{ "total": 1397, "compensating_controls": [ { "control_id": "GOV-03", "risk_if_not_implemented": "Without Centralized Management of Security, Compliance & Resilience Controls, security, compliance and resilience activities may lack direction, ownership and executive support, leaving required controls unperformed. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unaddressed Security / Compliance Exposure (R-GV-2), Unperformed / Unowned Control Responsibilities (R-GV-3), Lack of oversight of internal controls (R-GV-6), Inability to Demonstrate Due Diligence / Due Care (R-GV-9), Unreliable Assurance / Decision Information (R-GV-10), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9).", "compensating_control_1": { "control_id": "TDA-05", "name": "Secure Software Development Practices (SSDP)", "description": "Mechanisms exist to develop applications based on Secure Software Development Practices (SSDP).", "justification": "Secure Software Development Practices (SSDP) (TDA-05) provides overlapping security capability that compensates for the absence of Centralized Management of Security, Compliance & Resilience Controls (GOV-03) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CFG-04", "name": "Secure Baseline Configurations", "description": "Mechanisms exist to develop, document and maintain secure baseline configurations for Technology Assets, Applications and/or Services (TAAS) that are consistent with industry-accepted hardening standards.", "justification": "Secure Baseline Configurations (CFG-04) provides configuration hardening that compensates for the absence of Centralized Management of Security, Compliance & Resilience Controls (GOV-03) by eliminating unnecessary services and enforcing secure settings to reduce inherent exposure. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "GOV-03.1", "risk_if_not_implemented": "Without Secure Practices Alignment Justification, security, compliance and resilience activities may lack direction, ownership and executive support, leaving required controls unperformed. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss of Authorization / Certification / License (R-EX-11), Unaddressed Security / Compliance Exposure (R-GV-2), Inability to Demonstrate Due Diligence / Due Care (R-GV-9), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11).", "compensating_control_1": { "control_id": "CPL-02", "name": "Statutory, Regulatory & Contractual Compliance", "description": "Mechanisms exist to facilitate the identification and implementation of relevant statutory, regulatory and contractual controls.", "justification": "Statutory, Regulatory & Contractual Compliance (CPL-02) provides third-party oversight and contractual controls that compensates for the absence of Secure Practices Alignment Justification (GOV-03.1) by extending security obligations and monitoring third-party risk in lieu of direct primary control implementation. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "GOV-03.3", "name": "Control Objectives", "description": "Mechanisms exist to establish control objectives as the basis for the design, selection, implementation and management of the organization's internal security, compliance and resilience control system.", "justification": "Control Objectives (GOV-03.3) provides overlapping security capability that compensates for the absence of Secure Practices Alignment Justification (GOV-03.1) by addressing related risk objectives through an alternative control mechanism. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "GOV-03.2", "risk_if_not_implemented": "Without Standardized Terminology, security, compliance and resilience activities may lack direction, ownership and executive support, leaving required controls unperformed. Based on the risk and threat mapping for this control, no risk is rated Likely; risks rated Possible include Failure to Support Business / Mission Objectives (R-GV-1), Unaddressed Security / Compliance Exposure (R-GV-2), Unperformed / Unowned Control Responsibilities (R-GV-3), and most likely increases susceptibility to Human Error (MT-9).", "compensating_control_1": { "control_id": "NET-06", "name": "Network Segmentation (macrosegmentation)", "description": "Mechanisms exist to implement network segmentation within network architectures to isolate Technology Assets, Applications and/or Services (TAAS) from other network resources.", "justification": "Network Segmentation (macrosegmentation) (NET-06) provides network-level access restriction that compensates for the absence of Standardized Terminology (GOV-03.2) by limiting attacker reach and lateral movement opportunities across the environment. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "SEA-04", "name": "Alignment With Enterprise Architecture", "description": "Mechanisms exist to develop an enterprise architecture, aligned with industry-recognized leading practices, with consideration for security, compliance and resilience principles that addresses risk to organizational operations, assets, individuals and other organizations.", "justification": "Alignment With Enterprise Architecture (SEA-04) provides overlapping security capability that compensates for the absence of Standardized Terminology (GOV-03.2) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "GOV-03.3", "risk_if_not_implemented": "Without Control Objectives, security, compliance and resilience activities may lack direction, ownership and executive support, leaving required controls unperformed. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unaddressed Security / Compliance Exposure (R-GV-2), Lack of oversight of internal controls (R-GV-6), Inability to Demonstrate Due Diligence / Due Care (R-GV-9), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11).", "compensating_control_1": { "control_id": "RSK-02", "name": "Risk Management Program", "description": "Mechanisms exist to facilitate the implementation of strategic, operational and tactical risk management controls that are aligned with:\n(1) The organization's Enterprise Risk Management (ERM); and\n(2) Industry-recognized cybersecurity risk management practices.", "justification": "Risk Management Program (RSK-02) provides policy-level governance that compensates for the absence of Define Control Objectives (GOV-03.3) by establishing documented expectations, accountability structures, and organizational guardrails. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "GOV-03.1", "name": "Secure Practices Alignment Justification", "description": "Mechanisms exist to align the organization's Security, Compliance & Resilience Program (SCRP) with one or more industry-recognized frameworks that:\n(1) Support external scrutiny; and\n(2) Provide defensible justification for secure practices.", "justification": "Secure Practices Alignment Justification (GOV-03.1) provides policy-level governance that compensates for the absence of Control Objectives (GOV-03.3) by aligning the Security, Compliance & Resilience Program (SCRP) to one or more industry-recognized frameworks, thereby inheriting that framework's codified control objectives as the basis for control design, selection, implementation and management. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "GOV-03.4", "risk_if_not_implemented": "Without Assessment Objectives (AO), security, compliance and resilience activities may lack direction, ownership and executive support, leaving required controls unperformed. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Lack of oversight of internal controls (R-GV-6), Inability to Demonstrate Due Diligence / Due Care (R-GV-9), Unreliable Assurance / Decision Information (R-GV-10), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Conflict of Interest (COI) / Undue Influence / Insider Misconduct (MT-15).", "compensating_control_1": { "control_id": "IAO-04", "name": "Control Validation Testing (CVT)", "description": "Mechanisms exist to formally assess the security, compliance and resilience controls in Technology Assets, Applications and/or Services (TAAS) through Information Assurance Program (IAP) activities to determine the extent to which the controls are implemented correctly, operating as intended and producing the desired outcome with respect to meeting expected requirements.", "justification": "Control Validation Testing (CVT) (IAO-04) provides periodic assessment and assurance that compensates for the absence of Assessment Objectives (AO) (GOV-03.4) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CPL-07.3", "name": "Audit Planning Activities", "description": "Mechanisms exist to thoughtfully plan audits by including input from operational risk and compliance partners to minimize the impact of audit-related activities on business operations.", "justification": "Audit Planning Activities (CPL-07.3) provides detective monitoring capability that compensates for the absence of Assessment Objectives (AO) (GOV-03.4) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "GOV-04.1", "risk_if_not_implemented": "Without Periodic Review & Update of Security, Compliance & Resilience Program, security, compliance and resilience activities may lack direction, ownership and executive support, leaving required controls unperformed. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss of Authorization / Certification / License (R-EX-11), Unaddressed Security / Compliance Exposure (R-GV-2), Lack of oversight of internal controls (R-GV-6), Inability to Demonstrate Due Diligence / Due Care (R-GV-9), Unreliable Assurance / Decision Information (R-GV-10), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11).", "compensating_control_1": { "control_id": "CPL-05", "name": "Conformity Monitoring", "description": "Mechanisms exist to validate that Technology Assets, Applications, Services and/or Data (TAASD) conform to the organization's security, compliance and/or resilience policies, standards and other applicable requirements.", "justification": "Conformity Monitoring (CPL-05) provides periodic assessment and assurance that compensates for the absence of Periodic Review & Update of Security, Compliance & Resilience Program (GOV-04.1) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "RSK-13.2", "name": "Risk Assessment Update", "description": "Mechanisms exist to routinely update risk assessments and react accordingly upon identifying new security vulnerabilities, including using outside sources for security vulnerability information.", "justification": "Risk Assessment Update (RSK-13.2) provides periodic assessment and assurance that compensates for the absence of Periodic Review & Update of Security, Compliance & Resilience Program (GOV-04.1) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "GOV-04.2", "risk_if_not_implemented": "Without Exception Management, security, compliance and resilience activities may lack direction, ownership and executive support, leaving required controls unperformed. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unaddressed Security / Compliance Exposure (R-GV-2), Uncontrolled Internal Security / Privacy Exposure (R-GV-4), Lack of oversight of internal controls (R-GV-6), Inability to Demonstrate Due Diligence / Due Care (R-GV-9), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Fraud, Corruption and/or Intentional Criminal Conduct (MT-14), Conflict of Interest (COI) / Undue Influence / Insider Misconduct (MT-15).", "compensating_control_1": { "control_id": "RSK-13", "name": "Risk Assessment", "description": "Mechanisms exist to conduct recurring assessments of risk that includes the likelihood and magnitude of harm, from unauthorized access, use, disclosure, disruption, modification or destruction of the organization's Technology Assets, Applications, Services and/or Data (TAASD).", "justification": "Risk Assessment (RSK-13) provides periodic assessment and assurance that compensates for the absence of Exception Management (GOV-04.2) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CPL-07", "name": "Executive Leadership Oversight of Security, Compliance & Resilience Controls", "description": "Mechanisms exist to provide a security, compliance and resilience controls oversight function that reports to the organization's executive leadership.", "justification": "Executive Leadership Oversight of Security, Compliance & Resilience Controls (CPL-07) provides resilience and recovery capability that compensates for the absence of Exception Management (GOV-04.2) by ensuring the organization can restore operations and data when the primary control is absent. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "GOV-04.3", "risk_if_not_implemented": "Without Periodic Review of Exceptions, security, compliance and resilience activities may lack direction, ownership and executive support, leaving required controls unperformed. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unaddressed Security / Compliance Exposure (R-GV-2), Uncontrolled Internal Security / Privacy Exposure (R-GV-4), Lack of oversight of internal controls (R-GV-6), Inability to Demonstrate Due Diligence / Due Care (R-GV-9), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11), Conflict of Interest (COI) / Undue Influence / Insider Misconduct (MT-15).", "compensating_control_1": { "control_id": "CFG-06", "name": "Approved Configuration Deviations", "description": "Mechanisms exist to document, assess and approve or deny deviations to secure baseline configurations.", "justification": "Approved Configuration Deviations (CFG-06) provides configuration hardening and change discipline that compensates for the absence of Periodic Review of Exceptions (GOV-04.3) by enforcing secure settings and trusted software sources to reduce inherent exposure. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "RSK-22", "name": "Risk Monitoring", "description": "Mechanisms exist to monitor risk as an integral part of the continuous monitoring strategy, including: \n(1) The effectiveness of security, compliance and resilience controls; \n(2) Changes to the organization's risk profile; and \n(3) Changes to Technology Assets, Applications and/or Services (TAAS) that affect risk.", "justification": "Risk Monitoring (RSK-22) provides detective monitoring capability that compensates for the absence of Periodic Review of Exceptions (GOV-04.3) by identifying unauthorized, anomalous or non-compliant activity that the primary control would have prevented. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "GOV-05.1", "risk_if_not_implemented": "Without Stakeholder Accountability Structure, unauthorized individuals, devices or services may gain access to Technology Assets, Applications, Services, Data and/or Facilities (TAASDF). Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unperformed / Unowned Control Responsibilities (R-GV-3), Inability to Demonstrate Due Diligence / Due Care (R-GV-9), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9).", "compensating_control_1": { "control_id": "HRS-14", "name": "Separation of Duties (SoD)", "description": "Mechanisms exist to implement and maintain Separation of Duties (SoD) to prevent potential inappropriate activity without collusion.", "justification": "Separation of Duties (SoD) (HRS-14) provides overlapping security capability that compensates for the absence of Stakeholder Accountability Structure (GOV-05.1) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "GOV-05", "name": "Assigned Security, Compliance & Resilience Responsibilities", "description": "Mechanisms exist to assign one or more qualified individuals with the mission and resources to centrally-manage, coordinate, develop, implement and maintain an enterprise-wide Security, Compliance & Resilience Program (SCRP).", "justification": "Assigned Security, Compliance & Resilience Responsibilities (GOV-05) provides resilience and recovery capability that compensates for the absence of Stakeholder Accountability Structure (GOV-05.1) by ensuring the organization can restore operations and data when the primary control is absent. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "GOV-05.2", "risk_if_not_implemented": "Without Authoritative Chain of Command, security, compliance and resilience activities may lack direction, ownership and executive support, leaving required controls unperformed. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unperformed / Unowned Control Responsibilities (R-GV-3), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9).", "compensating_control_1": { "control_id": "HRS-04", "name": "Defined Roles & Responsibilities", "description": "Mechanisms exist to define cybersecurity roles & responsibilities for all personnel.", "justification": "Defined Roles & Responsibilities (HRS-04) provides overlapping security capability that compensates for the absence of Authoritative Chain of Command (GOV-05.2) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "GOV-05", "name": "Assigned Security, Compliance & Resilience Responsibilities", "description": "Mechanisms exist to assign one or more qualified individuals with the mission and resources to centrally-manage, coordinate, develop, implement and maintain an enterprise-wide Security, Compliance & Resilience Program (SCRP).", "justification": "Assigned Security, Compliance & Resilience Responsibilities (GOV-05) provides resilience and recovery capability that compensates for the absence of Authoritative Chain of Command (GOV-05.2) by ensuring the organization can restore operations and data when the primary control is absent. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "GOV-06", "risk_if_not_implemented": "Without Defining Business Context & Mission, security, compliance and resilience activities may lack direction, ownership and executive support, leaving required controls unperformed. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Failure to Support Business / Mission Objectives (R-GV-1), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9).", "compensating_control_1": { "control_id": "RSK-02", "name": "Risk Management Program", "description": "Mechanisms exist to facilitate the implementation of strategic, operational and tactical risk management controls that are aligned with:\n(1) The organization's Enterprise Risk Management (ERM); and\n(2) Industry-recognized cybersecurity risk management practices.", "justification": "Risk Management Program (RSK-02) provides policy-level governance that compensates for the absence of Defining Business Context & Mission (GOV-06) by establishing documented expectations, accountability structures, and organizational guardrails. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "PRM-09", "name": "Security, Compliance & Resilience Requirements Definition", "description": "Mechanisms exist to proactively govern Technology Assets, Applications and/or Services (TAAS) by:\n(1) Defining technical security, compliance and resilience requirements; and\n(2) Performing a criticality analysis at predefined decision points in the Secure Development Life Cycle (SDLC).", "justification": "Security, Compliance & Resilience Requirements Definition (PRM-09) provides resilience and recovery capability that compensates for the absence of Defining Business Context & Mission (GOV-06) by ensuring the organization can restore operations and data when the primary control is absent. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "GOV-07", "risk_if_not_implemented": "Without Materiality Determination, security, compliance and resilience activities may lack direction, ownership and executive support, leaving required controls unperformed. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Regulatory / Legal / Contractual Financial Liability (R-EX-5), Unreliable Assurance / Decision Information (R-GV-10), Delayed Containment / Increased Incident Impact (R-IR-2), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11).", "compensating_control_1": { "control_id": "RSK-15", "name": "Risk Ranking", "description": "Mechanisms exist to identify and assign a risk ranking to newly discovered security vulnerabilities that is based on industry-recognized practices.", "justification": "Risk Ranking (RSK-15) provides risk identification and prioritization that compensates for the absence of Materiality Determination (GOV-07) by enabling informed decisions about where to focus resources to manage residual exposure. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CPL-07", "name": "Executive Leadership Oversight of Security, Compliance & Resilience Controls", "description": "Mechanisms exist to provide a security, compliance and resilience controls oversight function that reports to the organization's executive leadership.", "justification": "Executive Leadership Oversight of Security, Compliance & Resilience Controls (CPL-07) provides resilience and recovery capability that compensates for the absence of Materiality Determination (GOV-07) by ensuring the organization can restore operations and data when the primary control is absent. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "GOV-08", "risk_if_not_implemented": "Without High Value Assets (HVAs), the organization's most critical assets may not receive proportionate protection, leaving them disproportionately exposed to compromise. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unaddressed Security / Compliance Exposure (R-GV-2), Unperformed / Unowned Control Responsibilities (R-GV-3), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Data Quality Degradation / Data Poisoning (MT-12).", "compensating_control_1": { "control_id": "AST-04", "name": "Asset Inventories", "description": "Mechanisms exist to perform inventories of Technology Assets, Applications, Services and/or Data (TAASD) that:\n(1) Accurately reflects the current TAASD in use; \n(2) Identifies authorized software products, including business justification details;\n(3) Is at the level of granularity deemed necessary for tracking and reporting;\n(4) Includes organization-defined information deemed necessary to achieve effective property accountability; and\n(5) Is available for review and audit by designated organizational personnel.", "justification": "Asset Inventories (AST-04) provides asset and inventory visibility that compensates for the absence of Crown Jewels (GOV-08) by providing the foundational asset knowledge needed to manage risks associated with the primary control. Given the data-handling focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "RSK-15", "name": "Risk Ranking", "description": "Mechanisms exist to identify and assign a risk ranking to newly discovered security vulnerabilities that is based on industry-recognized practices.", "justification": "Risk Ranking (RSK-15) provides risk identification and prioritization that compensates for the absence of Crown Jewels (GOV-08) by enabling informed decisions about where to focus resources to manage residual exposure. Given the data-handling focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "GOV-09", "risk_if_not_implemented": "Without Steering Committee & Program Oversight, security, compliance and resilience activities may lack direction, ownership and executive support, leaving required controls unperformed. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Failure to Support Business / Mission Objectives (R-GV-1), Lack of oversight of internal controls (R-GV-6), Inability to Demonstrate Due Diligence / Due Care (R-GV-9), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Conflict of Interest (COI) / Undue Influence / Insider Misconduct (MT-15).", "compensating_control_1": { "control_id": "GOV-05", "name": "Assigned Security, Compliance & Resilience Responsibilities", "description": "Mechanisms exist to assign one or more qualified individuals with the mission and resources to centrally-manage, coordinate, develop, implement and maintain an enterprise-wide Security, Compliance & Resilience Program (SCRP).", "justification": "Assigned Security, Compliance & Resilience Responsibilities (GOV-05) provides resilience and recovery capability that compensates for the absence of Steering Committee & Program Oversight (GOV-09) by ensuring the organization can restore operations and data when the primary control is absent. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "RSK-02", "name": "Risk Management Program", "description": "Mechanisms exist to facilitate the implementation of strategic, operational and tactical risk management controls that are aligned with:\n(1) The organization's Enterprise Risk Management (ERM); and\n(2) Industry-recognized cybersecurity risk management practices.", "justification": "Risk Management Program (RSK-02) provides policy-level governance that compensates for the absence of Steering Committee & Program Oversight (GOV-09) by establishing documented expectations, accountability structures, and organizational guardrails. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "GOV-09.1", "risk_if_not_implemented": "Without Status Reporting To Governing Body, security, compliance and resilience activities may lack direction, ownership and executive support, leaving required controls unperformed. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Lack of oversight of internal controls (R-GV-6), Inability to Demonstrate Due Diligence / Due Care (R-GV-9), Unreliable Assurance / Decision Information (R-GV-10), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Data Quality Degradation / Data Poisoning (MT-12), Conflict of Interest (COI) / Undue Influence / Insider Misconduct (MT-15).", "compensating_control_1": { "control_id": "GOV-12", "name": "Measures of Performance", "description": "Mechanisms exist to develop, report and monitor Security, Compliance & Resilience Program (SCRP) measures of performance.", "justification": "Measures of Performance (GOV-12) provides overlapping security capability that compensates for the absence of Status Reporting To Governing Body (GOV-09.1) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CPL-07", "name": "Executive Leadership Oversight of Security, Compliance & Resilience Controls", "description": "Mechanisms exist to provide a security, compliance and resilience controls oversight function that reports to the organization's executive leadership.", "justification": "Executive Leadership Oversight of Security, Compliance & Resilience Controls (CPL-07) provides resilience and recovery capability that compensates for the absence of Status Reporting To Governing Body (GOV-09.1) by ensuring the organization can restore operations and data when the primary control is absent. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "GOV-10", "risk_if_not_implemented": "Without Business As Usual (BAU) Security, Compliance & Resilience Practices, security, compliance and resilience activities may lack direction, ownership and executive support, leaving required controls unperformed. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Uncontrolled Internal Security / Privacy Exposure (R-GV-4), Inability to Demonstrate Due Diligence / Due Care (R-GV-9), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9).", "compensating_control_1": { "control_id": "GOV-02", "name": "Security, Compliance & Resilience Program (SCRP)", "description": "Mechanisms exist to facilitate the design, implementation, and monitoring of security, compliance and resilience governance controls.", "justification": "Security, Compliance & Resilience Program (SCRP) (GOV-02) provides resilience and recovery capability that compensates for the absence of Business As Usual (BAU) Security, Compliance & Resilience Practices (GOV-10) by ensuring the organization can restore operations and data when the primary control is absent. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "SAT-04", "name": "Security, Compliance & Resilience Awareness Training", "description": "Mechanisms exist to provide all employees and contractors appropriate security, compliance and resilience awareness education and training that is relevant for their job function.", "justification": "Security, Compliance & Resilience Awareness Training (SAT-04) provides personnel training and awareness that compensates for the absence of Business As Usual (BAU) Security, Compliance & Resilience Practices (GOV-10) by reducing human-factor risk by equipping personnel to recognize and respond to relevant threats. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "GOV-11", "risk_if_not_implemented": "Without Operationalizing Security, Compliance & Resilience Capabilities, security, compliance and resilience activities may lack direction, ownership and executive support, leaving required controls unperformed. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unperformed / Unowned Control Responsibilities (R-GV-3), Uncontrolled Internal Security / Privacy Exposure (R-GV-4), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9).", "compensating_control_1": { "control_id": "RSK-02", "name": "Risk Management Program", "description": "Mechanisms exist to facilitate the implementation of strategic, operational and tactical risk management controls that are aligned with:\n(1) The organization's Enterprise Risk Management (ERM); and\n(2) Industry-recognized cybersecurity risk management practices.", "justification": "Risk Management Program (RSK-02) provides policy-level governance that compensates for the absence of Operationalizing Security, Compliance & Resilience Capabilities (GOV-11) by establishing documented expectations, accountability structures, and organizational guardrails. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CPL-14", "name": "Control Reciprocity", "description": "Mechanisms exist to define instances of control reciprocity within assessment boundaries.", "justification": "Control Reciprocity (CPL-14) provides overlapping security capability that compensates for the absence of Operationalizing Security, Compliance & Resilience Capabilities (GOV-11) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "GOV-11.1", "risk_if_not_implemented": "Without Select Controls, security, compliance and resilience activities may lack direction, ownership and executive support, leaving required controls unperformed. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unaddressed Security / Compliance Exposure (R-GV-2), Unperformed / Unowned Control Responsibilities (R-GV-3), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11).", "compensating_control_1": { "control_id": "RSK-13", "name": "Risk Assessment", "description": "Mechanisms exist to conduct recurring assessments of risk that includes the likelihood and magnitude of harm, from unauthorized access, use, disclosure, disruption, modification or destruction of the organization's Technology Assets, Applications, Services and/or Data (TAASD).", "justification": "Risk Assessment (RSK-13) provides periodic assessment and assurance that compensates for the absence of Select Controls (GOV-11.1) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CPL-25", "name": "Statement of Applicability (SOA)", "description": "Mechanisms exist to produce a Statement of Applicability (SOA), or similar document, for compliance-related scoping activities.", "justification": "Statement of Applicability (SOA) (CPL-25) provides overlapping security capability that compensates for the absence of Select Controls (GOV-11.1) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "GOV-11.2", "risk_if_not_implemented": "Without Implement Controls, security, compliance and resilience activities may lack direction, ownership and executive support, leaving required controls unperformed. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unperformed / Unowned Control Responsibilities (R-GV-3), Uncontrolled Internal Security / Privacy Exposure (R-GV-4), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9).", "compensating_control_1": { "control_id": "PRM-08", "name": "Security, Compliance & Resilience In Project Management", "description": "Mechanisms exist to assess security, compliance and resilience controls as part of Technology Assets, Applications and/or Services (TAAS) project development to determine whether controls are implemented correctly, operating as intended and producing the desired outcome with respect to meeting requirements.", "justification": "Security, Compliance & Resilience In Project Management (PRM-08) provides resilience and recovery capability that compensates for the absence of Implement Controls (GOV-11.2) by ensuring the organization can restore operations and data when the primary control is absent. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CPL-15", "name": "Control Inheritance", "description": "Mechanisms exist to define instances of control inheritance within assessment boundaries.", "justification": "Control Inheritance (CPL-15) provides overlapping security capability that compensates for the absence of Implement Controls (GOV-11.2) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "GOV-11.3", "risk_if_not_implemented": "Without Assess Controls, security, compliance and resilience activities may lack direction, ownership and executive support, leaving required controls unperformed. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Lack of oversight of internal controls (R-GV-6), Inability to Demonstrate Due Diligence / Due Care (R-GV-9), Unreliable Assurance / Decision Information (R-GV-10), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Conflict of Interest (COI) / Undue Influence / Insider Misconduct (MT-15).", "compensating_control_1": { "control_id": "CPL-05", "name": "Conformity Monitoring", "description": "Mechanisms exist to validate that Technology Assets, Applications, Services and/or Data (TAASD) conform to the organization's security, compliance and/or resilience policies, standards and other applicable requirements.", "justification": "Conformity Monitoring (CPL-05) provides periodic assessment and assurance that compensates for the absence of Assess Controls (GOV-11.3) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "IAO-04", "name": "Control Validation Testing (CVT)", "description": "Mechanisms exist to formally assess the security, compliance and resilience controls in Technology Assets, Applications and/or Services (TAAS) through Information Assurance Program (IAP) activities to determine the extent to which the controls are implemented correctly, operating as intended and producing the desired outcome with respect to meeting expected requirements.", "justification": "Control Validation Testing (CVT) (IAO-04) provides periodic assessment and assurance that compensates for the absence of Assess Controls (GOV-11.3) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "GOV-11.4", "risk_if_not_implemented": "Without Authorize Technology Assets, Applications and/or Services (TAAS), security, compliance and resilience activities may lack direction, ownership and executive support, leaving required controls unperformed. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unaddressed Security / Compliance Exposure (R-GV-2), Unperformed / Unowned Control Responsibilities (R-GV-3), Inability to Demonstrate Due Diligence / Due Care (R-GV-9), Harm from Unauthorized / Unintended Product or Service Use (R-SC-5), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Fraud, Corruption and/or Intentional Criminal Conduct (MT-14).", "compensating_control_1": { "control_id": "IAC-02", "name": "Identity & Access Management (IAM)", "description": "Mechanisms exist to facilitate the implementation of Identification and Access Management (IAM) controls.", "justification": "Identity & Access Management (IAM) (IAC-02) provides access control enforcement that compensates for the absence of Authorize Technology Assets, Applications and/or Services (TAAS) (GOV-11.4) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "RSK-13", "name": "Risk Assessment", "description": "Mechanisms exist to conduct recurring assessments of risk that includes the likelihood and magnitude of harm, from unauthorized access, use, disclosure, disruption, modification or destruction of the organization's Technology Assets, Applications, Services and/or Data (TAASD).", "justification": "Risk Assessment (RSK-13) provides periodic assessment and assurance that compensates for the absence of Authorize Technology Assets, Applications and/or Services (TAAS) (GOV-11.4) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "GOV-11.5", "risk_if_not_implemented": "Without Monitor Controls, malicious, anomalous or unauthorized activity may go undetected or be detected too late to prevent or limit harm. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unperformed / Unowned Control Responsibilities (R-GV-3), Lack of oversight of internal controls (R-GV-6), Inability to Demonstrate Due Diligence / Due Care (R-GV-9), Unreliable Assurance / Decision Information (R-GV-10), Undetected / Delayed Detection of Adverse Activity (R-SA-1), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Data Quality Degradation / Data Poisoning (MT-12).", "compensating_control_1": { "control_id": "MON-02", "name": "Continuous Monitoring", "description": "Mechanisms exist to facilitate the implementation of enterprise-wide monitoring controls.", "justification": "Continuous Monitoring (MON-02) provides detective monitoring capability that compensates for the absence of Monitor Controls (GOV-11.5) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CPL-07", "name": "Executive Leadership Oversight of Security, Compliance & Resilience Controls", "description": "Mechanisms exist to provide a security, compliance and resilience controls oversight function that reports to the organization's executive leadership.", "justification": "Executive Leadership Oversight of Security, Compliance & Resilience Controls (CPL-07) provides resilience and recovery capability that compensates for the absence of Monitor Controls (GOV-11.5) by ensuring the organization can restore operations and data when the primary control is absent. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "GOV-12", "risk_if_not_implemented": "Without Measures of Performance, Technology Assets, Applications and/or Services (TAAS) may become unavailable, degraded or unable to meet demand when required. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Lack of oversight of internal controls (R-GV-6), Inability to Demonstrate Due Diligence / Due Care (R-GV-9), Unreliable Assurance / Decision Information (R-GV-10), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Data Quality Degradation / Data Poisoning (MT-12).", "compensating_control_1": { "control_id": "CPL-07", "name": "Executive Leadership Oversight of Security, Compliance & Resilience Controls", "description": "Mechanisms exist to provide a security, compliance and resilience controls oversight function that reports to the organization's executive leadership.", "justification": "Executive Leadership Oversight of Security, Compliance & Resilience Controls (CPL-07) provides resilience and recovery capability that compensates for the absence of Measures of Performance (GOV-12) by ensuring the organization can restore operations and data when the primary control is absent. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "RSK-22", "name": "Risk Monitoring", "description": "Mechanisms exist to monitor risk as an integral part of the continuous monitoring strategy, including: \n(1) The effectiveness of security, compliance and resilience controls; \n(2) Changes to the organization's risk profile; and \n(3) Changes to Technology Assets, Applications and/or Services (TAAS) that affect risk.", "justification": "Risk Monitoring (RSK-22) provides detective monitoring capability that compensates for the absence of Measures of Performance (GOV-12) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "GOV-12.1", "risk_if_not_implemented": "Without Key Performance Indicators (KPIs), Technology Assets, Applications and/or Services (TAAS) may become unavailable, degraded or unable to meet demand when required. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Lack of oversight of internal controls (R-GV-6), Inability to Demonstrate Due Diligence / Due Care (R-GV-9), Unreliable Assurance / Decision Information (R-GV-10), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Data Quality Degradation / Data Poisoning (MT-12).", "compensating_control_1": { "control_id": "MON-06", "name": "Monitoring Reporting", "description": "Mechanisms exist to provide an event log report generation capability to aid in detecting and assessing anomalous activities.", "justification": "Monitoring Reporting (MON-06) provides detective monitoring capability that compensates for the absence of Key Performance Indicators (KPIs) (GOV-12.1) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "RSK-22", "name": "Risk Monitoring", "description": "Mechanisms exist to monitor risk as an integral part of the continuous monitoring strategy, including: \n(1) The effectiveness of security, compliance and resilience controls; \n(2) Changes to the organization's risk profile; and \n(3) Changes to Technology Assets, Applications and/or Services (TAAS) that affect risk.", "justification": "Risk Monitoring (RSK-22) provides detective monitoring capability that compensates for the absence of Key Performance Indicators (KPIs) (GOV-12.1) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "GOV-12.2", "risk_if_not_implemented": "Without Key Risk Indicators (KRIs), malicious, anomalous or unauthorized activity may go undetected or be detected too late to prevent or limit harm. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Lack of oversight of internal controls (R-GV-6), Inability to Demonstrate Due Diligence / Due Care (R-GV-9), Unreliable Assurance / Decision Information (R-GV-10), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Data Quality Degradation / Data Poisoning (MT-12).", "compensating_control_1": { "control_id": "RSK-15", "name": "Risk Ranking", "description": "Mechanisms exist to identify and assign a risk ranking to newly discovered security vulnerabilities that is based on industry-recognized practices.", "justification": "Risk Ranking (RSK-15) provides risk identification and prioritization that compensates for the absence of Key Risk Indicators (KRIs) (GOV-12.2) by enabling informed decisions about where to focus resources to manage residual exposure. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "MON-06", "name": "Monitoring Reporting", "description": "Mechanisms exist to provide an event log report generation capability to aid in detecting and assessing anomalous activities.", "justification": "Monitoring Reporting (MON-06) provides detective monitoring capability that compensates for the absence of Key Risk Indicators (KRIs) (GOV-12.2) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "GOV-15", "risk_if_not_implemented": "Without Contacts With Authorities, security, compliance and resilience activities may lack direction, ownership and executive support, leaving required controls unperformed. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Delayed Containment / Increased Incident Impact (R-IR-2), and most likely increases susceptibility to Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11).", "compensating_control_1": { "control_id": "IRO-16", "name": "Incident Stakeholder Reporting", "description": "Mechanisms exist to timely-report incidents to applicable:\n(1) Internal stakeholders; \n(2) Affected clients & third-parties; and\n(3) Regulatory authorities.", "justification": "Incident Stakeholder Reporting (IRO-16) provides incident response capability that compensates for the absence of Contacts With Authorities (GOV-15) by enabling timely detection, containment, and recovery from security events in the absence of the primary control. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CPL-02", "name": "Statutory, Regulatory & Contractual Compliance", "description": "Mechanisms exist to facilitate the identification and implementation of relevant statutory, regulatory and contractual controls.", "justification": "Statutory, Regulatory & Contractual Compliance (CPL-02) provides overlapping security capability that compensates for the absence of Contacts With Authorities (GOV-15) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "GOV-16", "risk_if_not_implemented": "Without Contacts With Groups & Associations, security, compliance and resilience activities may lack direction, ownership and executive support, leaving required controls unperformed. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Lack of a security-minded workforce (R-SA-2), and most likely increases susceptibility to Human Error (MT-9).", "compensating_control_1": { "control_id": "THR-02", "name": "Threat Intelligence Program", "description": "Mechanisms exist to implement a threat intelligence program that includes a cross-organization information-sharing capability that can influence the development of the system and security architectures, selection of security solutions, monitoring, threat hunting, response and recovery activities.", "justification": "Threat Intelligence Program (THR-02) provides policy-level governance that compensates for the absence of Contacts With Groups & Associations (GOV-16) by establishing documented expectations, accountability structures, and organizational guardrails. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CPL-05", "name": "Conformity Monitoring", "description": "Mechanisms exist to validate that Technology Assets, Applications, Services and/or Data (TAASD) conform to the organization's security, compliance and/or resilience policies, standards and other applicable requirements.", "justification": "Conformity Monitoring (CPL-05) provides periodic assessment and assurance that compensates for the absence of Contacts With Groups & Associations (GOV-16) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "GOV-17", "risk_if_not_implemented": "Without Quality Management System (QMS), security, compliance and resilience activities may lack direction, ownership and executive support, leaving required controls unperformed. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss of Authorization / Certification / License (R-EX-11), Lack of oversight of internal controls (R-GV-6), Inability to Demonstrate Due Diligence / Due Care (R-GV-9), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11).", "compensating_control_1": { "control_id": "CPL-05", "name": "Conformity Monitoring", "description": "Mechanisms exist to validate that Technology Assets, Applications, Services and/or Data (TAASD) conform to the organization's security, compliance and/or resilience policies, standards and other applicable requirements.", "justification": "Conformity Monitoring (CPL-05) provides periodic assessment and assurance that compensates for the absence of Quality Management System (QMS) (GOV-17) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "IAO-04", "name": "Control Validation Testing (CVT)", "description": "Mechanisms exist to formally assess the security, compliance and resilience controls in Technology Assets, Applications and/or Services (TAAS) through Information Assurance Program (IAP) activities to determine the extent to which the controls are implemented correctly, operating as intended and producing the desired outcome with respect to meeting expected requirements.", "justification": "Control Validation Testing (CVT) (IAO-04) provides periodic assessment and assurance that compensates for the absence of Quality Management System (QMS) (GOV-17) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "GOV-18", "risk_if_not_implemented": "Without Assurance, executive management, the Board of Directors (BoD) and assessors may rely on inaccurate, incomplete or unverifiable control and risk information. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Lack of oversight of internal controls (R-GV-6), Inability to Demonstrate Due Diligence / Due Care (R-GV-9), Unreliable Assurance / Decision Information (R-GV-10), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9).", "compensating_control_1": { "control_id": "CPL-05", "name": "Conformity Monitoring", "description": "Mechanisms exist to validate that Technology Assets, Applications, Services and/or Data (TAASD) conform to the organization's security, compliance and/or resilience policies, standards and other applicable requirements.", "justification": "Conformity Monitoring (CPL-05) provides periodic assessment and assurance that compensates for the absence of Assurance (GOV-18) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "IAO-04", "name": "Control Validation Testing (CVT)", "description": "Mechanisms exist to formally assess the security, compliance and resilience controls in Technology Assets, Applications and/or Services (TAAS) through Information Assurance Program (IAP) activities to determine the extent to which the controls are implemented correctly, operating as intended and producing the desired outcome with respect to meeting expected requirements.", "justification": "Control Validation Testing (CVT) (IAO-04) provides periodic assessment and assurance that compensates for the absence of Assurance (GOV-18) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "GOV-19", "risk_if_not_implemented": "Without Mergers, Acquisitions & Divestitures (MA&D), security, compliance and resilience activities may lack direction, ownership and executive support, leaving required controls unperformed. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unaddressed Security / Compliance Exposure (R-GV-2), Inability to Demonstrate Due Diligence / Due Care (R-GV-9), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9).", "compensating_control_1": { "control_id": "RSK-13", "name": "Risk Assessment", "description": "Mechanisms exist to conduct recurring assessments of risk that includes the likelihood and magnitude of harm, from unauthorized access, use, disclosure, disruption, modification or destruction of the organization's Technology Assets, Applications, Services and/or Data (TAASD).", "justification": "Risk Assessment (RSK-13) provides periodic assessment and assurance that compensates for the absence of Mergers, Acquisitions & Divestitures (MA&D) (GOV-19) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "TPM-02", "name": "Third-Party Management", "description": "Mechanisms exist to facilitate the implementation of third-party management controls.", "justification": "Third-Party Management (TPM-02) provides third-party oversight that compensates for the absence of Mergers, Acquisitions & Divestitures (MA&D) (GOV-19) by extending security obligations contractually and monitoring third-party risk in lieu of direct control. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "GOV-19.1", "risk_if_not_implemented": "Without Virtual Data Room (VDR), security, compliance and resilience activities may lack direction, ownership and executive support, leaving required controls unperformed. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Access (R-AC-4), Loss of Confidentiality (R-IP-2), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9).", "compensating_control_1": { "control_id": "TPM-02", "name": "Third-Party Management", "description": "Mechanisms exist to facilitate the implementation of third-party management controls.", "justification": "Third-Party Management (TPM-02) provides third-party oversight that compensates for the absence of Virtual Data Room (VDR) (GOV-19.1) by extending security obligations contractually and monitoring third-party risk in lieu of direct control. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "RSK-13", "name": "Risk Assessment", "description": "Mechanisms exist to conduct recurring assessments of risk that includes the likelihood and magnitude of harm, from unauthorized access, use, disclosure, disruption, modification or destruction of the organization's Technology Assets, Applications, Services and/or Data (TAASD).", "justification": "Risk Assessment (RSK-13) provides periodic assessment and assurance that compensates for the absence of Virtual Data Room (VDR) (GOV-19.1) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "AAT-03", "risk_if_not_implemented": "Without AI & Autonomous Technologies Mission and Goals Definition, AI and autonomous systems may produce unreliable, biased or unsafe outputs, act outside authorized scope, or expose sensitive data. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Failure to Achieve Strategic / Mission Objectives (R-EX-8), Failure to Support Business / Mission Objectives (R-GV-1), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9).", "compensating_control_1": { "control_id": "AAT-02", "name": "Artificial Intelligence (AI) & Autonomous Technologies Governance", "description": "Mechanisms exist to ensure policies, processes, procedures and practices related to the mapping, measuring and managing of Artificial Intelligence (AI) and Autonomous Technologies (AAT)-related risks are in place, transparent and implemented effectively.", "justification": "Artificial Intelligence (AI) & Autonomous Technologies Governance (AAT-02) provides detective monitoring capability that compensates for the absence of AI & Autonomous Technologies Mission and Goals Definition (AAT-03) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "GOV-06", "name": "Defining Business Context & Mission", "description": "Mechanisms exist to document the organization's business model and mission.", "justification": "Defining Business Context & Mission (GOV-06) provides overlapping security capability that compensates for the absence of AI & Autonomous Technologies Mission and Goals Definition (AAT-03) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "AAT-03.1", "risk_if_not_implemented": "Without AI & Autonomous Technologies Value Sustainment, AI and autonomous systems may produce unreliable, biased or unsafe outputs, act outside authorized scope, or expose sensitive data. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Failure to Achieve Strategic / Mission Objectives (R-EX-8), Failure to Support Business / Mission Objectives (R-GV-1), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Workforce Shortage / Loss of Critical Skills / Labor Disruption (MT-25).", "compensating_control_1": { "control_id": "CPL-02", "name": "Statutory, Regulatory & Contractual Compliance", "description": "Mechanisms exist to facilitate the identification and implementation of relevant statutory, regulatory and contractual controls.", "justification": "Statutory, Regulatory & Contractual Compliance (CPL-02) provides overlapping security capability that compensates for the absence of AI & Autonomous Technologies Value Sustainment (AAT-03.1) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "GOV-03.3", "name": "Control Objectives", "description": "Mechanisms exist to establish control objectives as the basis for the design, selection, implementation and management of the organization's internal security, compliance and resilience control system.", "justification": "Control Objectives (GOV-03.3) provides overlapping security capability that compensates for the absence of AI & Autonomous Technologies Value Sustainment (AAT-03.1) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "AAT-04", "risk_if_not_implemented": "Without AI & Autonomous Technologies Context Definition, AI and autonomous systems may produce unreliable, biased or unsafe outputs, act outside authorized scope, or expose sensitive data. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Regulatory / Legal / Contractual Financial Liability (R-EX-5), Unaddressed Security / Compliance Exposure (R-GV-2), Harm from Unauthorized / Unintended Product or Service Use (R-SC-5), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11).", "compensating_control_1": { "control_id": "RSK-02", "name": "Risk Management Program", "description": "Mechanisms exist to facilitate the implementation of strategic, operational and tactical risk management controls that are aligned with:\n(1) The organization's Enterprise Risk Management (ERM); and\n(2) Industry-recognized cybersecurity risk management practices.", "justification": "Risk Management Program (RSK-02) provides policy-level governance that compensates for the absence of AI & Autonomous Technologies Context Definition (AAT-04) by establishing documented expectations, accountability structures, and organizational guardrails. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "GOV-06", "name": "Defining Business Context & Mission", "description": "Mechanisms exist to document the organization's business model and mission.", "justification": "Defining Business Context & Mission (GOV-06) provides overlapping security capability that compensates for the absence of AI & Autonomous Technologies Context Definition (AAT-04) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "AAT-04.1", "risk_if_not_implemented": "Without AI & Autonomous Technologies-Related Legal Requirements Identification, AI and autonomous systems may produce unreliable, biased or unsafe outputs, act outside authorized scope, or expose sensitive data. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Regulatory / Legal / Contractual Financial Liability (R-EX-5), Loss of Authorization / Certification / License (R-EX-11), Unaddressed Security / Compliance Exposure (R-GV-2), Inability to Demonstrate Due Diligence / Due Care (R-GV-9), and most likely increases susceptibility to Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11).", "compensating_control_1": { "control_id": "AAT-05", "name": "Assigned Responsibilities for AI & Autonomous Technologies", "description": "Mechanisms exist to define and differentiate roles and responsibilities for:\n(1) Artificial Intelligence (AI) and Autonomous Technologies (AAT) configurations; and\n(2) Oversight of AAT systems.", "justification": "Assigned Responsibilities for AI & Autonomous Technologies (AAT-05) provides detective monitoring capability that compensates for the absence of AI & Autonomous Technologies-Related Legal Requirements Definition (AAT-04.1) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "GOV-05", "name": "Assigned Security, Compliance & Resilience Responsibilities", "description": "Mechanisms exist to assign one or more qualified individuals with the mission and resources to centrally-manage, coordinate, develop, implement and maintain an enterprise-wide Security, Compliance & Resilience Program (SCRP).", "justification": "Assigned Security, Compliance & Resilience Responsibilities (GOV-05) provides resilience and recovery capability that compensates for the absence of AI & Autonomous Technologies-Related Legal Requirements Definition (AAT-04.1) by ensuring the organization can restore operations and data when the primary control is absent. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "AAT-05", "risk_if_not_implemented": "Without Assigned Responsibilities for AI & Autonomous Technologies, AI and autonomous systems may produce unreliable, biased or unsafe outputs, act outside authorized scope, or expose sensitive data. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unperformed / Unowned Control Responsibilities (R-GV-3), Lack of oversight of internal controls (R-GV-6), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Conflict of Interest (COI) / Undue Influence / Insider Misconduct (MT-15), Workforce Shortage / Loss of Critical Skills / Labor Disruption (MT-25).", "compensating_control_1": { "control_id": "GOV-05", "name": "Assigned Security, Compliance & Resilience Responsibilities", "description": "Mechanisms exist to assign one or more qualified individuals with the mission and resources to centrally-manage, coordinate, develop, implement and maintain an enterprise-wide Security, Compliance & Resilience Program (SCRP).", "justification": "Assigned Security, Compliance & Resilience Responsibilities (GOV-05) provides resilience and recovery capability that compensates for the absence of Assigned Responsibilities for AI & Autonomous Technologies (AAT-05) by ensuring the organization can restore operations and data when the primary control is absent. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "HRS-04", "name": "Defined Roles & Responsibilities", "description": "Mechanisms exist to define cybersecurity roles & responsibilities for all personnel.", "justification": "Defined Roles & Responsibilities (HRS-04) provides overlapping security capability that compensates for the absence of Assigned Responsibilities for AI & Autonomous Technologies (AAT-05) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "AAT-06.1", "risk_if_not_implemented": "Without AI & Autonomous Technologies Continuous Improvements, AI and autonomous systems may produce unreliable, biased or unsafe outputs, act outside authorized scope, or expose sensitive data. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Lack of oversight of internal controls (R-GV-6), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9).", "compensating_control_1": { "control_id": "RSK-13", "name": "Risk Assessment", "description": "Mechanisms exist to conduct recurring assessments of risk that includes the likelihood and magnitude of harm, from unauthorized access, use, disclosure, disruption, modification or destruction of the organization's Technology Assets, Applications, Services and/or Data (TAASD).", "justification": "Risk Assessment (RSK-13) provides periodic assessment and assurance that compensates for the absence of AI & Autonomous Technologies Continuous Improvements (AAT-06.1) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CPL-05", "name": "Conformity Monitoring", "description": "Mechanisms exist to validate that Technology Assets, Applications, Services and/or Data (TAASD) conform to the organization's security, compliance and/or resilience policies, standards and other applicable requirements.", "justification": "Conformity Monitoring (CPL-05) provides periodic assessment and assurance that compensates for the absence of AI & Autonomous Technologies Continuous Improvements (AAT-06.1) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "AAT-07", "risk_if_not_implemented": "Without Situational Awareness of AI & Autonomous Technologies In Use, personnel are more likely to make unsafe decisions, fall victim to social engineering, mishandle data or violate requirements. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unaddressed Security / Compliance Exposure (R-GV-2), Sensitive Data / Compliance Exposure from Unsanctioned AI Use (R-AI-4), and most likely increases susceptibility to Human Error (MT-9), Data Quality Degradation / Data Poisoning (MT-12).", "compensating_control_1": { "control_id": "THR-02", "name": "Threat Intelligence Program", "description": "Mechanisms exist to implement a threat intelligence program that includes a cross-organization information-sharing capability that can influence the development of the system and security architectures, selection of security solutions, monitoring, threat hunting, response and recovery activities.", "justification": "Threat Intelligence Program (THR-02) provides policy-level governance that compensates for the absence of Situational Awareness of AI & Autonomous Technologies (AAT-07) by establishing documented expectations, accountability structures, and organizational guardrails. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "MON-02", "name": "Continuous Monitoring", "description": "Mechanisms exist to facilitate the implementation of enterprise-wide monitoring controls.", "justification": "Continuous Monitoring (MON-02) provides detective monitoring capability that compensates for the absence of Situational Awareness of AI & Autonomous Technologies (AAT-07) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "AAT-07.1", "risk_if_not_implemented": "Without AI Model & Agent Inventory & Lifecycle Management, AI and autonomous systems may produce unreliable, biased or unsafe outputs, act outside authorized scope, or expose sensitive data. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss of Accountability / Attribution (R-AC-1), Unaddressed Security / Compliance Exposure (R-GV-2), Unperformed / Unowned Control Responsibilities (R-GV-3), Sensitive Data / Compliance Exposure from Unsanctioned AI Use (R-AI-4), and most likely increases susceptibility to Human Error (MT-9), Data Quality Degradation / Data Poisoning (MT-12).", "compensating_control_1": { "control_id": "TPM-02", "name": "Third-Party Management", "description": "Mechanisms exist to facilitate the implementation of third-party management controls.", "justification": "Third-Party Management (TPM-02) provides third-party oversight that compensates for the absence of AI Model & Agent Inventory & Lifecycle Management (AAT-07.1) by extending security obligations contractually and monitoring third-party risk in lieu of direct control. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "TPM-14", "name": "Third-Party Contract Requirements", "description": "Mechanisms exist to require contractual requirements for applicable security, compliance and resilience requirements with third-parties, reflecting the organization's needs to protect its Technology Assets, Applications, Services and/or Data (TAASD).", "justification": "Third-Party Contract Requirements (TPM-14) provides third-party oversight that compensates for the absence of AI Model & Agent Inventory & Lifecycle Management (AAT-07.1) by extending security obligations contractually and monitoring third-party risk in lieu of direct control. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "AAT-07.2", "risk_if_not_implemented": "Without Artificial Intelligence and Autonomous Technologies (AAT) & AI Agent Categorization, AI and autonomous systems may produce unreliable, biased or unsafe outputs, act outside authorized scope, or expose sensitive data. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unaddressed Security / Compliance Exposure (R-GV-2), Unperformed / Unowned Control Responsibilities (R-GV-3), Lack of oversight of internal controls (R-GV-6), Inability to Demonstrate Due Diligence / Due Care (R-GV-9), Sensitive Data / Compliance Exposure from Unsanctioned AI Use (R-AI-4), and most likely increases susceptibility to Human Error (MT-9).", "compensating_control_1": { "control_id": "AAT-02", "name": "Artificial Intelligence (AI) & Autonomous Technologies Governance", "description": "Mechanisms exist to ensure policies, processes, procedures and practices related to the mapping, measuring and managing of Artificial Intelligence (AI) and Autonomous Technologies (AAT)-related risks are in place, transparent and implemented effectively.", "justification": "Artificial Intelligence (AI) & Autonomous Technologies Governance (AAT-02) provides detective monitoring capability that compensates for the absence of Artificial Intelligence and Autonomous Technologies (AAT) & AI Agent Categorization (AAT-07.2) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "RSK-13", "name": "Risk Assessment", "description": "Mechanisms exist to conduct recurring assessments of risk that includes the likelihood and magnitude of harm, from unauthorized access, use, disclosure, disruption, modification or destruction of the organization's Technology Assets, Applications, Services and/or Data (TAASD).", "justification": "Risk Assessment (RSK-13) provides periodic assessment and verification that compensates for the absence of Artificial Intelligence and Autonomous Technologies (AAT) & AI Agent Categorization (AAT-07.2) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "AAT-08", "risk_if_not_implemented": "Without AI & Autonomous Technologies Internal Controls, AI and autonomous systems may produce unreliable, biased or unsafe outputs, act outside authorized scope, or expose sensitive data. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unaddressed Security / Compliance Exposure (R-GV-2), Uncontrolled Internal Security / Privacy Exposure (R-GV-4), Lack of oversight of internal controls (R-GV-6), Inability to Demonstrate Due Diligence / Due Care (R-GV-9), and most likely increases susceptibility to Human Error (MT-9).", "compensating_control_1": { "control_id": "TPM-09", "name": "Third-Party Criticality Assessments", "description": "Mechanisms exist to identify, prioritize and assess suppliers and partners of critical Technology Assets, Applications and/or Services (TAAS) using a supply chain risk assessment process relative to their importance in supporting the delivery of high-value services.", "justification": "Third-Party Criticality Assessments (TPM-09) provides periodic assessment and assurance that compensates for the absence of AI & Autonomous Technologies Internal Controls (AAT-08) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "RSK-20", "name": "Supply Chain Risk Management (SCRM) Plan", "description": "Mechanisms exist to develop a plan for Supply Chain Risk Management (SCRM) associated with the development, acquisition, maintenance and disposal of Technology Assets, Applications and/or Services (TAAS), including documenting selected mitigating actions and monitoring performance against those plans.", "justification": "Supply Chain Risk Management (SCRM) Plan (RSK-20) provides risk identification and prioritization that compensates for the absence of AI & Autonomous Technologies Internal Controls (AAT-08) by enabling informed decisions about where to focus resources to manage residual exposure. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "AAT-09", "risk_if_not_implemented": "Without AI & Autonomous Technologies Impact Assessment, AI and autonomous systems may produce unreliable, biased or unsafe outputs, act outside authorized scope, or expose sensitive data. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Regulatory / Legal / Contractual Financial Liability (R-EX-5), Inability to Demonstrate Due Diligence / Due Care (R-GV-9), Unreliable Assurance / Decision Information (R-GV-10), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11).", "compensating_control_1": { "control_id": "RSK-13", "name": "Risk Assessment", "description": "Mechanisms exist to conduct recurring assessments of risk that includes the likelihood and magnitude of harm, from unauthorized access, use, disclosure, disruption, modification or destruction of the organization's Technology Assets, Applications, Services and/or Data (TAASD).", "justification": "Risk Assessment (RSK-13) provides periodic assessment and assurance that compensates for the absence of AI & Autonomous Technologies Impact Assessment (AAT-09) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "GOV-11", "name": "Operationalizing Security, Compliance & Resilience Capabilities", "description": "Mechanisms exist to compel data and/or process owners to operationalize security, compliance and resilience practices for Technology Assets, Applications, Services and/or Data (TAASD) under their control.", "justification": "Operationalizing Security, Compliance & Resilience Capabilities (GOV-11) provides resilience and recovery capability that compensates for the absence of AI & Autonomous Technologies Impact Assessment (AAT-09) by ensuring the organization can restore operations and data when the primary control is absent. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "AAT-10", "risk_if_not_implemented": "Without AI & Autonomous Technologies Risk Profiling, AI and autonomous systems may produce unreliable, biased or unsafe outputs, act outside authorized scope, or expose sensitive data. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unaddressed Security / Compliance Exposure (R-GV-2), Inability to Demonstrate Due Diligence / Due Care (R-GV-9), Unreliable Assurance / Decision Information (R-GV-10), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9).", "compensating_control_1": { "control_id": "RSK-13", "name": "Risk Assessment", "description": "Mechanisms exist to conduct recurring assessments of risk that includes the likelihood and magnitude of harm, from unauthorized access, use, disclosure, disruption, modification or destruction of the organization's Technology Assets, Applications, Services and/or Data (TAASD).", "justification": "Risk Assessment (RSK-13) provides periodic assessment and assurance that compensates for the absence of AI & Autonomous Technologies Risk Profiling (AAT-10) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "THR-08", "name": "Threat Analysis", "description": "Mechanisms exist to identify, assess, prioritize and document the potential impact(s) and likelihood(s) of applicable internal and external threats.", "justification": "Threat Analysis (THR-08) provides overlapping security capability that compensates for the absence of AI & Autonomous Technologies Risk Profiling (AAT-10) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "AAT-10.1", "risk_if_not_implemented": "Without AI & Autonomous Technologies Risk Mapping, AI and autonomous systems may produce unreliable, biased or unsafe outputs, act outside authorized scope, or expose sensitive data. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Regulatory / Legal / Contractual Financial Liability (R-EX-5), Unaddressed Security / Compliance Exposure (R-GV-2), Inability to Demonstrate Due Diligence / Due Care (R-GV-9), Unreliable Assurance / Decision Information (R-GV-10), Sensitive Data / Compliance Exposure from Unsanctioned AI Use (R-AI-4), and most likely increases susceptibility to Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11).", "compensating_control_1": { "control_id": "RSK-13", "name": "Risk Assessment", "description": "Mechanisms exist to conduct recurring assessments of risk that includes the likelihood and magnitude of harm, from unauthorized access, use, disclosure, disruption, modification or destruction of the organization's Technology Assets, Applications, Services and/or Data (TAASD).", "justification": "Risk Assessment (RSK-13) provides periodic assessment and assurance that compensates for the absence of AI & Autonomous Technologies Risk Mapping (AAT-10.1) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "THR-08", "name": "Threat Analysis", "description": "Mechanisms exist to identify, assess, prioritize and document the potential impact(s) and likelihood(s) of applicable internal and external threats.", "justification": "Threat Analysis (THR-08) provides overlapping security capability that compensates for the absence of AI & Autonomous Technologies Risk Mapping (AAT-10.1) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "AAT-11.2", "risk_if_not_implemented": "Without AI & Autonomous Technologies High Risk Designations, AI and autonomous systems may produce unreliable, biased or unsafe outputs, act outside authorized scope, or expose sensitive data. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Regulatory / Legal / Contractual Financial Liability (R-EX-5), Unaddressed Security / Compliance Exposure (R-GV-2), Inability to Demonstrate Due Diligence / Due Care (R-GV-9), Unreliable Assurance / Decision Information (R-GV-10), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11), Conflict of Interest (COI) / Undue Influence / Insider Misconduct (MT-15).", "compensating_control_1": { "control_id": "RSK-13", "name": "Risk Assessment", "description": "Mechanisms exist to conduct recurring assessments of risk that includes the likelihood and magnitude of harm, from unauthorized access, use, disclosure, disruption, modification or destruction of the organization's Technology Assets, Applications, Services and/or Data (TAASD).", "justification": "Risk Assessment (RSK-13) provides periodic assessment and assurance that compensates for the absence of AI & Autonomous Technologies High Risk Designations (AAT-11.2) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "MON-02", "name": "Continuous Monitoring", "description": "Mechanisms exist to facilitate the implementation of enterprise-wide monitoring controls.", "justification": "Continuous Monitoring (MON-02) provides detective monitoring capability that compensates for the absence of AI & Autonomous Technologies High Risk Designations (AAT-11.2) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "AAT-12", "risk_if_not_implemented": "Without AI Threat Modeling & Risk Assessment, AI and autonomous systems may produce unreliable, biased or unsafe outputs, act outside authorized scope, or expose sensitive data. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unaddressed Security / Compliance Exposure (R-GV-2), Inability to Demonstrate Due Diligence / Due Care (R-GV-9), Unreliable Assurance / Decision Information (R-GV-10), and most likely increases susceptibility to Human Error (MT-9).", "compensating_control_1": { "control_id": "RSK-13", "name": "Risk Assessment", "description": "Mechanisms exist to conduct recurring assessments of risk that includes the likelihood and magnitude of harm, from unauthorized access, use, disclosure, disruption, modification or destruction of the organization's Technology Assets, Applications, Services and/or Data (TAASD).", "justification": "Risk Assessment (RSK-13) provides periodic assessment and assurance that compensates for the absence of AI Threat Modeling & Risk Assessment (AAT-12) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "THR-08", "name": "Threat Analysis", "description": "Mechanisms exist to identify, assess, prioritize and document the potential impact(s) and likelihood(s) of applicable internal and external threats.", "justification": "Threat Analysis (THR-08) provides overlapping security capability that compensates for the absence of AI Threat Modeling & Risk Assessment (AAT-12) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "AAT-12.1", "risk_if_not_implemented": "Without Novel Risk Assessment Methods & Technologies, risks may remain unidentified, unowned or unmanaged, leaving decision-makers without a defensible basis for prioritization and treatment. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Inability to Demonstrate Due Diligence / Due Care (R-GV-9), Unreliable Assurance / Decision Information (R-GV-10), and most likely increases susceptibility to Human Error (MT-9), Technical / Mechanical Failure (MT-10), Workforce Shortage / Loss of Critical Skills / Labor Disruption (MT-25).", "compensating_control_1": { "control_id": "IRO-08", "name": "Incident Response Plan (IRP)", "description": "Mechanisms exist to maintain and make available a current and viable Incident Response Plan (IRP) to all stakeholders.", "justification": "Incident Response Plan (IRP) (IRO-08) provides incident response capability that compensates for the absence of Novel Risk Assessment Methods & Technologies (AAT-12.1) by enabling timely detection, containment, and recovery from security events in the absence of the primary control. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "MON-02", "name": "Continuous Monitoring", "description": "Mechanisms exist to facilitate the implementation of enterprise-wide monitoring controls.", "justification": "Continuous Monitoring (MON-02) provides detective monitoring capability that compensates for the absence of Novel Risk Assessment Methods & Technologies (AAT-12.1) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "AAT-13.1", "risk_if_not_implemented": "Without AI & Autonomous Technologies Risk Tracking Approaches, AI and autonomous systems may produce unreliable, biased or unsafe outputs, act outside authorized scope, or expose sensitive data. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unaddressed Security / Compliance Exposure (R-GV-2), Inability to Demonstrate Due Diligence / Due Care (R-GV-9), Unreliable Assurance / Decision Information (R-GV-10), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Artificial Intelligence & Autonomous Technologies (AAT) System Failure or Unintended Behavior (MT-13).", "compensating_control_1": { "control_id": "RSK-22", "name": "Risk Monitoring", "description": "Mechanisms exist to monitor risk as an integral part of the continuous monitoring strategy, including: \n(1) The effectiveness of security, compliance and resilience controls; \n(2) Changes to the organization's risk profile; and \n(3) Changes to Technology Assets, Applications and/or Services (TAAS) that affect risk.", "justification": "Risk Monitoring (RSK-22) provides detective monitoring capability that compensates for the absence of AI & Autonomous Technologies Risk Tracking Approaches (AAT-13.1) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "MON-02", "name": "Continuous Monitoring", "description": "Mechanisms exist to facilitate the implementation of enterprise-wide monitoring controls.", "justification": "Continuous Monitoring (MON-02) provides detective monitoring capability that compensates for the absence of AI & Autonomous Technologies Risk Tracking Approaches (AAT-13.1) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "AAT-13.2", "risk_if_not_implemented": "Without Fine Tuning Risk Mitigation, AI and autonomous systems may produce unreliable, biased or unsafe outputs, act outside authorized scope, or expose sensitive data. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Modification / Loss of System Integrity (R-AM-2), AI Output / Decision Integrity Failure (R-AI-1), AI Data Confidentiality / Integrity / Provenance Loss (R-AI-2), Unintended or Unsafe Technology Behavior (R-AI-5), and most likely increases susceptibility to Human Error (MT-9), Data Quality Degradation / Data Poisoning (MT-12), Artificial Intelligence & Autonomous Technologies (AAT) System Failure or Unintended Behavior (MT-13), Adversarial Artificial Intelligence (AI) Attack (MT-29).", "compensating_control_1": { "control_id": "RSK-13", "name": "Risk Assessment", "description": "Mechanisms exist to conduct recurring assessments of risk that includes the likelihood and magnitude of harm, from unauthorized access, use, disclosure, disruption, modification or destruction of the organization's Technology Assets, Applications, Services and/or Data (TAASD).", "justification": "Risk Assessment (RSK-13) provides periodic assessment and assurance that compensates for the absence of Fine Tuning Risk Mitigation (AAT-13.2) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "IRO-08", "name": "Incident Response Plan (IRP)", "description": "Mechanisms exist to maintain and make available a current and viable Incident Response Plan (IRP) to all stakeholders.", "justification": "Incident Response Plan (IRP) (IRO-08) provides incident response capability that compensates for the absence of Fine Tuning Risk Mitigation (AAT-13.2) by enabling timely detection, containment, and recovery from security events in the absence of the primary control. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "AAT-14", "risk_if_not_implemented": "Without AI & Autonomous Technologies Business Case, AI and autonomous systems may produce unreliable, biased or unsafe outputs, act outside authorized scope, or expose sensitive data. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unreliable Assurance / Decision Information (R-GV-10), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Conflict of Interest (COI) / Undue Influence / Insider Misconduct (MT-15).", "compensating_control_1": { "control_id": "RSK-13", "name": "Risk Assessment", "description": "Mechanisms exist to conduct recurring assessments of risk that includes the likelihood and magnitude of harm, from unauthorized access, use, disclosure, disruption, modification or destruction of the organization's Technology Assets, Applications, Services and/or Data (TAASD).", "justification": "Risk Assessment (RSK-13) provides periodic assessment and assurance that compensates for the absence of AI & Autonomous Technologies Business Case (AAT-14) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "GOV-06", "name": "Defining Business Context & Mission", "description": "Mechanisms exist to document the organization's business model and mission.", "justification": "Defining Business Context & Mission (GOV-06) provides overlapping security capability that compensates for the absence of AI & Autonomous Technologies Business Case (AAT-14) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "AAT-14.1", "risk_if_not_implemented": "Without AI & Autonomous Technologies Potential Benefits Analysis, AI and autonomous systems may produce unreliable, biased or unsafe outputs, act outside authorized scope, or expose sensitive data. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unreliable Assurance / Decision Information (R-GV-10), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Conflict of Interest (COI) / Undue Influence / Insider Misconduct (MT-15).", "compensating_control_1": { "control_id": "PRM-09", "name": "Security, Compliance & Resilience Requirements Definition", "description": "Mechanisms exist to proactively govern Technology Assets, Applications and/or Services (TAAS) by:\n(1) Defining technical security, compliance and resilience requirements; and\n(2) Performing a criticality analysis at predefined decision points in the Secure Development Life Cycle (SDLC).", "justification": "Security, Compliance & Resilience Requirements Definition (PRM-09) provides resilience and recovery capability that compensates for the absence of AI & Autonomous Technologies Potential Benefits Analysis (AAT-14.1) by ensuring the organization can restore operations and data when the primary control is absent. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "RSK-13", "name": "Risk Assessment", "description": "Mechanisms exist to conduct recurring assessments of risk that includes the likelihood and magnitude of harm, from unauthorized access, use, disclosure, disruption, modification or destruction of the organization's Technology Assets, Applications, Services and/or Data (TAASD).", "justification": "Risk Assessment (RSK-13) provides periodic assessment and assurance that compensates for the absence of AI & Autonomous Technologies Potential Benefits Analysis (AAT-14.1) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "AAT-14.2", "risk_if_not_implemented": "Without AI & Autonomous Technologies Potential Costs Analysis, AI and autonomous systems may produce unreliable, biased or unsafe outputs, act outside authorized scope, or expose sensitive data. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unreliable Assurance / Decision Information (R-GV-10), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Conflict of Interest (COI) / Undue Influence / Insider Misconduct (MT-15).", "compensating_control_1": { "control_id": "CPL-02", "name": "Statutory, Regulatory & Contractual Compliance", "description": "Mechanisms exist to facilitate the identification and implementation of relevant statutory, regulatory and contractual controls.", "justification": "Statutory, Regulatory & Contractual Compliance (CPL-02) provides overlapping security capability that compensates for the absence of AI & Autonomous Technologies Potential Costs Analysis (AAT-14.2) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "RSK-13", "name": "Risk Assessment", "description": "Mechanisms exist to conduct recurring assessments of risk that includes the likelihood and magnitude of harm, from unauthorized access, use, disclosure, disruption, modification or destruction of the organization's Technology Assets, Applications, Services and/or Data (TAASD).", "justification": "Risk Assessment (RSK-13) provides periodic assessment and assurance that compensates for the absence of AI & Autonomous Technologies Potential Costs Analysis (AAT-14.2) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "AAT-14.3", "risk_if_not_implemented": "Without AI & Autonomous Technologies Targeted Application Scope, AI and autonomous systems may produce unreliable, biased or unsafe outputs, act outside authorized scope, or expose sensitive data. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unaddressed Security / Compliance Exposure (R-GV-2), Inability to Demonstrate Due Diligence / Due Care (R-GV-9), Harm from Unauthorized / Unintended Product or Service Use (R-SC-5), Unauthorized / Harmful Autonomous Action (R-AI-3), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9).", "compensating_control_1": { "control_id": "RSK-13", "name": "Risk Assessment", "description": "Mechanisms exist to conduct recurring assessments of risk that includes the likelihood and magnitude of harm, from unauthorized access, use, disclosure, disruption, modification or destruction of the organization's Technology Assets, Applications, Services and/or Data (TAASD).", "justification": "Risk Assessment (RSK-13) provides periodic assessment and assurance that compensates for the absence of AI & Autonomous Technologies Targeted Application Scope (AAT-14.3) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "AAT-02", "name": "Artificial Intelligence (AI) & Autonomous Technologies Governance", "description": "Mechanisms exist to ensure policies, processes, procedures and practices related to the mapping, measuring and managing of Artificial Intelligence (AI) and Autonomous Technologies (AAT)-related risks are in place, transparent and implemented effectively.", "justification": "Artificial Intelligence (AI) & Autonomous Technologies Governance (AAT-02) provides detective monitoring capability that compensates for the absence of AI & Autonomous Technologies Targeted Application Scope (AAT-14.3) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "AAT-14.4", "risk_if_not_implemented": "Without AI & Autonomous Technologies Cost / Benefit Mapping, AI and autonomous systems may produce unreliable, biased or unsafe outputs, act outside authorized scope, or expose sensitive data. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unaddressed Security / Compliance Exposure (R-GV-2), Uncontrolled Third-Party Security / Privacy Exposure (R-GV-5), Unreliable Assurance / Decision Information (R-GV-10), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Conflict of Interest (COI) / Undue Influence / Insider Misconduct (MT-15).", "compensating_control_1": { "control_id": "CPL-02", "name": "Statutory, Regulatory & Contractual Compliance", "description": "Mechanisms exist to facilitate the identification and implementation of relevant statutory, regulatory and contractual controls.", "justification": "Statutory, Regulatory & Contractual Compliance (CPL-02) provides overlapping security capability that compensates for the absence of AI & Autonomous Technologies Cost / Benefit Mapping (AAT-14.4) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "AAT-02", "name": "Artificial Intelligence (AI) & Autonomous Technologies Governance", "description": "Mechanisms exist to ensure policies, processes, procedures and practices related to the mapping, measuring and managing of Artificial Intelligence (AI) and Autonomous Technologies (AAT)-related risks are in place, transparent and implemented effectively.", "justification": "Artificial Intelligence (AI) & Autonomous Technologies Governance (AAT-02) provides detective monitoring capability that compensates for the absence of AI & Autonomous Technologies Cost / Benefit Mapping (AAT-14.4) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "AAT-15", "risk_if_not_implemented": "Without Model & AI Agent Documentation, AI and autonomous systems may produce unreliable, biased or unsafe outputs, act outside authorized scope, or expose sensitive data. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Inability to Demonstrate Due Diligence / Due Care (R-GV-9), Harm from Unauthorized / Unintended Product or Service Use (R-SC-5), AI Data Confidentiality / Integrity / Provenance Loss (R-AI-2), Loss of Authenticity / Provenance (R-IP-5), and most likely increases susceptibility to Human Error (MT-9).", "compensating_control_1": { "control_id": "DCH-04", "name": "Data & Asset Classification", "description": "Mechanisms exist to ensure data and assets are categorized in accordance with applicable statutory, regulatory and contractual requirements.", "justification": "Data & Asset Classification (DCH-04) provides overlapping security capability that compensates for the absence of Model & AI Agent Documentation (AAT-15) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "PRI-02", "name": "Data Privacy Program", "description": "Mechanisms exist to facilitate the implementation and operation of data protection controls throughout the data lifecycle to ensure all forms of Personal Data (PD) are processed lawfully, fairly and transparently.", "justification": "Data Privacy Program (PRI-02) provides policy-level governance that compensates for the absence of Model & AI Agent Documentation (AAT-15) by establishing documented expectations, accountability structures, and organizational guardrails. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "AAT-16", "risk_if_not_implemented": "Without AI & Autonomous Technologies Output Marking, AI and autonomous systems may produce unreliable, biased or unsafe outputs, act outside authorized scope, or expose sensitive data. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss of Authenticity / Provenance (R-IP-5), and most likely increases susceptibility to Technical / Mechanical Failure (MT-10), Artificial Intelligence & Autonomous Technologies (AAT) System Failure or Unintended Behavior (MT-13), Adversarial Artificial Intelligence (AI) Attack (MT-29).", "compensating_control_1": { "control_id": "DCH-11", "name": "Media Marking", "description": "Mechanisms exist to mark media in accordance with data protection requirements so that personnel are alerted to distribution limitations, handling caveats and applicable security requirements.", "justification": "Media Marking (DCH-11) provides overlapping security capability that compensates for the absence of AI & Autonomous Technologies Output Marking (AAT-16) by addressing related risk objectives through an alternative control mechanism aligned with Technology applicability. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "DCH-37", "name": "Cybersecurity & Data Protection Attributes", "description": "Mechanisms exist to bind cybersecurity and data protection attributes to information as it is stored, transmitted and processed.", "justification": "Cybersecurity & Data Protection Attributes (DCH-37) provides overlapping security capability that compensates for the absence of AI & Autonomous Technologies Output Marking (AAT-16) by addressing related risk objectives through an alternative control mechanism aligned with Technology applicability. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "AAT-17", "risk_if_not_implemented": "Without Release Owner Gate (ROG) For AI-Augmented Content, AI and autonomous systems may produce unreliable, biased or unsafe outputs, act outside authorized scope, or expose sensitive data. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Reputational Harm / Loss of Stakeholder Trust (R-EX-4), AI Output / Decision Integrity Failure (R-AI-1), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Artificial Intelligence & Autonomous Technologies (AAT) System Failure or Unintended Behavior (MT-13), Conflict of Interest (COI) / Undue Influence / Insider Misconduct (MT-15), Workforce Shortage / Loss of Critical Skills / Labor Disruption (MT-25).", "compensating_control_1": { "control_id": "CHG-04.4", "name": "Dual Approval For High-Impact Environments", "description": "Mechanisms exist to require dual approval for any changes that might result in a serious incident that could adversely impact:\n(1) Business processes; and/or\n(2) Technology Assets, Applications, Services and/or Data (TAASD).", "justification": "Dual Approval For High-Impact Environments (CHG-04.4) provides overlapping security capability that compensates for the absence of Release Owner Gate (ROG) For AI-Augmented Content (AAT-17) by addressing related risk objectives through an alternative control mechanism. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "GOV-05", "name": "Assigned Security, Compliance & Resilience Responsibilities", "description": "Mechanisms exist to assign one or more qualified individuals with the mission and resources to centrally-manage, coordinate, develop, implement and maintain an enterprise-wide Security, Compliance & Resilience Program (SCRP).", "justification": "Assigned Security, Compliance & Resilience Responsibilities (GOV-05) provides resilience and recovery capability that compensates for the absence of Release Owner Gate (ROG) For AI-Augmented Content (AAT-17) by ensuring the organization can restore operations when the primary control is absent. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "AAT-17.1", "risk_if_not_implemented": "Without AI & Autonomous Technologies Output Filtering, AI and autonomous systems may produce unreliable, biased or unsafe outputs, act outside authorized scope, or expose sensitive data. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Harm from Illegal, Abusive or Unsafe Content / Conduct (R-GV-8), AI Output / Decision Integrity Failure (R-AI-1), Unintended or Unsafe Technology Behavior (R-AI-5), and most likely increases susceptibility to Technical / Mechanical Failure (MT-10), Artificial Intelligence & Autonomous Technologies (AAT) System Failure or Unintended Behavior (MT-13), Adversarial Artificial Intelligence (AI) Attack (MT-29).", "compensating_control_1": { "control_id": "DCH-40", "name": "Data Loss Prevention (DLP)", "description": "Automated mechanisms exist to implement Data Loss Prevention (DLP) to protect sensitive information as it is stored, transmitted and processed.", "justification": "Data Loss Prevention (DLP) (DCH-40) provides detective monitoring capability that compensates for the absence of AI & Autonomous Technologies Output Filtering (AAT-17.1) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "END-04", "name": "Malicious Code Protection (Antimalware)", "description": "Mechanisms exist to utilize antimalware, or similar technologies, to detect and eradicate malicious code.", "justification": "Malicious Code Protection (Antimalware) (END-04) provides overlapping security capability that compensates for the absence of AI & Autonomous Technologies Output Filtering (AAT-17.1) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "AAT-17.2", "risk_if_not_implemented": "Without Human Moderation of AI & Autonomous Technologies-Generated Content, AI and autonomous systems may produce unreliable, biased or unsafe outputs, act outside authorized scope, or expose sensitive data. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unperformed / Unowned Control Responsibilities (R-GV-3), Harm from Illegal, Abusive or Unsafe Content / Conduct (R-GV-8), AI Output / Decision Integrity Failure (R-AI-1), AI Bias / Discriminatory Outcome (R-AI-6), and most likely increases susceptibility to Human Error (MT-9), Workforce Shortage / Loss of Critical Skills / Labor Disruption (MT-25).", "compensating_control_1": { "control_id": "DCH-40", "name": "Data Loss Prevention (DLP)", "description": "Automated mechanisms exist to implement Data Loss Prevention (DLP) to protect sensitive information as it is stored, transmitted and processed.", "justification": "Data Loss Prevention (DLP) (DCH-40) provides detective monitoring capability that compensates for the absence of Human Moderation (AAT-17.2) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "MON-05.2", "name": "Event Log & Security-Relevant Telemetry Analysis & Triage", "description": "Mechanisms exist to ensure event log and security-relevant telemetry reviews include analysis and triage practices that integrate with the organization's established incident response processes.", "justification": "Event Log & Security-Relevant Telemetry Analysis & Triage (MON-05.2) provides detective monitoring capability that compensates for the absence of Human Moderation (AAT-17.2) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "AAT-18.3", "risk_if_not_implemented": "Without Data Source Lineage & Origin Disclosure, AI and autonomous systems may produce unreliable, biased or unsafe outputs, act outside authorized scope, or expose sensitive data. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to AI Data Confidentiality / Integrity / Provenance Loss (R-AI-2), Loss of Authenticity / Provenance (R-IP-5), and most likely increases susceptibility to Artificial Intelligence & Autonomous Technologies (AAT) System Failure or Unintended Behavior (MT-13).", "compensating_control_1": { "control_id": "TPM-14", "name": "Third-Party Contract Requirements", "description": "Mechanisms exist to require contractual requirements for applicable security, compliance and resilience requirements with third-parties, reflecting the organization's needs to protect its Technology Assets, Applications, Services and/or Data (TAASD).", "justification": "Third-Party Contract Requirements (TPM-14) provides third-party oversight that compensates for the absence of Data Source Lineage & Origin Disclosure (AAT-18.3) by extending security obligations contractually and monitoring third-party risk in lieu of direct control. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "AAT-18", "name": "AI & Autonomous Technologies Intellectual Property Infringement Protections", "description": "Mechanisms exist to prevent third-party Intellectual Property (IP) rights infringement by Artificial Intelligence (AI) and Autonomous Technologies (AAT).", "justification": "AI & Autonomous Technologies Intellectual Property Infringement Protections (AAT-18) provides detective monitoring capability that compensates for the absence of Data Source Lineage & Origin Disclosure (AAT-18.3) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "AAT-18.4", "risk_if_not_implemented": "Without Digital Content Modification Logging, malicious, anomalous or unauthorized activity may go undetected or be detected too late to prevent or limit harm. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss of Accountability / Attribution (R-AC-1), Loss of Investigative / Evidentiary Capability (R-IR-1), Undetected / Delayed Detection of Adverse Activity (R-SA-1), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Technical / Mechanical Failure (MT-10), Artificial Intelligence & Autonomous Technologies (AAT) System Failure or Unintended Behavior (MT-13).", "compensating_control_1": { "control_id": "CPL-02", "name": "Statutory, Regulatory & Contractual Compliance", "description": "Mechanisms exist to facilitate the identification and implementation of relevant statutory, regulatory and contractual controls.", "justification": "Statutory, Regulatory & Contractual Compliance (CPL-02) provides overlapping security capability that compensates for the absence of Digital Content Modification Logging (AAT-18.4) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "TPM-02", "name": "Third-Party Management", "description": "Mechanisms exist to facilitate the implementation of third-party management controls.", "justification": "Third-Party Management (TPM-02) provides third-party oversight that compensates for the absence of Digital Content Modification Logging (AAT-18.4) by extending security obligations contractually and monitoring third-party risk in lieu of direct control. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "AAT-18.5", "risk_if_not_implemented": "Without Training Data Source & Integrity, personnel are more likely to make unsafe decisions, fall victim to social engineering, mishandle data or violate requirements. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to AI Output / Decision Integrity Failure (R-AI-1), AI Data Confidentiality / Integrity / Provenance Loss (R-AI-2), AI Bias / Discriminatory Outcome (R-AI-6), and most likely increases susceptibility to Human Error (MT-9), Data Quality Degradation / Data Poisoning (MT-12).", "compensating_control_1": { "control_id": "DCH-33", "name": "Data Quality Operations", "description": "Mechanisms exist to check for Redundant, Obsolete/Outdated, Toxic or Trivial (ROTT) data to ensure the accuracy, relevance, timeliness, impact, completeness and de-identification of information throughout the information lifecycle.", "justification": "Data Quality Operations (DCH-33) provides overlapping security capability that compensates for the absence of Training Data Source & Integrity (AAT-18.5) by addressing related risk objectives through an alternative control mechanism. Given the data-handling focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "AAT-28", "name": "Artificial Intelligence Test, Evaluation, Validation & Verification (AI TEVV)", "description": "Mechanisms exist to implement Artificial Intelligence Test, Evaluation, Validation & Verification (AI TEVV) practices to enable Artificial Intelligence (AI) and Autonomous Technologies (AAT)-related security, resilience and compliance-related conformity testing throughout the lifecycle of the AAT.", "justification": "Artificial Intelligence Test, Evaluation, Validation & Verification (AI TEVV) (AAT-28) provides periodic assessment and verification that compensates for the absence of Training Data Source & Integrity (AAT-18.5) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the data-handling focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "AAT-18.6", "risk_if_not_implemented": "Without Prohibit Training, personnel are more likely to make unsafe decisions, fall victim to social engineering, mishandle data or violate requirements. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Intellectual Property / Trade Secret Loss (R-EX-9), AI Data Confidentiality / Integrity / Provenance Loss (R-AI-2), Sensitive Data / Compliance Exposure from Unsanctioned AI Use (R-AI-4), Loss of Confidentiality (R-IP-2), Privacy Harm / Unauthorized Processing (R-IP-6), and most likely increases susceptibility to Artificial Intelligence & Autonomous Technologies (AAT) System Failure or Unintended Behavior (MT-13).", "compensating_control_1": { "control_id": "CPL-02", "name": "Statutory, Regulatory & Contractual Compliance", "description": "Mechanisms exist to facilitate the identification and implementation of relevant statutory, regulatory and contractual controls.", "justification": "Statutory, Regulatory & Contractual Compliance (CPL-02) provides third-party oversight and contractual controls that compensates for the absence of Prohibit Training (AAT-18.6) by extending security obligations and monitoring third-party risk in lieu of direct primary control implementation. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "DCH-08.1", "name": "Sensitive / Regulated Data Sharing Decisions", "description": "Mechanisms exist to utilize a process to assist users in making information sharing decisions to ensure data is appropriately protected.", "justification": "Sensitive / Regulated Data Sharing Decisions (DCH-08.1) provides threat intelligence and situational awareness that compensates for the absence of Prohibit Training (AAT-18.6) by providing early warning of threats and informing proactive security posture adjustments. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "AAT-19.2", "risk_if_not_implemented": "Without AI & Autonomous Technologies Environmental Impact & Sustainability, AI and autonomous systems may produce unreliable, biased or unsafe outputs, act outside authorized scope, or expose sensitive data. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Inability to Demonstrate Due Diligence / Due Care (R-GV-9), Unreliable Assurance / Decision Information (R-GV-10), and most likely increases susceptibility to Human Error (MT-9).", "compensating_control_1": { "control_id": "CPL-02", "name": "Statutory, Regulatory & Contractual Compliance", "description": "Mechanisms exist to facilitate the identification and implementation of relevant statutory, regulatory and contractual controls.", "justification": "Statutory, Regulatory & Contractual Compliance (CPL-02) provides overlapping security capability that compensates for the absence of AI & Autonomous Technologies Environmental Impact & Sustainability (AAT-19.2) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "RSK-13", "name": "Risk Assessment", "description": "Mechanisms exist to conduct recurring assessments of risk that includes the likelihood and magnitude of harm, from unauthorized access, use, disclosure, disruption, modification or destruction of the organization's Technology Assets, Applications, Services and/or Data (TAASD).", "justification": "Risk Assessment (RSK-13) provides periodic assessment and assurance that compensates for the absence of AI & Autonomous Technologies Environmental Impact & Sustainability (AAT-19.2) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "AAT-19.3", "risk_if_not_implemented": "Without Previously Unknown AI & Autonomous Technologies Threats & Risks, AI and autonomous systems may produce unreliable, biased or unsafe outputs, act outside authorized scope, or expose sensitive data. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Delayed Containment / Increased Incident Impact (R-IR-2), Incident Persistence / Recurrence (R-IR-3), Unintended or Unsafe Technology Behavior (R-AI-5), and most likely increases susceptibility to Human Error (MT-9), Workforce Shortage / Loss of Critical Skills / Labor Disruption (MT-25).", "compensating_control_1": { "control_id": "IAC-25", "name": "Access Enforcement", "description": "Mechanisms exist to enforce Logical Access Control (LAC) permissions that conform to the principle of \"least privilege.\"", "justification": "Access Enforcement (IAC-25) provides access control enforcement that compensates for the absence of Previously Unknown AI & Autonomous Technologies Threats & Risks (AAT-19.3) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "MON-02", "name": "Continuous Monitoring", "description": "Mechanisms exist to facilitate the implementation of enterprise-wide monitoring controls.", "justification": "Continuous Monitoring (MON-02) provides detective monitoring capability that compensates for the absence of Previously Unknown AI & Autonomous Technologies Threats & Risks (AAT-19.3) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "AAT-20", "risk_if_not_implemented": "Without AI & Autonomous Technologies Conformity, AI and autonomous systems may produce unreliable, biased or unsafe outputs, act outside authorized scope, or expose sensitive data. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Regulatory / Legal / Contractual Financial Liability (R-EX-5), Loss of Authorization / Certification / License (R-EX-11), Unaddressed Security / Compliance Exposure (R-GV-2), Inability to Demonstrate Due Diligence / Due Care (R-GV-9), Sensitive Data / Compliance Exposure from Unsanctioned AI Use (R-AI-4), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11).", "compensating_control_1": { "control_id": "CPL-02", "name": "Statutory, Regulatory & Contractual Compliance", "description": "Mechanisms exist to facilitate the identification and implementation of relevant statutory, regulatory and contractual controls.", "justification": "Statutory, Regulatory & Contractual Compliance (CPL-02) provides overlapping security capability that compensates for the absence of AI & Autonomous Technologies Conformity (AAT-20) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "IAO-04", "name": "Control Validation Testing (CVT)", "description": "Mechanisms exist to formally assess the security, compliance and resilience controls in Technology Assets, Applications and/or Services (TAAS) through Information Assurance Program (IAP) activities to determine the extent to which the controls are implemented correctly, operating as intended and producing the desired outcome with respect to meeting expected requirements.", "justification": "Control Validation Testing (CVT) (IAO-04) provides periodic assessment and assurance that compensates for the absence of AI & Autonomous Technologies Conformity (AAT-20) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "AAT-20.1", "risk_if_not_implemented": "Without Manipulative or Deceptive Techniques, AI and autonomous systems may produce unreliable, biased or unsafe outputs, act outside authorized scope, or expose sensitive data. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Regulatory / Legal / Contractual Financial Liability (R-EX-5), Harm from Illegal, Abusive or Unsafe Content / Conduct (R-GV-8), AI Output / Decision Integrity Failure (R-AI-1), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11).", "compensating_control_1": { "control_id": "CPL-14", "name": "Control Reciprocity", "description": "Mechanisms exist to define instances of control reciprocity within assessment boundaries.", "justification": "Control Reciprocity (CPL-14) provides overlapping security capability that compensates for the absence of Manipulative or Deceptive Techniques (AAT-20.1) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CPL-02", "name": "Statutory, Regulatory & Contractual Compliance", "description": "Mechanisms exist to facilitate the identification and implementation of relevant statutory, regulatory and contractual controls.", "justification": "Statutory, Regulatory & Contractual Compliance (CPL-02) provides overlapping security capability that compensates for the absence of Manipulative or Deceptive Techniques (AAT-20.1) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "AAT-20.2", "risk_if_not_implemented": "Without Materially Distorting Behaviors, AI and autonomous systems may produce unreliable, biased or unsafe outputs, act outside authorized scope, or expose sensitive data. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Regulatory / Legal / Contractual Financial Liability (R-EX-5), Harm from Illegal, Abusive or Unsafe Content / Conduct (R-GV-8), AI Bias / Discriminatory Outcome (R-AI-6), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11).", "compensating_control_1": { "control_id": "IAO-04", "name": "Control Validation Testing (CVT)", "description": "Mechanisms exist to formally assess the security, compliance and resilience controls in Technology Assets, Applications and/or Services (TAAS) through Information Assurance Program (IAP) activities to determine the extent to which the controls are implemented correctly, operating as intended and producing the desired outcome with respect to meeting expected requirements.", "justification": "Control Validation Testing (CVT) (IAO-04) provides periodic assessment and assurance that compensates for the absence of Materially Distorting Behaviors (AAT-20.2) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CPL-05", "name": "Conformity Monitoring", "description": "Mechanisms exist to validate that Technology Assets, Applications, Services and/or Data (TAASD) conform to the organization's security, compliance and/or resilience policies, standards and other applicable requirements.", "justification": "Conformity Monitoring (CPL-05) provides periodic assessment and assurance that compensates for the absence of Materially Distorting Behaviors (AAT-20.2) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "AAT-20.3", "risk_if_not_implemented": "Without Social Scoring, AI and autonomous systems may produce unreliable, biased or unsafe outputs, act outside authorized scope, or expose sensitive data. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Regulatory / Legal / Contractual Financial Liability (R-EX-5), Harm from Illegal, Abusive or Unsafe Content / Conduct (R-GV-8), AI Bias / Discriminatory Outcome (R-AI-6), Privacy Harm / Unauthorized Processing (R-IP-6), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11).", "compensating_control_1": { "control_id": "CPL-02", "name": "Statutory, Regulatory & Contractual Compliance", "description": "Mechanisms exist to facilitate the identification and implementation of relevant statutory, regulatory and contractual controls.", "justification": "Statutory, Regulatory & Contractual Compliance (CPL-02) provides overlapping security capability that compensates for the absence of Social Scoring (AAT-20.3) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CPL-14", "name": "Control Reciprocity", "description": "Mechanisms exist to define instances of control reciprocity within assessment boundaries.", "justification": "Control Reciprocity (CPL-14) provides overlapping security capability that compensates for the absence of Social Scoring (AAT-20.3) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "AAT-20.4", "risk_if_not_implemented": "Without Detrimental or Unfavorable Treatment, AI and autonomous systems may produce unreliable, biased or unsafe outputs, act outside authorized scope, or expose sensitive data. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Regulatory / Legal / Contractual Financial Liability (R-EX-5), Harm from Illegal, Abusive or Unsafe Content / Conduct (R-GV-8), AI Bias / Discriminatory Outcome (R-AI-6), Privacy Harm / Unauthorized Processing (R-IP-6), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11).", "compensating_control_1": { "control_id": "CPL-05", "name": "Conformity Monitoring", "description": "Mechanisms exist to validate that Technology Assets, Applications, Services and/or Data (TAASD) conform to the organization's security, compliance and/or resilience policies, standards and other applicable requirements.", "justification": "Conformity Monitoring (CPL-05) provides periodic assessment and assurance that compensates for the absence of Detrimental or Unfavorable Treatment (AAT-20.4) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "IAO-04", "name": "Control Validation Testing (CVT)", "description": "Mechanisms exist to formally assess the security, compliance and resilience controls in Technology Assets, Applications and/or Services (TAAS) through Information Assurance Program (IAP) activities to determine the extent to which the controls are implemented correctly, operating as intended and producing the desired outcome with respect to meeting expected requirements.", "justification": "Control Validation Testing (CVT) (IAO-04) provides periodic assessment and assurance that compensates for the absence of Detrimental or Unfavorable Treatment (AAT-20.4) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "AAT-20.5", "risk_if_not_implemented": "Without Risk and Criminal Profiling, AI and autonomous systems may produce unreliable, biased or unsafe outputs, act outside authorized scope, or expose sensitive data. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Regulatory / Legal / Contractual Financial Liability (R-EX-5), Harm from Illegal, Abusive or Unsafe Content / Conduct (R-GV-8), AI Bias / Discriminatory Outcome (R-AI-6), Privacy Harm / Unauthorized Processing (R-IP-6), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11).", "compensating_control_1": { "control_id": "CPL-02", "name": "Statutory, Regulatory & Contractual Compliance", "description": "Mechanisms exist to facilitate the identification and implementation of relevant statutory, regulatory and contractual controls.", "justification": "Statutory, Regulatory & Contractual Compliance (CPL-02) provides overlapping security capability that compensates for the absence of Risk and Criminal Profiling (AAT-20.5) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CPL-05", "name": "Conformity Monitoring", "description": "Mechanisms exist to validate that Technology Assets, Applications, Services and/or Data (TAASD) conform to the organization's security, compliance and/or resilience policies, standards and other applicable requirements.", "justification": "Conformity Monitoring (CPL-05) provides periodic assessment and assurance that compensates for the absence of Risk and Criminal Profiling (AAT-20.5) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "AAT-20.6", "risk_if_not_implemented": "Without Populating Facial Recognition Databases, AI and autonomous systems may produce unreliable, biased or unsafe outputs, act outside authorized scope, or expose sensitive data. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Regulatory / Legal / Contractual Financial Liability (R-EX-5), Harm from Illegal, Abusive or Unsafe Content / Conduct (R-GV-8), AI Data Confidentiality / Integrity / Provenance Loss (R-AI-2), Privacy Harm / Unauthorized Processing (R-IP-6), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11).", "compensating_control_1": { "control_id": "IAO-04", "name": "Control Validation Testing (CVT)", "description": "Mechanisms exist to formally assess the security, compliance and resilience controls in Technology Assets, Applications and/or Services (TAAS) through Information Assurance Program (IAP) activities to determine the extent to which the controls are implemented correctly, operating as intended and producing the desired outcome with respect to meeting expected requirements.", "justification": "Control Validation Testing (CVT) (IAO-04) provides periodic assessment and assurance that compensates for the absence of Populating Facial Recognition Databases (AAT-20.6) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CPL-02", "name": "Statutory, Regulatory & Contractual Compliance", "description": "Mechanisms exist to facilitate the identification and implementation of relevant statutory, regulatory and contractual controls.", "justification": "Statutory, Regulatory & Contractual Compliance (CPL-02) provides overlapping security capability that compensates for the absence of Populating Facial Recognition Databases (AAT-20.6) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "AAT-20.7", "risk_if_not_implemented": "Without Emotion Inference, AI and autonomous systems may produce unreliable, biased or unsafe outputs, act outside authorized scope, or expose sensitive data. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Regulatory / Legal / Contractual Financial Liability (R-EX-5), Harm from Illegal, Abusive or Unsafe Content / Conduct (R-GV-8), Privacy Harm / Unauthorized Processing (R-IP-6), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11).", "compensating_control_1": { "control_id": "CPL-14", "name": "Control Reciprocity", "description": "Mechanisms exist to define instances of control reciprocity within assessment boundaries.", "justification": "Control Reciprocity (CPL-14) provides overlapping security capability that compensates for the absence of Emotion Inference (AAT-20.7) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "IAO-04", "name": "Control Validation Testing (CVT)", "description": "Mechanisms exist to formally assess the security, compliance and resilience controls in Technology Assets, Applications and/or Services (TAAS) through Information Assurance Program (IAP) activities to determine the extent to which the controls are implemented correctly, operating as intended and producing the desired outcome with respect to meeting expected requirements.", "justification": "Control Validation Testing (CVT) (IAO-04) provides periodic assessment and assurance that compensates for the absence of Emotion Inference (AAT-20.7) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "AAT-20.8", "risk_if_not_implemented": "Without Biometric Categorization, credentials may be phished, replayed, guessed or stolen, allowing unauthorized actors to authenticate as trusted identities. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Regulatory / Legal / Contractual Financial Liability (R-EX-5), Harm from Illegal, Abusive or Unsafe Content / Conduct (R-GV-8), AI Bias / Discriminatory Outcome (R-AI-6), Privacy Harm / Unauthorized Processing (R-IP-6), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11).", "compensating_control_1": { "control_id": "CPL-05", "name": "Conformity Monitoring", "description": "Mechanisms exist to validate that Technology Assets, Applications, Services and/or Data (TAASD) conform to the organization's security, compliance and/or resilience policies, standards and other applicable requirements.", "justification": "Conformity Monitoring (CPL-05) provides periodic assessment and assurance that compensates for the absence of Biometric Categorization (AAT-20.8) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CPL-02", "name": "Statutory, Regulatory & Contractual Compliance", "description": "Mechanisms exist to facilitate the identification and implementation of relevant statutory, regulatory and contractual controls.", "justification": "Statutory, Regulatory & Contractual Compliance (CPL-02) provides overlapping security capability that compensates for the absence of Biometric Categorization (AAT-20.8) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "AAT-21", "risk_if_not_implemented": "Without AI & Autonomous Technologies Requirements Definitions, AI and autonomous systems may produce unreliable, biased or unsafe outputs, act outside authorized scope, or expose sensitive data. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unaddressed Security / Compliance Exposure (R-GV-2), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9).", "compensating_control_1": { "control_id": "PRM-09", "name": "Security, Compliance & Resilience Requirements Definition", "description": "Mechanisms exist to proactively govern Technology Assets, Applications and/or Services (TAAS) by:\n(1) Defining technical security, compliance and resilience requirements; and\n(2) Performing a criticality analysis at predefined decision points in the Secure Development Life Cycle (SDLC).", "justification": "Security, Compliance & Resilience Requirements Definition (PRM-09) provides resilience and recovery capability that compensates for the absence of AI & Autonomous Technologies Requirements Definitions (AAT-21) by ensuring the organization can restore operations and data when the primary control is absent. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "TDA-11.1", "name": "Minimum Viable Product (MVP) Security Requirements", "description": "Mechanisms exist to design, develop and produce Technology Assets, Applications and/or Services (TAAS) in such a way that risk-based technical and functional specifications ensure Minimum Viable Product (MVP) criteria establish an appropriate level of security and resiliency based on applicable risks and threats.", "justification": "Minimum Viable Product (MVP) Security Requirements (TDA-11.1) provides overlapping security capability that compensates for the absence of AI & Autonomous Technologies Requirements Definitions (AAT-21) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "AAT-22", "risk_if_not_implemented": "Without AI & Autonomous Technologies Fairness & Bias, AI and autonomous systems may produce unreliable, biased or unsafe outputs, act outside authorized scope, or expose sensitive data. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Regulatory / Legal / Contractual Financial Liability (R-EX-5), AI Output / Decision Integrity Failure (R-AI-1), AI Bias / Discriminatory Outcome (R-AI-6), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Data Quality Degradation / Data Poisoning (MT-12).", "compensating_control_1": { "control_id": "AAT-28", "name": "Artificial Intelligence Test, Evaluation, Validation & Verification (AI TEVV)", "description": "Mechanisms exist to implement Artificial Intelligence Test, Evaluation, Validation & Verification (AI TEVV) practices to enable Artificial Intelligence (AI) and Autonomous Technologies (AAT)-related security, resilience and compliance-related conformity testing throughout the lifecycle of the AAT.", "justification": "Artificial Intelligence Test, Evaluation, Validation & Verification (AI TEVV) (AAT-28) provides periodic assessment and assurance that compensates for the absence of AI & Autonomous Technologies Fairness & Bias (AAT-22) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "RSK-13", "name": "Risk Assessment", "description": "Mechanisms exist to conduct recurring assessments of risk that includes the likelihood and magnitude of harm, from unauthorized access, use, disclosure, disruption, modification or destruction of the organization's Technology Assets, Applications, Services and/or Data (TAASD).", "justification": "Risk Assessment (RSK-13) provides periodic assessment and assurance that compensates for the absence of AI & Autonomous Technologies Fairness & Bias (AAT-22) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "AAT-24.1", "risk_if_not_implemented": "Without AI & Autonomous Technologies Transparency, AI and autonomous systems may produce unreliable, biased or unsafe outputs, act outside authorized scope, or expose sensitive data. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to AI Output / Decision Integrity Failure (R-AI-1), and most likely increases susceptibility to Human Error (MT-9), Artificial Intelligence & Autonomous Technologies (AAT) System Failure or Unintended Behavior (MT-13).", "compensating_control_1": { "control_id": "TDA-05", "name": "Secure Software Development Practices (SSDP)", "description": "Mechanisms exist to develop applications based on Secure Software Development Practices (SSDP).", "justification": "Secure Software Development Practices (SSDP) (TDA-05) provides overlapping security capability that compensates for the absence of AI & Autonomous Technologies Transparency (AAT-24.1) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "SEA-05", "name": "Secure Engineering Principles", "description": "Mechanisms exist to facilitate the implementation of industry-recognized security, compliance and resilience practices in the specification, design, development, implementation and modification of Technology Assets, Applications and/or Services (TAAS).", "justification": "Secure Engineering Principles (SEA-05) provides overlapping security capability that compensates for the absence of AI & Autonomous Technologies Transparency (AAT-24.1) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "AAT-24.2", "risk_if_not_implemented": "Without AI & Autonomous Technologies Implementation Documentation, AI and autonomous systems may produce unreliable, biased or unsafe outputs, act outside authorized scope, or expose sensitive data. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Reduced Operational Productivity (R-BC-3), Inability to Demonstrate Due Diligence / Due Care (R-GV-9), Loss of Investigative / Evidentiary Capability (R-IR-1), and most likely increases susceptibility to Human Error (MT-9), Artificial Intelligence & Autonomous Technologies (AAT) System Failure or Unintended Behavior (MT-13).", "compensating_control_1": { "control_id": "TDA-05", "name": "Secure Software Development Practices (SSDP)", "description": "Mechanisms exist to develop applications based on Secure Software Development Practices (SSDP).", "justification": "Secure Software Development Practices (SSDP) (TDA-05) provides overlapping security capability that compensates for the absence of AI & Autonomous Technologies Implementation Documentation (AAT-24.2) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "IAO-10", "name": "Threat Analysis & Flaw Remediation During Development", "description": "Mechanisms exist to require system developers and integrators to create and execute a Security Testing and Evaluation (ST&E) plan, or similar process, to identify and remediate flaws during development.", "justification": "Threat Analysis & Flaw Remediation During Development (IAO-10) provides vulnerability management that compensates for the absence of AI & Autonomous Technologies Implementation Documentation (AAT-24.2) by reducing the exploitable attack surface by addressing known weaknesses before they are leveraged. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "AAT-24.3", "risk_if_not_implemented": "Without AI & Autonomous Technologies Human Domain Knowledge Reliance, essential knowledge and skills may be unavailable when needed, degrading the organization's ability to operate and protect itself. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Inability to Demonstrate Due Diligence / Due Care (R-GV-9), AI Data Confidentiality / Integrity / Provenance Loss (R-AI-2), and most likely increases susceptibility to Human Error (MT-9), Artificial Intelligence & Autonomous Technologies (AAT) System Failure or Unintended Behavior (MT-13).", "compensating_control_1": { "control_id": "TDA-05", "name": "Secure Software Development Practices (SSDP)", "description": "Mechanisms exist to develop applications based on Secure Software Development Practices (SSDP).", "justification": "Secure Software Development Practices (SSDP) (TDA-05) provides overlapping security capability that compensates for the absence of AI & Autonomous Technologies Human Domain Knowledge Reliance (AAT-24.3) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "TDA-17", "name": "Security, Compliance & Resilience Testing Throughout Development", "description": "Mechanisms exist to require system developers/integrators consult with security, compliance and/or resilience personnel to: \n(1) Create and implement a Security Testing and Evaluation (ST&E) plan, or similar capability;\n(2) Implement a verifiable flaw remediation process to correct weaknesses and deficiencies identified during the control testing and evaluation process; and\n(3) Document the results.", "justification": "Security, Compliance & Resilience Testing Throughout Development (TDA-17) provides periodic assessment and assurance that compensates for the absence of AI & Autonomous Technologies Human Domain Knowledge Reliance (AAT-24.3) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "AAT-25", "risk_if_not_implemented": "Without AI & Autonomous Technologies Implementation Tasks Definition, AI and autonomous systems may produce unreliable, biased or unsafe outputs, act outside authorized scope, or expose sensitive data. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Harm from Unauthorized / Unintended Product or Service Use (R-SC-5), and most likely increases susceptibility to Human Error (MT-9), Artificial Intelligence & Autonomous Technologies (AAT) System Failure or Unintended Behavior (MT-13).", "compensating_control_1": { "control_id": "TDA-11.1", "name": "Minimum Viable Product (MVP) Security Requirements", "description": "Mechanisms exist to design, develop and produce Technology Assets, Applications and/or Services (TAAS) in such a way that risk-based technical and functional specifications ensure Minimum Viable Product (MVP) criteria establish an appropriate level of security and resiliency based on applicable risks and threats.", "justification": "Minimum Viable Product (MVP) Security Requirements (TDA-11.1) provides overlapping security capability that compensates for the absence of AI & Autonomous Technologies Implementation Tasks Definition (AAT-25) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "PRM-09", "name": "Security, Compliance & Resilience Requirements Definition", "description": "Mechanisms exist to proactively govern Technology Assets, Applications and/or Services (TAAS) by:\n(1) Defining technical security, compliance and resilience requirements; and\n(2) Performing a criticality analysis at predefined decision points in the Secure Development Life Cycle (SDLC).", "justification": "Security, Compliance & Resilience Requirements Definition (PRM-09) provides resilience and recovery capability that compensates for the absence of AI & Autonomous Technologies Implementation Tasks Definition (AAT-25) by ensuring the organization can restore operations and data when the primary control is absent. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "AAT-26", "risk_if_not_implemented": "Without Real World Testing of AI & Autonomous Technologies, AI and autonomous systems may produce unreliable, biased or unsafe outputs, act outside authorized scope, or expose sensitive data. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Regulatory / Legal / Contractual Financial Liability (R-EX-5), Privacy Harm / Unauthorized Processing (R-IP-6), and most likely increases susceptibility to Human Error (MT-9).", "compensating_control_1": { "control_id": "AAT-28", "name": "Artificial Intelligence Test, Evaluation, Validation & Verification (AI TEVV)", "description": "Mechanisms exist to implement Artificial Intelligence Test, Evaluation, Validation & Verification (AI TEVV) practices to enable Artificial Intelligence (AI) and Autonomous Technologies (AAT)-related security, resilience and compliance-related conformity testing throughout the lifecycle of the AAT.", "justification": "Artificial Intelligence Test, Evaluation, Validation & Verification (AI TEVV) (AAT-28) provides periodic assessment and assurance that compensates for the absence of Real World Testing of AI & Autonomous Technologies (AAT-26) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "VPM-18", "name": "Penetration Testing", "description": "Mechanisms exist to conduct penetration testing on Technology Assets, Applications and/or Services (TAAS).", "justification": "Penetration Testing (VPM-18) provides periodic assessment and assurance that compensates for the absence of Real World Testing of AI & Autonomous Technologies (AAT-26) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "AAT-27", "risk_if_not_implemented": "Without AI & Autonomous Technologies Testing Techniques, AI and autonomous systems may produce unreliable, biased or unsafe outputs, act outside authorized scope, or expose sensitive data. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to AI Output / Decision Integrity Failure (R-AI-1), and most likely increases susceptibility to Human Error (MT-9), Data Quality Degradation / Data Poisoning (MT-12), Artificial Intelligence & Autonomous Technologies (AAT) System Failure or Unintended Behavior (MT-13), Adversarial Artificial Intelligence (AI) Attack (MT-29).", "compensating_control_1": { "control_id": "TDA-17", "name": "Security, Compliance & Resilience Testing Throughout Development", "description": "Mechanisms exist to require system developers/integrators consult with security, compliance and/or resilience personnel to: \n(1) Create and implement a Security Testing and Evaluation (ST&E) plan, or similar capability;\n(2) Implement a verifiable flaw remediation process to correct weaknesses and deficiencies identified during the control testing and evaluation process; and\n(3) Document the results.", "justification": "Security, Compliance & Resilience Testing Throughout Development (TDA-17) provides periodic assessment and assurance that compensates for the absence of AI & Autonomous Technologies Testing Techniques (AAT-27) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "VPM-18", "name": "Penetration Testing", "description": "Mechanisms exist to conduct penetration testing on Technology Assets, Applications and/or Services (TAAS).", "justification": "Penetration Testing (VPM-18) provides periodic assessment and assurance that compensates for the absence of AI & Autonomous Technologies Testing Techniques (AAT-27) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "AAT-27.1", "risk_if_not_implemented": "Without Generative Artificial Intelligence (GAI) Identification, AI and autonomous systems may produce unreliable, biased or unsafe outputs, act outside authorized scope, or expose sensitive data. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss of Authenticity / Provenance (R-IP-5), and most likely increases susceptibility to Human Error (MT-9), Artificial Intelligence & Autonomous Technologies (AAT) System Failure or Unintended Behavior (MT-13), Adversarial Artificial Intelligence (AI) Attack (MT-29).", "compensating_control_1": { "control_id": "VPM-18", "name": "Penetration Testing", "description": "Mechanisms exist to conduct penetration testing on Technology Assets, Applications and/or Services (TAAS).", "justification": "Penetration Testing (VPM-18) provides periodic assessment and assurance that compensates for the absence of Generative Artificial Intelligence (GAI) Identification (AAT-27.1) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "AAT-28", "name": "Artificial Intelligence Test, Evaluation, Validation & Verification (AI TEVV)", "description": "Mechanisms exist to implement Artificial Intelligence Test, Evaluation, Validation & Verification (AI TEVV) practices to enable Artificial Intelligence (AI) and Autonomous Technologies (AAT)-related security, resilience and compliance-related conformity testing throughout the lifecycle of the AAT.", "justification": "Artificial Intelligence Test, Evaluation, Validation & Verification (AI TEVV) (AAT-28) provides periodic assessment and assurance that compensates for the absence of Generative Artificial Intelligence (GAI) Identification (AAT-27.1) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "AAT-27.2", "risk_if_not_implemented": "Without AI & Autonomous Technologies Capabilities Testing, AI and autonomous systems may produce unreliable, biased or unsafe outputs, act outside authorized scope, or expose sensitive data. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unreliable Assurance / Decision Information (R-GV-10), and most likely increases susceptibility to Human Error (MT-9), Artificial Intelligence & Autonomous Technologies (AAT) System Failure or Unintended Behavior (MT-13).", "compensating_control_1": { "control_id": "TDA-17", "name": "Security, Compliance & Resilience Testing Throughout Development", "description": "Mechanisms exist to require system developers/integrators consult with security, compliance and/or resilience personnel to: \n(1) Create and implement a Security Testing and Evaluation (ST&E) plan, or similar capability;\n(2) Implement a verifiable flaw remediation process to correct weaknesses and deficiencies identified during the control testing and evaluation process; and\n(3) Document the results.", "justification": "Security, Compliance & Resilience Testing Throughout Development (TDA-17) provides periodic assessment and assurance that compensates for the absence of AI & Autonomous Technologies Capabilities Testing (AAT-27.2) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CPL-05", "name": "Conformity Monitoring", "description": "Mechanisms exist to validate that Technology Assets, Applications, Services and/or Data (TAASD) conform to the organization's security, compliance and/or resilience policies, standards and other applicable requirements.", "justification": "Conformity Monitoring (CPL-05) provides periodic assessment and assurance that compensates for the absence of AI & Autonomous Technologies Capabilities Testing (AAT-27.2) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "AAT-27.3", "risk_if_not_implemented": "Without Real-World Testing, AI and autonomous systems may produce unreliable, biased or unsafe outputs, act outside authorized scope, or expose sensitive data. Based on the risk and threat mapping for this control, no risk is rated Likely; risks rated Possible include Reduced Operational Productivity (R-BC-3), Reputational Harm / Loss of Stakeholder Trust (R-EX-4), Regulatory / Legal / Contractual Financial Liability (R-EX-5), and most likely increases susceptibility to Human Error (MT-9), Artificial Intelligence & Autonomous Technologies (AAT) System Failure or Unintended Behavior (MT-13), Workforce Shortage / Loss of Critical Skills / Labor Disruption (MT-25).", "compensating_control_1": { "control_id": "VPM-18", "name": "Penetration Testing", "description": "Mechanisms exist to conduct penetration testing on Technology Assets, Applications and/or Services (TAAS).", "justification": "Penetration Testing (VPM-18) provides periodic assessment and assurance that compensates for the absence of Real-World Testing (AAT-27.3) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "TDA-17", "name": "Security, Compliance & Resilience Testing Throughout Development", "description": "Mechanisms exist to require system developers/integrators consult with security, compliance and/or resilience personnel to: \n(1) Create and implement a Security Testing and Evaluation (ST&E) plan, or similar capability;\n(2) Implement a verifiable flaw remediation process to correct weaknesses and deficiencies identified during the control testing and evaluation process; and\n(3) Document the results.", "justification": "Security, Compliance & Resilience Testing Throughout Development (TDA-17) provides periodic assessment and assurance that compensates for the absence of Real-World Testing (AAT-27.3) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "AAT-27.4", "risk_if_not_implemented": "Without Documenting Testing Guidance, AI and autonomous systems may produce unreliable, biased or unsafe outputs, act outside authorized scope, or expose sensitive data. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Inability to Demonstrate Due Diligence / Due Care (R-GV-9), and most likely increases susceptibility to Human Error (MT-9).", "compensating_control_1": { "control_id": "CPL-05", "name": "Conformity Monitoring", "description": "Mechanisms exist to validate that Technology Assets, Applications, Services and/or Data (TAASD) conform to the organization's security, compliance and/or resilience policies, standards and other applicable requirements.", "justification": "Conformity Monitoring (CPL-05) provides periodic assessment and assurance that compensates for the absence of Documenting Testing Guidance (AAT-27.4) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "TDA-17", "name": "Security, Compliance & Resilience Testing Throughout Development", "description": "Mechanisms exist to require system developers/integrators consult with security, compliance and/or resilience personnel to: \n(1) Create and implement a Security Testing and Evaluation (ST&E) plan, or similar capability;\n(2) Implement a verifiable flaw remediation process to correct weaknesses and deficiencies identified during the control testing and evaluation process; and\n(3) Document the results.", "justification": "Security, Compliance & Resilience Testing Throughout Development (TDA-17) provides periodic assessment and assurance that compensates for the absence of Documenting Testing Guidance (AAT-27.4) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "AAT-28.2", "risk_if_not_implemented": "Without AI TEVV Tools, AI and autonomous systems may produce unreliable, biased or unsafe outputs, act outside authorized scope, or expose sensitive data. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Lack of oversight of internal controls (R-GV-6), Inability to Demonstrate Due Diligence / Due Care (R-GV-9), Unreliable Assurance / Decision Information (R-GV-10), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9).", "compensating_control_1": { "control_id": "TDA-17", "name": "Security, Compliance & Resilience Testing Throughout Development", "description": "Mechanisms exist to require system developers/integrators consult with security, compliance and/or resilience personnel to: \n(1) Create and implement a Security Testing and Evaluation (ST&E) plan, or similar capability;\n(2) Implement a verifiable flaw remediation process to correct weaknesses and deficiencies identified during the control testing and evaluation process; and\n(3) Document the results.", "justification": "Security, Compliance & Resilience Testing Throughout Development (TDA-17) provides periodic assessment and assurance that compensates for the absence of AI TEVV Tools (AAT-28.2) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CPL-05", "name": "Conformity Monitoring", "description": "Mechanisms exist to validate that Technology Assets, Applications, Services and/or Data (TAASD) conform to the organization's security, compliance and/or resilience policies, standards and other applicable requirements.", "justification": "Conformity Monitoring (CPL-05) provides periodic assessment and assurance that compensates for the absence of AI TEVV Tools (AAT-28.2) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "AAT-28.3", "risk_if_not_implemented": "Without AI TEVV Trustworthiness Demonstration, AI and autonomous systems may produce unreliable, biased or unsafe outputs, act outside authorized scope, or expose sensitive data. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Lack of oversight of internal controls (R-GV-6), Inability to Demonstrate Due Diligence / Due Care (R-GV-9), Unreliable Assurance / Decision Information (R-GV-10), AI Output / Decision Integrity Failure (R-AI-1), Unintended or Unsafe Technology Behavior (R-AI-5), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Data Quality Degradation / Data Poisoning (MT-12), Artificial Intelligence & Autonomous Technologies (AAT) System Failure or Unintended Behavior (MT-13).", "compensating_control_1": { "control_id": "TDA-05", "name": "Secure Software Development Practices (SSDP)", "description": "Mechanisms exist to develop applications based on Secure Software Development Practices (SSDP).", "justification": "Secure Software Development Practices (SSDP) (TDA-05) provides overlapping security capability that compensates for the absence of AI TEVV Trustworthiness Demonstration (AAT-28.3) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "TDA-17", "name": "Security, Compliance & Resilience Testing Throughout Development", "description": "Mechanisms exist to require system developers/integrators consult with security, compliance and/or resilience personnel to: \n(1) Create and implement a Security Testing and Evaluation (ST&E) plan, or similar capability;\n(2) Implement a verifiable flaw remediation process to correct weaknesses and deficiencies identified during the control testing and evaluation process; and\n(3) Document the results.", "justification": "Security, Compliance & Resilience Testing Throughout Development (TDA-17) provides periodic assessment and assurance that compensates for the absence of AI TEVV Trustworthiness Demonstration (AAT-28.3) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "AAT-28.5", "risk_if_not_implemented": "Without AI TEVV Security & Resiliency Assessment, critical business processes and services may not withstand or recover from disruption, causing extended outages and data loss. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Lack of oversight of internal controls (R-GV-6), Inability to Demonstrate Due Diligence / Due Care (R-GV-9), Unreliable Assurance / Decision Information (R-GV-10), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Artificial Intelligence & Autonomous Technologies (AAT) System Failure or Unintended Behavior (MT-13), Adversarial Artificial Intelligence (AI) Attack (MT-29).", "compensating_control_1": { "control_id": "IAO-11", "name": "Technical Verification", "description": "Mechanisms exist to perform Control Validation Testing (CVT) activities to evaluate the design, implementation and effectiveness of technical security, compliance and resilience controls.", "justification": "Technical Verification (IAO-11) provides overlapping security capability that compensates for the absence of AI TEVV Security & Resiliency Assessment (AAT-28.5) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CPL-05", "name": "Conformity Monitoring", "description": "Mechanisms exist to validate that Technology Assets, Applications, Services and/or Data (TAASD) conform to the organization's security, compliance and/or resilience policies, standards and other applicable requirements.", "justification": "Conformity Monitoring (CPL-05) provides periodic assessment and assurance that compensates for the absence of AI TEVV Security & Resiliency Assessment (AAT-28.5) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "AAT-28.6", "risk_if_not_implemented": "Without AI TEVV Transparency & Accountability Assessment, unauthorized individuals, devices or services may gain access to Technology Assets, Applications, Services, Data and/or Facilities (TAASDF). Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss of Accountability / Attribution (R-AC-1), Lack of oversight of internal controls (R-GV-6), Inability to Demonstrate Due Diligence / Due Care (R-GV-9), Unreliable Assurance / Decision Information (R-GV-10), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Artificial Intelligence & Autonomous Technologies (AAT) System Failure or Unintended Behavior (MT-13).", "compensating_control_1": { "control_id": "RSK-13", "name": "Risk Assessment", "description": "Mechanisms exist to conduct recurring assessments of risk that includes the likelihood and magnitude of harm, from unauthorized access, use, disclosure, disruption, modification or destruction of the organization's Technology Assets, Applications, Services and/or Data (TAASD).", "justification": "Risk Assessment (RSK-13) provides periodic assessment and assurance that compensates for the absence of AI TEVV Transparency & Accountability Assessment (AAT-28.6) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "AAT-28", "name": "Artificial Intelligence Test, Evaluation, Validation & Verification (AI TEVV)", "description": "Mechanisms exist to implement Artificial Intelligence Test, Evaluation, Validation & Verification (AI TEVV) practices to enable Artificial Intelligence (AI) and Autonomous Technologies (AAT)-related security, resilience and compliance-related conformity testing throughout the lifecycle of the AAT.", "justification": "Artificial Intelligence Test, Evaluation, Validation & Verification (AI TEVV) (AAT-28) provides periodic assessment and assurance that compensates for the absence of AI TEVV Transparency & Accountability Assessment (AAT-28.6) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "AAT-28.7", "risk_if_not_implemented": "Without AI TEVV Privacy Assessment, Personal Data (PD) may be collected, processed, retained or shared without lawful authority or adequate safeguards, harming individuals and exposing the organization to regulatory action. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to R-EX-5, R-GV-6, R-GV-9, R-GV-10, R-AI-2, R-IP-6, and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Artificial Intelligence & Autonomous Technologies (AAT) System Failure or Unintended Behavior (MT-13).", "compensating_control_1": { "control_id": "MON-02", "name": "Continuous Monitoring", "description": "Mechanisms exist to facilitate the implementation of enterprise-wide monitoring controls.", "justification": "Continuous Monitoring (MON-02) provides detective monitoring capability that compensates for the absence of AI TEVV Privacy Assessment (AAT-28.7) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "AAT-36", "name": "AI & Autonomous Technologies Production Monitoring", "description": "Mechanisms exist to monitor the functionality and behavior of the deployed Artificial Intelligence (AI) and Autonomous Technologies (AAT).", "justification": "AI & Autonomous Technologies Production Monitoring (AAT-36) provides detective monitoring capability that compensates for the absence of AI TEVV Privacy Assessment (AAT-28.7) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "AAT-28.8", "risk_if_not_implemented": "Without AI TEVV Fairness & Bias Assessment, AI and autonomous systems may produce unreliable, biased or unsafe outputs, act outside authorized scope, or expose sensitive data. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Regulatory / Legal / Contractual Financial Liability (R-EX-5), Lack of oversight of internal controls (R-GV-6), Inability to Demonstrate Due Diligence / Due Care (R-GV-9), Unreliable Assurance / Decision Information (R-GV-10), AI Bias / Discriminatory Outcome (R-AI-6), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Data Quality Degradation / Data Poisoning (MT-12), Artificial Intelligence & Autonomous Technologies (AAT) System Failure or Unintended Behavior (MT-13).", "compensating_control_1": { "control_id": "TDA-17", "name": "Security, Compliance & Resilience Testing Throughout Development", "description": "Mechanisms exist to require system developers/integrators consult with security, compliance and/or resilience personnel to: \n(1) Create and implement a Security Testing and Evaluation (ST&E) plan, or similar capability;\n(2) Implement a verifiable flaw remediation process to correct weaknesses and deficiencies identified during the control testing and evaluation process; and\n(3) Document the results.", "justification": "Security, Compliance & Resilience Testing Throughout Development (TDA-17) provides periodic assessment and assurance that compensates for the absence of AI TEVV Fairness & Bias Assessment (AAT-28.8) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "VPM-18", "name": "Penetration Testing", "description": "Mechanisms exist to conduct penetration testing on Technology Assets, Applications and/or Services (TAAS).", "justification": "Penetration Testing (VPM-18) provides periodic assessment and assurance that compensates for the absence of AI TEVV Fairness & Bias Assessment (AAT-28.8) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "AAT-28.9", "risk_if_not_implemented": "Without AI & Autonomous Technologies Model Validation, AI and autonomous systems may produce unreliable, biased or unsafe outputs, act outside authorized scope, or expose sensitive data. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Lack of oversight of internal controls (R-GV-6), Inability to Demonstrate Due Diligence / Due Care (R-GV-9), Unreliable Assurance / Decision Information (R-GV-10), AI Output / Decision Integrity Failure (R-AI-1), Unintended or Unsafe Technology Behavior (R-AI-5), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Data Quality Degradation / Data Poisoning (MT-12), Artificial Intelligence & Autonomous Technologies (AAT) System Failure or Unintended Behavior (MT-13), Adversarial Artificial Intelligence (AI) Attack (MT-29).", "compensating_control_1": { "control_id": "VPM-18", "name": "Penetration Testing", "description": "Mechanisms exist to conduct penetration testing on Technology Assets, Applications and/or Services (TAAS).", "justification": "Penetration Testing (VPM-18) provides periodic assessment and assurance that compensates for the absence of AI & Autonomous Technologies Model Validation (AAT-28.9) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "TDA-17", "name": "Security, Compliance & Resilience Testing Throughout Development", "description": "Mechanisms exist to require system developers/integrators consult with security, compliance and/or resilience personnel to: \n(1) Create and implement a Security Testing and Evaluation (ST&E) plan, or similar capability;\n(2) Implement a verifiable flaw remediation process to correct weaknesses and deficiencies identified during the control testing and evaluation process; and\n(3) Document the results.", "justification": "Security, Compliance & Resilience Testing Throughout Development (TDA-17) provides periodic assessment and assurance that compensates for the absence of AI & Autonomous Technologies Model Validation (AAT-28.9) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "AAT-28.10", "risk_if_not_implemented": "Without AI TEVV Comparable Deployment Settings, AI and autonomous systems may produce unreliable, biased or unsafe outputs, act outside authorized scope, or expose sensitive data. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Lack of oversight of internal controls (R-GV-6), Inability to Demonstrate Due Diligence / Due Care (R-GV-9), Unreliable Assurance / Decision Information (R-GV-10), AI Output / Decision Integrity Failure (R-AI-1), Unintended or Unsafe Technology Behavior (R-AI-5), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Data Quality Degradation / Data Poisoning (MT-12), Artificial Intelligence & Autonomous Technologies (AAT) System Failure or Unintended Behavior (MT-13).", "compensating_control_1": { "control_id": "TDA-17", "name": "Security, Compliance & Resilience Testing Throughout Development", "description": "Mechanisms exist to require system developers/integrators consult with security, compliance and/or resilience personnel to: \n(1) Create and implement a Security Testing and Evaluation (ST&E) plan, or similar capability;\n(2) Implement a verifiable flaw remediation process to correct weaknesses and deficiencies identified during the control testing and evaluation process; and\n(3) Document the results.", "justification": "Security, Compliance & Resilience Testing Throughout Development (TDA-17) provides periodic assessment and assurance that compensates for the absence of AI TEVV Comparable Deployment Settings (AAT-28.10) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "IAO-04", "name": "Control Validation Testing (CVT)", "description": "Mechanisms exist to formally assess the security, compliance and resilience controls in Technology Assets, Applications and/or Services (TAAS) through Information Assurance Program (IAP) activities to determine the extent to which the controls are implemented correctly, operating as intended and producing the desired outcome with respect to meeting expected requirements.", "justification": "Control Validation Testing (CVT) (IAO-04) provides periodic assessment and assurance that compensates for the absence of AI TEVV Comparable Deployment Settings (AAT-28.10) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "AAT-28.11", "risk_if_not_implemented": "Without AI TEVV Empirically Validated Methods, AI and autonomous systems may produce unreliable, biased or unsafe outputs, act outside authorized scope, or expose sensitive data. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Lack of oversight of internal controls (R-GV-6), Inability to Demonstrate Due Diligence / Due Care (R-GV-9), Unreliable Assurance / Decision Information (R-GV-10), AI Output / Decision Integrity Failure (R-AI-1), Unintended or Unsafe Technology Behavior (R-AI-5), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Data Quality Degradation / Data Poisoning (MT-12), Artificial Intelligence & Autonomous Technologies (AAT) System Failure or Unintended Behavior (MT-13), Adversarial Artificial Intelligence (AI) Attack (MT-29).", "compensating_control_1": { "control_id": "CPL-05", "name": "Conformity Monitoring", "description": "Mechanisms exist to validate that Technology Assets, Applications, Services and/or Data (TAASD) conform to the organization's security, compliance and/or resilience policies, standards and other applicable requirements.", "justification": "Conformity Monitoring (CPL-05) provides periodic assessment and assurance that compensates for the absence of AI TEVV Empirically Validated Methods (AAT-28.11) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "IAO-11", "name": "Technical Verification", "description": "Mechanisms exist to perform Control Validation Testing (CVT) activities to evaluate the design, implementation and effectiveness of technical security, compliance and resilience controls.", "justification": "Technical Verification (IAO-11) provides overlapping security capability that compensates for the absence of AI TEVV Empirically Validated Methods (AAT-28.11) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "AAT-28.12", "risk_if_not_implemented": "Without AI TEVV Benchmarking Content Provenance, counterfeit, non-conforming or compromised components and services may enter the environment through the supply chain. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Lack of oversight of internal controls (R-GV-6), Inability to Demonstrate Due Diligence / Due Care (R-GV-9), Unreliable Assurance / Decision Information (R-GV-10), AI Data Confidentiality / Integrity / Provenance Loss (R-AI-2), Loss of Authenticity / Provenance (R-IP-5), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Data Quality Degradation / Data Poisoning (MT-12), Artificial Intelligence & Autonomous Technologies (AAT) System Failure or Unintended Behavior (MT-13), Adversarial Artificial Intelligence (AI) Attack (MT-29).", "compensating_control_1": { "control_id": "VPM-18", "name": "Penetration Testing", "description": "Mechanisms exist to conduct penetration testing on Technology Assets, Applications and/or Services (TAAS).", "justification": "Penetration Testing (VPM-18) provides periodic assessment and assurance that compensates for the absence of AI TEVV Benchmarking Content Provenance (AAT-28.12) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CPL-05", "name": "Conformity Monitoring", "description": "Mechanisms exist to validate that Technology Assets, Applications, Services and/or Data (TAASD) conform to the organization's security, compliance and/or resilience policies, standards and other applicable requirements.", "justification": "Conformity Monitoring (CPL-05) provides periodic assessment and assurance that compensates for the absence of AI TEVV Benchmarking Content Provenance (AAT-28.12) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "AAT-28.13", "risk_if_not_implemented": "Without AI TEVV Model Collapse Mitigations, AI and autonomous systems may produce unreliable, biased or unsafe outputs, act outside authorized scope, or expose sensitive data. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to AI Output / Decision Integrity Failure (R-AI-1), AI Data Confidentiality / Integrity / Provenance Loss (R-AI-2), Unintended or Unsafe Technology Behavior (R-AI-5), AI Bias / Discriminatory Outcome (R-AI-6), and most likely increases susceptibility to Human Error (MT-9), Data Quality Degradation / Data Poisoning (MT-12), Artificial Intelligence & Autonomous Technologies (AAT) System Failure or Unintended Behavior (MT-13).", "compensating_control_1": { "control_id": "TDA-17", "name": "Security, Compliance & Resilience Testing Throughout Development", "description": "Mechanisms exist to require system developers/integrators consult with security, compliance and/or resilience personnel to: \n(1) Create and implement a Security Testing and Evaluation (ST&E) plan, or similar capability;\n(2) Implement a verifiable flaw remediation process to correct weaknesses and deficiencies identified during the control testing and evaluation process; and\n(3) Document the results.", "justification": "Security, Compliance & Resilience Testing Throughout Development (TDA-17) provides periodic assessment and assurance that compensates for the absence of AI TEVV Model Collapse Mitigations (AAT-28.13) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "AAT-28", "name": "Artificial Intelligence Test, Evaluation, Validation & Verification (AI TEVV)", "description": "Mechanisms exist to implement Artificial Intelligence Test, Evaluation, Validation & Verification (AI TEVV) practices to enable Artificial Intelligence (AI) and Autonomous Technologies (AAT)-related security, resilience and compliance-related conformity testing throughout the lifecycle of the AAT.", "justification": "Artificial Intelligence Test, Evaluation, Validation & Verification (AI TEVV) (AAT-28) provides periodic assessment and assurance that compensates for the absence of AI TEVV Model Collapse Mitigations (AAT-28.13) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "AAT-28.14", "risk_if_not_implemented": "Without AI TEVV Third-Party Risk Management, supplier and External Service Provider (ESP) weaknesses, incidents or failures may propagate into the organization's environment unmanaged. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Uncontrolled Third-Party Security / Privacy Exposure (R-GV-5), Lack of oversight of third-party controls (R-GV-7), Third-Party Cybersecurity Compromise / Exposure (R-SC-1), Third-Party Legal / Compliance Exposure (R-SC-4), Sensitive Data / Compliance Exposure from Unsanctioned AI Use (R-AI-4), and most likely increases susceptibility to Human Error (MT-9).", "compensating_control_1": { "control_id": "CPL-05", "name": "Conformity Monitoring", "description": "Mechanisms exist to validate that Technology Assets, Applications, Services and/or Data (TAASD) conform to the organization's security, compliance and/or resilience policies, standards and other applicable requirements.", "justification": "Conformity Monitoring (CPL-05) provides periodic assessment and assurance that compensates for the absence of AI TEVV Third-Party Risk Management (AAT-28.14) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "TDA-05", "name": "Secure Software Development Practices (SSDP)", "description": "Mechanisms exist to develop applications based on Secure Software Development Practices (SSDP).", "justification": "Secure Software Development Practices (SSDP) (TDA-05) provides overlapping security capability that compensates for the absence of AI TEVV Third-Party Risk Management (AAT-28.14) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "AAT-29.1", "risk_if_not_implemented": "Without AI TEVV Effectiveness, AI and autonomous systems may produce unreliable, biased or unsafe outputs, act outside authorized scope, or expose sensitive data. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Lack of oversight of internal controls (R-GV-6), Inability to Demonstrate Due Diligence / Due Care (R-GV-9), Unreliable Assurance / Decision Information (R-GV-10), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9).", "compensating_control_1": { "control_id": "IAO-04", "name": "Control Validation Testing (CVT)", "description": "Mechanisms exist to formally assess the security, compliance and resilience controls in Technology Assets, Applications and/or Services (TAAS) through Information Assurance Program (IAP) activities to determine the extent to which the controls are implemented correctly, operating as intended and producing the desired outcome with respect to meeting expected requirements.", "justification": "Control Validation Testing (CVT) (IAO-04) provides periodic assessment and assurance that compensates for the absence of AI TEVV Effectiveness (AAT-29.1) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CPL-05", "name": "Conformity Monitoring", "description": "Mechanisms exist to validate that Technology Assets, Applications, Services and/or Data (TAASD) conform to the organization's security, compliance and/or resilience policies, standards and other applicable requirements.", "justification": "Conformity Monitoring (CPL-05) provides periodic assessment and assurance that compensates for the absence of AI TEVV Effectiveness (AAT-29.1) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "AAT-30", "risk_if_not_implemented": "Without AI TEVV Reporting, AI and autonomous systems may produce unreliable, biased or unsafe outputs, act outside authorized scope, or expose sensitive data. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Lack of oversight of internal controls (R-GV-6), Inability to Demonstrate Due Diligence / Due Care (R-GV-9), Unreliable Assurance / Decision Information (R-GV-10), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Conflict of Interest (COI) / Undue Influence / Insider Misconduct (MT-15).", "compensating_control_1": { "control_id": "IAO-04", "name": "Control Validation Testing (CVT)", "description": "Mechanisms exist to formally assess the security, compliance and resilience controls in Technology Assets, Applications and/or Services (TAAS) through Information Assurance Program (IAP) activities to determine the extent to which the controls are implemented correctly, operating as intended and producing the desired outcome with respect to meeting expected requirements.", "justification": "Control Validation Testing (CVT) (IAO-04) provides periodic assessment and assurance that compensates for the absence of AI TEVV Reporting (AAT-30) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "AAT-28", "name": "Artificial Intelligence Test, Evaluation, Validation & Verification (AI TEVV)", "description": "Mechanisms exist to implement Artificial Intelligence Test, Evaluation, Validation & Verification (AI TEVV) practices to enable Artificial Intelligence (AI) and Autonomous Technologies (AAT)-related security, resilience and compliance-related conformity testing throughout the lifecycle of the AAT.", "justification": "Artificial Intelligence Test, Evaluation, Validation & Verification (AI TEVV) (AAT-28) provides periodic assessment and assurance that compensates for the absence of AI TEVV Reporting (AAT-30) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "AAT-30.1", "risk_if_not_implemented": "Without AI & Autonomous Technologies Residual Risks, AI and autonomous systems may produce unreliable, biased or unsafe outputs, act outside authorized scope, or expose sensitive data. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Inability to Demonstrate Due Diligence / Due Care (R-GV-9), Unreliable Assurance / Decision Information (R-GV-10), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Conflict of Interest (COI) / Undue Influence / Insider Misconduct (MT-15).", "compensating_control_1": { "control_id": "RSK-13", "name": "Risk Assessment", "description": "Mechanisms exist to conduct recurring assessments of risk that includes the likelihood and magnitude of harm, from unauthorized access, use, disclosure, disruption, modification or destruction of the organization's Technology Assets, Applications, Services and/or Data (TAASD).", "justification": "Risk Assessment (RSK-13) provides periodic assessment and assurance that compensates for the absence of AI & Autonomous Technologies Negative Residual Risks (AAT-30.1) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "GOV-06", "name": "Defining Business Context & Mission", "description": "Mechanisms exist to document the organization's business model and mission.", "justification": "Defining Business Context & Mission (GOV-06) provides overlapping security capability that compensates for the absence of AI & Autonomous Technologies Negative Residual Risks (AAT-30.1) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "AAT-31", "risk_if_not_implemented": "Without AI TEVV Post-Deployment Monitoring, AI and autonomous systems may produce unreliable, biased or unsafe outputs, act outside authorized scope, or expose sensitive data. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Delayed Containment / Increased Incident Impact (R-IR-2), Undetected / Delayed Detection of Adverse Activity (R-SA-1), AI Output / Decision Integrity Failure (R-AI-1), Unintended or Unsafe Technology Behavior (R-AI-5), and most likely increases susceptibility to man-made threats MT-2, MT-9, MT-10, MT-12, MT-13, MT-29.", "compensating_control_1": { "control_id": "CPL-05", "name": "Conformity Monitoring", "description": "Mechanisms exist to validate that Technology Assets, Applications, Services and/or Data (TAASD) conform to the organization's security, compliance and/or resilience policies, standards and other applicable requirements.", "justification": "Conformity Monitoring (CPL-05) provides periodic assessment and assurance that compensates for the absence of AI TEVV Post-Deployment Monitoring (AAT-31) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "VPM-18", "name": "Penetration Testing", "description": "Mechanisms exist to conduct penetration testing on Technology Assets, Applications and/or Services (TAAS).", "justification": "Penetration Testing (VPM-18) provides periodic assessment and assurance that compensates for the absence of AI TEVV Post-Deployment Monitoring (AAT-31) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "AAT-32", "risk_if_not_implemented": "Without Updating AI & Autonomous Technologies, AI and autonomous systems may produce unreliable, biased or unsafe outputs, act outside authorized scope, or expose sensitive data. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to AI Output / Decision Integrity Failure (R-AI-1), Unintended or Unsafe Technology Behavior (R-AI-5), and most likely increases susceptibility to Human Error (MT-9).", "compensating_control_1": { "control_id": "TDA-05", "name": "Secure Software Development Practices (SSDP)", "description": "Mechanisms exist to develop applications based on Secure Software Development Practices (SSDP).", "justification": "Secure Software Development Practices (SSDP) (TDA-05) provides overlapping security capability that compensates for the absence of Updating AI & Autonomous Technologies (AAT-32) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CPL-05", "name": "Conformity Monitoring", "description": "Mechanisms exist to validate that Technology Assets, Applications, Services and/or Data (TAASD) conform to the organization's security, compliance and/or resilience policies, standards and other applicable requirements.", "justification": "Conformity Monitoring (CPL-05) provides periodic assessment and assurance that compensates for the absence of Updating AI & Autonomous Technologies (AAT-32) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "AAT-33", "risk_if_not_implemented": "Without Robust Stakeholder Engagement for AI & Autonomous Technologies, AI and autonomous systems may produce unreliable, biased or unsafe outputs, act outside authorized scope, or expose sensitive data. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unintended or Unsafe Technology Behavior (R-AI-5), AI Bias / Discriminatory Outcome (R-AI-6), and most likely increases susceptibility to Human Error (MT-9).", "compensating_control_1": { "control_id": "GOV-16", "name": "Contacts With Groups & Associations", "description": "Mechanisms exist to establish contact with selected groups and associations within the security, compliance and resilience communities to: \n(1) Facilitate ongoing cybersecurity and data protection education and training for organizational personnel;\n(2) Maintain currency with recommended cybersecurity and data protection practices, techniques and technologies; and\n(3) Share current cybersecurity and/or data protection-related information including threats, vulnerabilities and incidents.", "justification": "Contacts With Groups & Associations (GOV-16) provides overlapping security capability that compensates for the absence of Robust Stakeholder Engagement for AI & Autonomous Technologies (AAT-33) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CPL-05", "name": "Conformity Monitoring", "description": "Mechanisms exist to validate that Technology Assets, Applications, Services and/or Data (TAASD) conform to the organization's security, compliance and/or resilience policies, standards and other applicable requirements.", "justification": "Conformity Monitoring (CPL-05) provides periodic assessment and assurance that compensates for the absence of Robust Stakeholder Engagement for AI & Autonomous Technologies (AAT-33) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "AAT-33.1", "risk_if_not_implemented": "Without AI & Autonomous Technologies Stakeholder Feedback Integration, AI and autonomous systems may produce unreliable, biased or unsafe outputs, act outside authorized scope, or expose sensitive data. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unintended or Unsafe Technology Behavior (R-AI-5), AI Bias / Discriminatory Outcome (R-AI-6), and most likely increases susceptibility to Human Error (MT-9), Conflict of Interest (COI) / Undue Influence / Insider Misconduct (MT-15).", "compensating_control_1": { "control_id": "TPM-02", "name": "Third-Party Management", "description": "Mechanisms exist to facilitate the implementation of third-party management controls.", "justification": "Third-Party Management (TPM-02) provides third-party oversight that compensates for the absence of AI & Autonomous Technologies Stakeholder Feedback Integration (AAT-33.1) by extending security obligations contractually and monitoring third-party risk in lieu of direct control. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "GOV-16", "name": "Contacts With Groups & Associations", "description": "Mechanisms exist to establish contact with selected groups and associations within the security, compliance and resilience communities to: \n(1) Facilitate ongoing cybersecurity and data protection education and training for organizational personnel;\n(2) Maintain currency with recommended cybersecurity and data protection practices, techniques and technologies; and\n(3) Share current cybersecurity and/or data protection-related information including threats, vulnerabilities and incidents.", "justification": "Contacts With Groups & Associations (GOV-16) provides overlapping security capability that compensates for the absence of AI & Autonomous Technologies Stakeholder Feedback Integration (AAT-33.1) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "AAT-33.2", "risk_if_not_implemented": "Without AI & Autonomous Technologies Ongoing Assessments, AI and autonomous systems may produce unreliable, biased or unsafe outputs, act outside authorized scope, or expose sensitive data. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Lack of oversight of internal controls (R-GV-6), Inability to Demonstrate Due Diligence / Due Care (R-GV-9), Unreliable Assurance / Decision Information (R-GV-10), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Conflict of Interest (COI) / Undue Influence / Insider Misconduct (MT-15), Workforce Shortage / Loss of Critical Skills / Labor Disruption (MT-25).", "compensating_control_1": { "control_id": "PRI-39.1", "name": "Data Subject Empowerment", "description": "Mechanisms exist to provide authenticated data subjects the ability to:\n(1) Access their Personal Data (PD) that is being processed, stored and shared, except where the burden, risk or expense of providing access would be disproportionate to the benefit offered to the data subject through granting access;\n(2) Obtain answers on the specifics of how their PD is collected, received, processed, stored, transmitted, shared, updated and/or disposed; \n(3) Obtain the source(s) of their PD; \n(4) Obtain the categories of their PD being collected, received, processed, stored and shared; \n(5) Request correction to their PD due to inaccuracies;\n(6) Request erasure of their PD; and\n(7) Restrict the further collecting, receiving, processing, storing, transmitting, updated and/or sharing of their PD.", "justification": "Data Subject Empowerment (PRI-39.1) provides privacy protection that compensates for the absence of AI & Autonomous Technologies Ongoing Assessments (AAT-33.2) by applying alternative privacy safeguards to protect personal data and honor data subject rights. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "GOV-16", "name": "Contacts With Groups & Associations", "description": "Mechanisms exist to establish contact with selected groups and associations within the security, compliance and resilience communities to: \n(1) Facilitate ongoing cybersecurity and data protection education and training for organizational personnel;\n(2) Maintain currency with recommended cybersecurity and data protection practices, techniques and technologies; and\n(3) Share current cybersecurity and/or data protection-related information including threats, vulnerabilities and incidents.", "justification": "Contacts With Groups & Associations (GOV-16) provides overlapping security capability that compensates for the absence of AI & Autonomous Technologies Ongoing Assessments (AAT-33.2) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "AAT-33.3", "risk_if_not_implemented": "Without AI & Autonomous Technologies End User Feedback, AI and autonomous systems may produce unreliable, biased or unsafe outputs, act outside authorized scope, or expose sensitive data. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unreliable Assurance / Decision Information (R-GV-10), AI Bias / Discriminatory Outcome (R-AI-6), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Data Quality Degradation / Data Poisoning (MT-12).", "compensating_control_1": { "control_id": "GOV-16", "name": "Contacts With Groups & Associations", "description": "Mechanisms exist to establish contact with selected groups and associations within the security, compliance and resilience communities to: \n(1) Facilitate ongoing cybersecurity and data protection education and training for organizational personnel;\n(2) Maintain currency with recommended cybersecurity and data protection practices, techniques and technologies; and\n(3) Share current cybersecurity and/or data protection-related information including threats, vulnerabilities and incidents.", "justification": "Contacts With Groups & Associations (GOV-16) provides overlapping security capability that compensates for the absence of AI & Autonomous Technologies End User Feedback (AAT-33.3) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CPL-02", "name": "Statutory, Regulatory & Contractual Compliance", "description": "Mechanisms exist to facilitate the identification and implementation of relevant statutory, regulatory and contractual controls.", "justification": "Statutory, Regulatory & Contractual Compliance (CPL-02) provides overlapping security capability that compensates for the absence of AI & Autonomous Technologies End User Feedback (AAT-33.3) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "AAT-33.4", "risk_if_not_implemented": "Without AI & Autonomous Technologies Incident & Error Reporting, security incidents may not be detected, contained, investigated or communicated in a timely manner, increasing their scope, duration and cost. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unreliable Assurance / Decision Information (R-GV-10), Delayed Containment / Increased Incident Impact (R-IR-2), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Conflict of Interest (COI) / Undue Influence / Insider Misconduct (MT-15).", "compensating_control_1": { "control_id": "AAT-34", "name": "AI & Autonomous Technologies Stakeholder Diversity", "description": "Mechanisms exist to ensure Artificial Intelligence (AI) and Autonomous Technologies (AAT) stakeholder competencies, skills and capacities incorporate demographic diversity, broad domain and user experience expertise.", "justification": "AI & Autonomous Technologies Stakeholder Diversity (AAT-34) provides detective monitoring capability that compensates for the absence of AI & Autonomous Technologies Incident & Error Reporting (AAT-33.4) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "GOV-16", "name": "Contacts With Groups & Associations", "description": "Mechanisms exist to establish contact with selected groups and associations within the security, compliance and resilience communities to: \n(1) Facilitate ongoing cybersecurity and data protection education and training for organizational personnel;\n(2) Maintain currency with recommended cybersecurity and data protection practices, techniques and technologies; and\n(3) Share current cybersecurity and/or data protection-related information including threats, vulnerabilities and incidents.", "justification": "Contacts With Groups & Associations (GOV-16) provides overlapping security capability that compensates for the absence of AI & Autonomous Technologies Incident & Error Reporting (AAT-33.4) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "AAT-34", "risk_if_not_implemented": "Without AI & Autonomous Technologies Stakeholder Diversity, AI and autonomous systems may produce unreliable, biased or unsafe outputs, act outside authorized scope, or expose sensitive data. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to AI Bias / Discriminatory Outcome (R-AI-6), Loss of Critical Knowledge / Capability (R-PE-1), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Workforce Shortage / Loss of Critical Skills / Labor Disruption (MT-25).", "compensating_control_1": { "control_id": "HRS-04", "name": "Defined Roles & Responsibilities", "description": "Mechanisms exist to define cybersecurity roles & responsibilities for all personnel.", "justification": "Defined Roles & Responsibilities (HRS-04) provides overlapping security capability that compensates for the absence of AI & Autonomous Technologies Stakeholder Diversity (AAT-34) by addressing related risk objectives through an alternative control mechanism aligned with People applicability. Given the people-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "GOV-16", "name": "Contacts With Groups & Associations", "description": "Mechanisms exist to establish contact with selected groups and associations within the security, compliance and resilience communities to: \n(1) Facilitate ongoing cybersecurity and data protection education and training for organizational personnel;\n(2) Maintain currency with recommended cybersecurity and data protection practices, techniques and technologies; and\n(3) Share current cybersecurity and/or data protection-related information including threats, vulnerabilities and incidents.", "justification": "Contacts With Groups & Associations (GOV-16) provides overlapping security capability that compensates for the absence of AI & Autonomous Technologies Stakeholder Diversity (AAT-34) by addressing related risk objectives through an alternative control mechanism aligned with People applicability. Given the people-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "AAT-34.1", "risk_if_not_implemented": "Without AI & Autonomous Technologies Stakeholder Competencies, AI and autonomous systems may produce unreliable, biased or unsafe outputs, act outside authorized scope, or expose sensitive data. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Lack of a security-minded workforce (R-SA-2), Loss of Critical Knowledge / Capability (R-PE-1), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Workforce Shortage / Loss of Critical Skills / Labor Disruption (MT-25).", "compensating_control_1": { "control_id": "GOV-16", "name": "Contacts With Groups & Associations", "description": "Mechanisms exist to establish contact with selected groups and associations within the security, compliance and resilience communities to: \n(1) Facilitate ongoing cybersecurity and data protection education and training for organizational personnel;\n(2) Maintain currency with recommended cybersecurity and data protection practices, techniques and technologies; and\n(3) Share current cybersecurity and/or data protection-related information including threats, vulnerabilities and incidents.", "justification": "Contacts With Groups & Associations (GOV-16) provides overlapping security capability that compensates for the absence of AI & Autonomous Technologies Stakeholder Competencies (AAT-34.1) by addressing related risk objectives through an alternative control mechanism aligned with People applicability. Given the people-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "HRS-04", "name": "Defined Roles & Responsibilities", "description": "Mechanisms exist to define cybersecurity roles & responsibilities for all personnel.", "justification": "Defined Roles & Responsibilities (HRS-04) provides overlapping security capability that compensates for the absence of AI & Autonomous Technologies Stakeholder Competencies (AAT-34.1) by addressing related risk objectives through an alternative control mechanism aligned with People applicability. Given the people-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "AAT-35", "risk_if_not_implemented": "Without AI & Autonomous Technologies Deployment, AI and autonomous systems may produce unreliable, biased or unsafe outputs, act outside authorized scope, or expose sensitive data. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Harm from Unauthorized / Unintended Product or Service Use (R-SC-5), Unintended or Unsafe Technology Behavior (R-AI-5), and most likely increases susceptibility to Human Error (MT-9).", "compensating_control_1": { "control_id": "CFG-02", "name": "Configuration Management Program", "description": "Mechanisms exist to facilitate the implementation of configuration management controls.", "justification": "Configuration Management Program (CFG-02) provides policy-level governance that compensates for the absence of AI & Autonomous Technologies Deployment (AAT-35) by establishing documented expectations, accountability structures, and organizational guardrails. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CHG-02", "name": "Change Management Program", "description": "Mechanisms exist to facilitate the implementation of a change management program.", "justification": "Change Management Program (CHG-02) provides policy-level governance that compensates for the absence of AI & Autonomous Technologies Deployment (AAT-35) by establishing documented expectations, accountability structures, and organizational guardrails. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "AAT-35.1", "risk_if_not_implemented": "Without AI & Autonomous Technologies Human Oversight, AI and autonomous systems may produce unreliable, biased or unsafe outputs, act outside authorized scope, or expose sensitive data. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unperformed / Unowned Control Responsibilities (R-GV-3), Unauthorized / Harmful Autonomous Action (R-AI-3), Unintended or Unsafe Technology Behavior (R-AI-5), AI Bias / Discriminatory Outcome (R-AI-6), Injury / Loss of Life (R-SF-1), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Conflict of Interest (COI) / Undue Influence / Insider Misconduct (MT-15), Workforce Shortage / Loss of Critical Skills / Labor Disruption (MT-25).", "compensating_control_1": { "control_id": "CFG-04", "name": "Secure Baseline Configurations", "description": "Mechanisms exist to develop, document and maintain secure baseline configurations for Technology Assets, Applications and/or Services (TAAS) that are consistent with industry-accepted hardening standards.", "justification": "Secure Baseline Configurations (CFG-04) provides configuration hardening that compensates for the absence of AI & Autonomous Technologies Human Oversight (AAT-35.1) by eliminating unnecessary services and enforcing secure settings to reduce inherent exposure. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CHG-06", "name": "Security Impact Analysis for Changes", "description": "Mechanisms exist to analyze proposed changes for potential security impacts, prior to the implementation of the change.", "justification": "Security Impact Analysis for Changes (CHG-06) provides risk identification and prioritization that compensates for the absence of AI & Autonomous Technologies Human Oversight (AAT-35.1) by enabling informed decisions about where to focus resources to manage residual exposure. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "AAT-35.2", "risk_if_not_implemented": "Without AI & Autonomous Technologies Oversight Measures, AI and autonomous systems may produce unreliable, biased or unsafe outputs, act outside authorized scope, or expose sensitive data. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unaddressed Security / Compliance Exposure (R-GV-2), Unauthorized / Harmful Autonomous Action (R-AI-3), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Conflict of Interest (COI) / Undue Influence / Insider Misconduct (MT-15).", "compensating_control_1": { "control_id": "CHG-03", "name": "Configuration Change Control", "description": "Mechanisms exist to govern the technical configuration change control processes.", "justification": "Configuration Change Control (CHG-03) provides configuration hardening that compensates for the absence of AI & Autonomous Technologies Oversight Measures (AAT-35.2) by eliminating unnecessary services and enforcing secure settings to reduce inherent exposure. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CFG-08.2", "name": "Integrity Assurance & Enforcement (IAE)", "description": "Automated mechanisms exist to:\n(1) Identify unauthorized deviations from an approved secure baseline configuration; and\n(2) Implement automated resiliency actions to remediate the unauthorized change.", "justification": "Integrity Assurance & Enforcement (IAE) (CFG-08.2) provides configuration hardening that compensates for the absence of AI & Autonomous Technologies Oversight Measures (AAT-35.2) by eliminating unnecessary services and enforcing secure settings to reduce inherent exposure. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "AAT-35.3", "risk_if_not_implemented": "Without AI & Autonomous Technologies Separate Verification, AI and autonomous systems may produce unreliable, biased or unsafe outputs, act outside authorized scope, or expose sensitive data. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unreliable Assurance / Decision Information (R-GV-10), AI Output / Decision Integrity Failure (R-AI-1), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Fraud, Corruption and/or Intentional Criminal Conduct (MT-14), Conflict of Interest (COI) / Undue Influence / Insider Misconduct (MT-15), Workforce Shortage / Loss of Critical Skills / Labor Disruption (MT-25).", "compensating_control_1": { "control_id": "CFG-08.2", "name": "Integrity Assurance & Enforcement (IAE)", "description": "Automated mechanisms exist to:\n(1) Identify unauthorized deviations from an approved secure baseline configuration; and\n(2) Implement automated resiliency actions to remediate the unauthorized change.", "justification": "Integrity Assurance & Enforcement (IAE) (CFG-08.2) provides configuration hardening that compensates for the absence of AI & Autonomous Technologies Separate Verification (AAT-35.3) by eliminating unnecessary services and enforcing secure settings to reduce inherent exposure. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "MON-02", "name": "Continuous Monitoring", "description": "Mechanisms exist to facilitate the implementation of enterprise-wide monitoring controls.", "justification": "Continuous Monitoring (MON-02) provides detective monitoring capability that compensates for the absence of AI & Autonomous Technologies Separate Verification (AAT-35.3) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "AAT-35.4", "risk_if_not_implemented": "Without AI & Autonomous Technologies Oversight Functions Competency, AI and autonomous systems may produce unreliable, biased or unsafe outputs, act outside authorized scope, or expose sensitive data. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unperformed / Unowned Control Responsibilities (R-GV-3), Lack of a security-minded workforce (R-SA-2), Loss of Critical Knowledge / Capability (R-PE-1), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Workforce Shortage / Loss of Critical Skills / Labor Disruption (MT-25).", "compensating_control_1": { "control_id": "CHG-03", "name": "Configuration Change Control", "description": "Mechanisms exist to govern the technical configuration change control processes.", "justification": "Configuration Change Control (CHG-03) provides configuration hardening that compensates for the absence of AI & Autonomous Technologies Oversight Functions Competency (AAT-35.4) by eliminating unnecessary services and enforcing secure settings to reduce inherent exposure. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CFG-04", "name": "Secure Baseline Configurations", "description": "Mechanisms exist to develop, document and maintain secure baseline configurations for Technology Assets, Applications and/or Services (TAAS) that are consistent with industry-accepted hardening standards.", "justification": "Secure Baseline Configurations (CFG-04) provides configuration hardening that compensates for the absence of AI & Autonomous Technologies Oversight Functions Competency (AAT-35.4) by eliminating unnecessary services and enforcing secure settings to reduce inherent exposure. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "AAT-35.5", "risk_if_not_implemented": "Without AI & Autonomous Technologies Data Relevance, AI and autonomous systems may produce unreliable, biased or unsafe outputs, act outside authorized scope, or expose sensitive data. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to AI Output / Decision Integrity Failure (R-AI-1), Privacy Harm / Unauthorized Processing (R-IP-6), and most likely increases susceptibility to Human Error (MT-9), Data Quality Degradation / Data Poisoning (MT-12).", "compensating_control_1": { "control_id": "MON-02", "name": "Continuous Monitoring", "description": "Mechanisms exist to facilitate the implementation of enterprise-wide monitoring controls.", "justification": "Continuous Monitoring (MON-02) provides detective monitoring capability that compensates for the absence of AI & Autonomous Technologies Data Relevance (AAT-35.5) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CFG-08.2", "name": "Integrity Assurance & Enforcement (IAE)", "description": "Automated mechanisms exist to:\n(1) Identify unauthorized deviations from an approved secure baseline configuration; and\n(2) Implement automated resiliency actions to remediate the unauthorized change.", "justification": "Integrity Assurance & Enforcement (IAE) (CFG-08.2) provides configuration hardening that compensates for the absence of AI & Autonomous Technologies Data Relevance (AAT-35.5) by eliminating unnecessary services and enforcing secure settings to reduce inherent exposure. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "AAT-35.6", "risk_if_not_implemented": "Without AI & Autonomous Technologies Irregularity Reporting, AI and autonomous systems may produce unreliable, biased or unsafe outputs, act outside authorized scope, or expose sensitive data. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Regulatory / Legal / Contractual Financial Liability (R-EX-5), Delayed Containment / Increased Incident Impact (R-IR-2), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11), Conflict of Interest (COI) / Undue Influence / Insider Misconduct (MT-15).", "compensating_control_1": { "control_id": "CFG-02", "name": "Configuration Management Program", "description": "Mechanisms exist to facilitate the implementation of configuration management controls.", "justification": "Configuration Management Program (CFG-02) provides policy-level governance that compensates for the absence of AI & Autonomous Technologies Irregularity Reporting (AAT-35.6) by establishing documented expectations, accountability structures, and organizational guardrails. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CHG-03", "name": "Configuration Change Control", "description": "Mechanisms exist to govern the technical configuration change control processes.", "justification": "Configuration Change Control (CHG-03) provides configuration hardening that compensates for the absence of AI & Autonomous Technologies Irregularity Reporting (AAT-35.6) by eliminating unnecessary services and enforcing secure settings to reduce inherent exposure. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "AAT-35.7", "risk_if_not_implemented": "Without AI & Autonomous Technologies Use Notification To Employees, AI and autonomous systems may produce unreliable, biased or unsafe outputs, act outside authorized scope, or expose sensitive data. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Regulatory / Legal / Contractual Financial Liability (R-EX-5), Privacy Harm / Unauthorized Processing (R-IP-6), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11).", "compensating_control_1": { "control_id": "CHG-06", "name": "Security Impact Analysis for Changes", "description": "Mechanisms exist to analyze proposed changes for potential security impacts, prior to the implementation of the change.", "justification": "Security Impact Analysis for Changes (CHG-06) provides risk identification and prioritization that compensates for the absence of AI & Autonomous Technologies Use Notification To Employees (AAT-35.7) by enabling informed decisions about where to focus resources to manage residual exposure. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CFG-08.2", "name": "Integrity Assurance & Enforcement (IAE)", "description": "Automated mechanisms exist to:\n(1) Identify unauthorized deviations from an approved secure baseline configuration; and\n(2) Implement automated resiliency actions to remediate the unauthorized change.", "justification": "Integrity Assurance & Enforcement (IAE) (CFG-08.2) provides configuration hardening that compensates for the absence of AI & Autonomous Technologies Use Notification To Employees (AAT-35.7) by eliminating unnecessary services and enforcing secure settings to reduce inherent exposure. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "AAT-35.8", "risk_if_not_implemented": "Without AI & Autonomous Technologies Use Notification To Users, AI and autonomous systems may produce unreliable, biased or unsafe outputs, act outside authorized scope, or expose sensitive data. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to AI Output / Decision Integrity Failure (R-AI-1), and most likely increases susceptibility to Technical / Mechanical Failure (MT-10), Artificial Intelligence & Autonomous Technologies (AAT) System Failure or Unintended Behavior (MT-13).", "compensating_control_1": { "control_id": "CFG-04", "name": "Secure Baseline Configurations", "description": "Mechanisms exist to develop, document and maintain secure baseline configurations for Technology Assets, Applications and/or Services (TAAS) that are consistent with industry-accepted hardening standards.", "justification": "Secure Baseline Configurations (CFG-04) provides configuration hardening that compensates for the absence of AI & Autonomous Technologies Use Notification To Users (AAT-35.8) by eliminating unnecessary services and enforcing secure settings to reduce inherent exposure. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "MON-02", "name": "Continuous Monitoring", "description": "Mechanisms exist to facilitate the implementation of enterprise-wide monitoring controls.", "justification": "Continuous Monitoring (MON-02) provides detective monitoring capability that compensates for the absence of AI & Autonomous Technologies Use Notification To Users (AAT-35.8) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "AAT-36", "risk_if_not_implemented": "Without AI & Autonomous Technologies Production Monitoring, AI and autonomous systems may produce unreliable, biased or unsafe outputs, act outside authorized scope, or expose sensitive data. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Delayed Containment / Increased Incident Impact (R-IR-2), Undetected / Delayed Detection of Adverse Activity (R-SA-1), AI Output / Decision Integrity Failure (R-AI-1), Unintended or Unsafe Technology Behavior (R-AI-5), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Technical / Mechanical Failure (MT-10), Adversarial Artificial Intelligence (AI) Attack (MT-29).", "compensating_control_1": { "control_id": "MON-02", "name": "Continuous Monitoring", "description": "Mechanisms exist to facilitate the implementation of enterprise-wide monitoring controls.", "justification": "Continuous Monitoring (MON-02) provides detective monitoring capability that compensates for the absence of AI & Autonomous Technologies Production Monitoring (AAT-36) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CPL-05", "name": "Conformity Monitoring", "description": "Mechanisms exist to validate that Technology Assets, Applications, Services and/or Data (TAASD) conform to the organization's security, compliance and/or resilience policies, standards and other applicable requirements.", "justification": "Conformity Monitoring (CPL-05) provides periodic assessment and assurance that compensates for the absence of AI & Autonomous Technologies Production Monitoring (AAT-36) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "AAT-36.1", "risk_if_not_implemented": "Without AI & Autonomous Technologies Measurement Approaches, AI and autonomous systems may produce unreliable, biased or unsafe outputs, act outside authorized scope, or expose sensitive data. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unaddressed Security / Compliance Exposure (R-GV-2), Inability to Demonstrate Due Diligence / Due Care (R-GV-9), Unreliable Assurance / Decision Information (R-GV-10), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Workforce Shortage / Loss of Critical Skills / Labor Disruption (MT-25).", "compensating_control_1": { "control_id": "MON-02", "name": "Continuous Monitoring", "description": "Mechanisms exist to facilitate the implementation of enterprise-wide monitoring controls.", "justification": "Continuous Monitoring (MON-02) provides detective monitoring capability that compensates for the absence of AI & Autonomous Technologies Measurement Approaches (AAT-36.1) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "AAT-28", "name": "Artificial Intelligence Test, Evaluation, Validation & Verification (AI TEVV)", "description": "Mechanisms exist to implement Artificial Intelligence Test, Evaluation, Validation & Verification (AI TEVV) practices to enable Artificial Intelligence (AI) and Autonomous Technologies (AAT)-related security, resilience and compliance-related conformity testing throughout the lifecycle of the AAT.", "justification": "Artificial Intelligence Test, Evaluation, Validation & Verification (AI TEVV) (AAT-28) provides periodic assessment and assurance that compensates for the absence of AI & Autonomous Technologies Measurement Approaches (AAT-36.1) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "AAT-36.2", "risk_if_not_implemented": "Without Measuring AI & Autonomous Technologies Effectiveness, AI and autonomous systems may produce unreliable, biased or unsafe outputs, act outside authorized scope, or expose sensitive data. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Lack of oversight of internal controls (R-GV-6), Inability to Demonstrate Due Diligence / Due Care (R-GV-9), Unreliable Assurance / Decision Information (R-GV-10), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Conflict of Interest (COI) / Undue Influence / Insider Misconduct (MT-15).", "compensating_control_1": { "control_id": "MON-16", "name": "Anomalous Behavior", "description": "Mechanisms exist to utilize User & Entity Behavior Analytics (UEBA) and/or User Activity Monitoring (UAM) solutions to detect and respond to anomalous behavior that could indicate account compromise or other malicious activities.", "justification": "Anomalous Behavior (MON-16) provides detective monitoring capability that compensates for the absence of Measuring AI & Autonomous Technologies Effectiveness (AAT-36.2) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "MON-02", "name": "Continuous Monitoring", "description": "Mechanisms exist to facilitate the implementation of enterprise-wide monitoring controls.", "justification": "Continuous Monitoring (MON-02) provides detective monitoring capability that compensates for the absence of Measuring AI & Autonomous Technologies Effectiveness (AAT-36.2) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "AAT-36.3", "risk_if_not_implemented": "Without Unmeasurable AI & Autonomous Technologies Risks, AI and autonomous systems may produce unreliable, biased or unsafe outputs, act outside authorized scope, or expose sensitive data. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unaddressed Security / Compliance Exposure (R-GV-2), Inability to Demonstrate Due Diligence / Due Care (R-GV-9), Unreliable Assurance / Decision Information (R-GV-10), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9).", "compensating_control_1": { "control_id": "MON-02", "name": "Continuous Monitoring", "description": "Mechanisms exist to facilitate the implementation of enterprise-wide monitoring controls.", "justification": "Continuous Monitoring (MON-02) provides detective monitoring capability that compensates for the absence of Unmeasurable AI & Autonomous Technologies Risks (AAT-36.3) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "IRO-08", "name": "Incident Response Plan (IRP)", "description": "Mechanisms exist to maintain and make available a current and viable Incident Response Plan (IRP) to all stakeholders.", "justification": "Incident Response Plan (IRP) (IRO-08) provides incident response capability that compensates for the absence of Unmeasurable AI & Autonomous Technologies Risks (AAT-36.3) by enabling timely detection, containment, and recovery from security events in the absence of the primary control. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "AAT-36.4", "risk_if_not_implemented": "Without Efficacy of AI & Autonomous Technologies Measurement, AI and autonomous systems may produce unreliable, biased or unsafe outputs, act outside authorized scope, or expose sensitive data. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unreliable Assurance / Decision Information (R-GV-10), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9).", "compensating_control_1": { "control_id": "IRO-02", "name": "Incident Response Operations", "description": "Mechanisms exist to implement and govern processes and documentation to facilitate an organization-wide response capability for cybersecurity and data protection-related incidents.", "justification": "Incident Response Operations (IRO-02) provides incident response capability that compensates for the absence of Efficacy of AI & Autonomous Technologies Measurement (AAT-36.4) by enabling timely detection, containment, and recovery from security events in the absence of the primary control. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "MON-02", "name": "Continuous Monitoring", "description": "Mechanisms exist to facilitate the implementation of enterprise-wide monitoring controls.", "justification": "Continuous Monitoring (MON-02) provides detective monitoring capability that compensates for the absence of Efficacy of AI & Autonomous Technologies Measurement (AAT-36.4) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "AAT-36.5", "risk_if_not_implemented": "Without AI & Autonomous Technologies Domain Expert Reviews, AI and autonomous systems may produce unreliable, biased or unsafe outputs, act outside authorized scope, or expose sensitive data. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to AI Output / Decision Integrity Failure (R-AI-1), Unintended or Unsafe Technology Behavior (R-AI-5), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Conflict of Interest (COI) / Undue Influence / Insider Misconduct (MT-15), Workforce Shortage / Loss of Critical Skills / Labor Disruption (MT-25).", "compensating_control_1": { "control_id": "MON-06", "name": "Monitoring Reporting", "description": "Mechanisms exist to provide an event log report generation capability to aid in detecting and assessing anomalous activities.", "justification": "Monitoring Reporting (MON-06) provides detective monitoring capability that compensates for the absence of AI & Autonomous Technologies Domain Expert Reviews (AAT-36.5) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the people-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CPL-07", "name": "Executive Leadership Oversight of Security, Compliance & Resilience Controls", "description": "Mechanisms exist to provide a security, compliance and resilience controls oversight function that reports to the organization's executive leadership.", "justification": "Executive Leadership Oversight of Security, Compliance & Resilience Controls (CPL-07) provides resilience and recovery capability that compensates for the absence of AI & Autonomous Technologies Domain Expert Reviews (AAT-36.5) by ensuring the organization can restore operations and data when the primary control is absent. Given the people-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "AAT-36.7", "risk_if_not_implemented": "Without Pre-Trained AI & Autonomous Technologies Models, AI and autonomous systems may produce unreliable, biased or unsafe outputs, act outside authorized scope, or expose sensitive data. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Third-Party Cybersecurity Compromise / Exposure (R-SC-1), Counterfeit / Non-Conforming Component Impact (R-SC-7), AI Output / Decision Integrity Failure (R-AI-1), AI Data Confidentiality / Integrity / Provenance Loss (R-AI-2), Loss of Authenticity / Provenance (R-IP-5), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Data Quality Degradation / Data Poisoning (MT-12), Counterfeit / Non-Conforming Products (MT-20), Adversarial Artificial Intelligence (AI) Attack (MT-29).", "compensating_control_1": { "control_id": "MON-16", "name": "Anomalous Behavior", "description": "Mechanisms exist to utilize User & Entity Behavior Analytics (UEBA) and/or User Activity Monitoring (UAM) solutions to detect and respond to anomalous behavior that could indicate account compromise or other malicious activities.", "justification": "Anomalous Behavior (MON-16) provides detective monitoring capability that compensates for the absence of Pre-Trained AI & Autonomous Technologies Models (AAT-36.7) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CPL-05", "name": "Conformity Monitoring", "description": "Mechanisms exist to validate that Technology Assets, Applications, Services and/or Data (TAASD) conform to the organization's security, compliance and/or resilience policies, standards and other applicable requirements.", "justification": "Conformity Monitoring (CPL-05) provides periodic assessment and assurance that compensates for the absence of Pre-Trained AI & Autonomous Technologies Models (AAT-36.7) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "AAT-36.8", "risk_if_not_implemented": "Without AI & Autonomous Technologies Event Logging, AI and autonomous systems may produce unreliable, biased or unsafe outputs, act outside authorized scope, or expose sensitive data. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss of Accountability / Attribution (R-AC-1), Loss of Investigative / Evidentiary Capability (R-IR-1), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Technical / Mechanical Failure (MT-10), Artificial Intelligence & Autonomous Technologies (AAT) System Failure or Unintended Behavior (MT-13).", "compensating_control_1": { "control_id": "MON-02", "name": "Continuous Monitoring", "description": "Mechanisms exist to facilitate the implementation of enterprise-wide monitoring controls.", "justification": "Continuous Monitoring (MON-02) provides detective monitoring capability that compensates for the absence of AI & Autonomous Technologies Event Logging (AAT-36.8) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "IRO-02", "name": "Incident Response Operations", "description": "Mechanisms exist to implement and govern processes and documentation to facilitate an organization-wide response capability for cybersecurity and data protection-related incidents.", "justification": "Incident Response Operations (IRO-02) provides incident response capability that compensates for the absence of AI & Autonomous Technologies Event Logging (AAT-36.8) by enabling timely detection, containment, and recovery from security events in the absence of the primary control. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "AAT-36.9", "risk_if_not_implemented": "Without Serious Incident Reporting For AI & Autonomous Technologies, security incidents may not be detected, contained, investigated or communicated in a timely manner, increasing their scope, duration and cost. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Regulatory / Legal / Contractual Financial Liability (R-EX-5), Inability to Demonstrate Due Diligence / Due Care (R-GV-9), Delayed Containment / Increased Incident Impact (R-IR-2), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11), Conflict of Interest (COI) / Undue Influence / Insider Misconduct (MT-15).", "compensating_control_1": { "control_id": "CPL-05", "name": "Conformity Monitoring", "description": "Mechanisms exist to validate that Technology Assets, Applications, Services and/or Data (TAASD) conform to the organization's security, compliance and/or resilience policies, standards and other applicable requirements.", "justification": "Conformity Monitoring (CPL-05) provides periodic assessment and assurance that compensates for the absence of Serious Incident Reporting For AI & Autonomous Technologies (AAT-36.9) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "MON-16", "name": "Anomalous Behavior", "description": "Mechanisms exist to utilize User & Entity Behavior Analytics (UEBA) and/or User Activity Monitoring (UAM) solutions to detect and respond to anomalous behavior that could indicate account compromise or other malicious activities.", "justification": "Anomalous Behavior (MON-16) provides detective monitoring capability that compensates for the absence of Serious Incident Reporting For AI & Autonomous Technologies (AAT-36.9) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "AAT-36.10", "risk_if_not_implemented": "Without Serious Incident Root Cause Analysis (RCA) For AI & Autonomous Technologies, security incidents may not be detected, contained, investigated or communicated in a timely manner, increasing their scope, duration and cost. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Inability to Demonstrate Due Diligence / Due Care (R-GV-9), Loss of Investigative / Evidentiary Capability (R-IR-1), Incident Persistence / Recurrence (R-IR-3), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Conflict of Interest (COI) / Undue Influence / Insider Misconduct (MT-15).", "compensating_control_1": { "control_id": "MON-05", "name": "Centralized Collection of Event Logs & Security-Relevant Telemetry", "description": "Mechanisms exist to utilize a Security Incident Event Manager (SIEM), or similar automated tool, to support the centralized collection of event logs and security-relevant telemetry.", "justification": "Centralized Collection of Event Logs & Security-Relevant Telemetry (MON-05) provides detective monitoring capability that compensates for the absence of Serious Incident Root Cause Analysis (RCA) For AI & Autonomous Technologies (AAT-36.10) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "MON-05.2", "name": "Event Log & Security-Relevant Telemetry Analysis & Triage", "description": "Mechanisms exist to ensure event log and security-relevant telemetry reviews include analysis and triage practices that integrate with the organization's established incident response processes.", "justification": "Event Log & Security-Relevant Telemetry Analysis & Triage (MON-05.2) provides detective monitoring capability that compensates for the absence of Serious Incident Root Cause Analysis (RCA) For AI & Autonomous Technologies (AAT-36.10) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "AAT-36.11", "risk_if_not_implemented": "Without Anomaly Detection & Human Oversight, malicious, anomalous or unauthorized activity may go undetected or be detected too late to prevent or limit harm. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Undetected / Delayed Detection of Adverse Activity (R-SA-1), Unauthorized / Harmful Autonomous Action (R-AI-3), Unintended or Unsafe Technology Behavior (R-AI-5), and most likely increases susceptibility to Human Error (MT-9), Artificial Intelligence & Autonomous Technologies (AAT) System Failure or Unintended Behavior (MT-13), Adversarial Artificial Intelligence (AI) Attack (MT-29).", "compensating_control_1": { "control_id": "IRO-08", "name": "Incident Response Plan (IRP)", "description": "Mechanisms exist to maintain and make available a current and viable Incident Response Plan (IRP) to all stakeholders.", "justification": "Incident Response Plan (IRP) (IRO-08) provides incident response capability that compensates for the absence of Anomaly Detection & Human Oversight (AAT-36.11) by enabling timely detection, containment, and recovery from security events in the absence of the primary control. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "MON-02", "name": "Continuous Monitoring", "description": "Mechanisms exist to facilitate the implementation of enterprise-wide monitoring controls.", "justification": "Continuous Monitoring (MON-02) provides detective monitoring capability that compensates for the absence of Anomaly Detection & Human Oversight (AAT-36.11) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "AAT-36.12", "risk_if_not_implemented": "Without Human-in-the-Loop & Escalation, AI and autonomous systems may produce unreliable, biased or unsafe outputs, act outside authorized scope, or expose sensitive data. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized / Harmful Autonomous Action (R-AI-3), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Artificial Intelligence & Autonomous Technologies (AAT) System Failure or Unintended Behavior (MT-13), Adversarial Artificial Intelligence (AI) Attack (MT-29).", "compensating_control_1": { "control_id": "MON-05.2", "name": "Event Log & Security-Relevant Telemetry Analysis & Triage", "description": "Mechanisms exist to ensure event log and security-relevant telemetry reviews include analysis and triage practices that integrate with the organization's established incident response processes.", "justification": "Event Log & Security-Relevant Telemetry Analysis & Triage (MON-05.2) provides detective monitoring capability that compensates for the absence of Human-in-the-Loop & Escalation (AAT-36.12) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CPL-05", "name": "Conformity Monitoring", "description": "Mechanisms exist to validate that Technology Assets, Applications, Services and/or Data (TAASD) conform to the organization's security, compliance and/or resilience policies, standards and other applicable requirements.", "justification": "Conformity Monitoring (CPL-05) provides periodic assessment and assurance that compensates for the absence of Human-in-the-Loop & Escalation (AAT-36.12) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "AAT-36.13", "risk_if_not_implemented": "Without Emergent Behavior & Collusion Protections, AI and autonomous systems may produce unreliable, biased or unsafe outputs, act outside authorized scope, or expose sensitive data. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Delayed Containment / Increased Incident Impact (R-IR-2), Incident Persistence / Recurrence (R-IR-3), Undetected / Delayed Detection of Adverse Activity (R-SA-1), Unauthorized / Harmful Autonomous Action (R-AI-3), Unintended or Unsafe Technology Behavior (R-AI-5), and most likely increases susceptibility to Artificial Intelligence & Autonomous Technologies (AAT) System Failure or Unintended Behavior (MT-13), Adversarial Artificial Intelligence (AI) Attack (MT-29).", "compensating_control_1": { "control_id": "CPL-05", "name": "Conformity Monitoring", "description": "Mechanisms exist to validate that Technology Assets, Applications, Services and/or Data (TAASD) conform to the organization's security, compliance and/or resilience policies, standards and other applicable requirements.", "justification": "Conformity Monitoring (CPL-05) provides periodic assessment and assurance that compensates for the absence of Emergent Behavior & Collusion Protections (AAT-36.13) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "IRO-02", "name": "Incident Response Operations", "description": "Mechanisms exist to implement and govern processes and documentation to facilitate an organization-wide response capability for cybersecurity and data protection-related incidents.", "justification": "Incident Response Operations (IRO-02) provides incident response capability that compensates for the absence of Emergent Behavior & Collusion Protections (AAT-36.13) by enabling timely detection, containment, and recovery from security events in the absence of the primary control. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "AAT-36.14", "risk_if_not_implemented": "Without Multi-Agent Trust & Communication Validation, AI and autonomous systems may produce unreliable, biased or unsafe outputs, act outside authorized scope, or expose sensitive data. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Identity Compromise / Impersonation (R-AC-5), Undetected / Delayed Detection of Adverse Activity (R-SA-1), AI Data Confidentiality / Integrity / Provenance Loss (R-AI-2), Loss of Authenticity / Provenance (R-IP-5), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Data Quality Degradation / Data Poisoning (MT-12), Artificial Intelligence & Autonomous Technologies (AAT) System Failure or Unintended Behavior (MT-13), Adversarial Artificial Intelligence (AI) Attack (MT-29).", "compensating_control_1": { "control_id": "MON-06", "name": "Monitoring Reporting", "description": "Mechanisms exist to provide an event log report generation capability to aid in detecting and assessing anomalous activities.", "justification": "Monitoring Reporting (MON-06) provides detective monitoring capability that compensates for the absence of Multi-Agent Trust & Communication Validation (AAT-36.14) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "MON-02", "name": "Continuous Monitoring", "description": "Mechanisms exist to facilitate the implementation of enterprise-wide monitoring controls.", "justification": "Continuous Monitoring (MON-02) provides detective monitoring capability that compensates for the absence of Multi-Agent Trust & Communication Validation (AAT-36.14) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "AAT-37", "risk_if_not_implemented": "Without AI & Autonomous Technologies System Value Chain, AI and autonomous systems may produce unreliable, biased or unsafe outputs, act outside authorized scope, or expose sensitive data. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unperformed / Unowned Control Responsibilities (R-GV-3), Inability to Demonstrate Due Diligence / Due Care (R-GV-9), and most likely increases susceptibility to Human Error (MT-9).", "compensating_control_1": { "control_id": "TPM-02", "name": "Third-Party Management", "description": "Mechanisms exist to facilitate the implementation of third-party management controls.", "justification": "Third-Party Management (TPM-02) provides third-party oversight that compensates for the absence of AI & Autonomous Technologies System Value Chain (AAT-37) by extending security obligations contractually and monitoring third-party risk in lieu of direct control. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "RSK-20", "name": "Supply Chain Risk Management (SCRM) Plan", "description": "Mechanisms exist to develop a plan for Supply Chain Risk Management (SCRM) associated with the development, acquisition, maintenance and disposal of Technology Assets, Applications and/or Services (TAAS), including documenting selected mitigating actions and monitoring performance against those plans.", "justification": "Supply Chain Risk Management (SCRM) Plan (RSK-20) provides risk identification and prioritization that compensates for the absence of AI & Autonomous Technologies System Value Chain (AAT-37) by enabling informed decisions about where to focus resources to manage residual exposure. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "AAT-37.1", "risk_if_not_implemented": "Without AI & Autonomous Technologies System Value Chain Fallbacks, AI and autonomous systems may produce unreliable, biased or unsafe outputs, act outside authorized scope, or expose sensitive data. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Concentration / Single-Point Dependency Failure (R-OR-2), Third-Party Dependency Failure (R-SC-6), and most likely increases susceptibility to Human Error (MT-9), Supplier Financial Distress / Insolvency (MT-24).", "compensating_control_1": { "control_id": "TPM-04", "name": "Supply Chain Risk Management (SCRM)", "description": "Mechanisms exist to:\n(1) Evaluate security risks and threats associated with Technology Assets, Applications and/or Services (TAAS) supply chains; and\n(2) Take appropriate remediation actions to minimize the organization's exposure to those risks and threats, as necessary.", "justification": "Supply Chain Risk Management (SCRM) (TPM-04) provides risk identification and prioritization that compensates for the absence of AI & Autonomous Technologies System Value Chain Fallbacks (AAT-37.1) by enabling informed decisions about where to focus resources to manage residual exposure. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "RSK-20", "name": "Supply Chain Risk Management (SCRM) Plan", "description": "Mechanisms exist to develop a plan for Supply Chain Risk Management (SCRM) associated with the development, acquisition, maintenance and disposal of Technology Assets, Applications and/or Services (TAAS), including documenting selected mitigating actions and monitoring performance against those plans.", "justification": "Supply Chain Risk Management (SCRM) Plan (RSK-20) provides risk identification and prioritization that compensates for the absence of AI & Autonomous Technologies System Value Chain Fallbacks (AAT-37.1) by enabling informed decisions about where to focus resources to manage residual exposure. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "AAT-38", "risk_if_not_implemented": "Without AI Model Resilience, critical business processes and services may not withstand or recover from disruption, causing extended outages and data loss. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to AI Output / Decision Integrity Failure (R-AI-1), Unintended or Unsafe Technology Behavior (R-AI-5), and most likely increases susceptibility to Human Error (MT-9), Artificial Intelligence & Autonomous Technologies (AAT) System Failure or Unintended Behavior (MT-13), Adversarial Artificial Intelligence (AI) Attack (MT-29).", "compensating_control_1": { "control_id": "BCD-02", "name": "Business Continuity Management System (BCMS)", "description": "Mechanisms exist to operate a Business Continuity Management System (BCMS) to achieve resilient Technology Assets, Applications, Services and/or Data (TAASD) during:\n(1) Routine operations; and\n(2) Adverse conditions.", "justification": "Business Continuity Management System (BCMS) (BCD-02) provides resilience and recovery capability that compensates for the absence of AI Model Resilience (AAT-38) by ensuring the organization can restore operations and data when the primary control is absent. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "RSK-02", "name": "Risk Management Program", "description": "Mechanisms exist to facilitate the implementation of strategic, operational and tactical risk management controls that are aligned with:\n(1) The organization's Enterprise Risk Management (ERM); and\n(2) Industry-recognized cybersecurity risk management practices.", "justification": "Risk Management Program (RSK-02) provides policy-level governance that compensates for the absence of AI Model Resilience (AAT-38) by establishing documented expectations, accountability structures, and organizational guardrails. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "AAT-38.1", "risk_if_not_implemented": "Without AI Model Pollution, AI and autonomous systems may produce unreliable, biased or unsafe outputs, act outside authorized scope, or expose sensitive data. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Modification / Loss of System Integrity (R-AM-2), AI Output / Decision Integrity Failure (R-AI-1), AI Data Confidentiality / Integrity / Provenance Loss (R-AI-2), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Data Quality Degradation / Data Poisoning (MT-12), Artificial Intelligence & Autonomous Technologies (AAT) System Failure or Unintended Behavior (MT-13), Adversarial Artificial Intelligence (AI) Attack (MT-29).", "compensating_control_1": { "control_id": "BCD-24", "name": "Data Backups", "description": "Mechanisms exist to create recurring backups of data, software and/or system images, as well as verify the integrity of these backups, to ensure the availability of the data to satisfy Recovery Time Objectives (RTOs) and Recovery Point Objectives (RPOs).", "justification": "Data Backups (BCD-24) provides resilience and recovery capability that compensates for the absence of Model Pollution (AAT-38.1) by ensuring the organization can restore operations and data when the primary control is absent. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "BCD-13", "name": "Alternate Processing Site", "description": "Mechanisms exist to establish an alternate processing site that provides processing capability and security measures equivalent to that of the primary site.", "justification": "Alternate Processing Site (BCD-13) provides resilience and recovery capability that compensates for the absence of Model Pollution (AAT-38.1) by ensuring the organization can restore operations and data when the primary control is absent. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "AAT-38.2", "risk_if_not_implemented": "Without Cascading Hallucination Defense, AI and autonomous systems may produce unreliable, biased or unsafe outputs, act outside authorized scope, or expose sensitive data. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Undetected / Delayed Detection of Adverse Activity (R-SA-1), AI Output / Decision Integrity Failure (R-AI-1), Unintended or Unsafe Technology Behavior (R-AI-5), Loss of Data Integrity (R-IP-3), and most likely increases susceptibility to Data Quality Degradation / Data Poisoning (MT-12), Artificial Intelligence & Autonomous Technologies (AAT) System Failure or Unintended Behavior (MT-13), Adversarial Artificial Intelligence (AI) Attack (MT-29).", "compensating_control_1": { "control_id": "BCD-13", "name": "Alternate Processing Site", "description": "Mechanisms exist to establish an alternate processing site that provides processing capability and security measures equivalent to that of the primary site.", "justification": "Alternate Processing Site (BCD-13) provides resilience and recovery capability that compensates for the absence of Cascading Hallucination Defense (AAT-38.2) by ensuring the organization can restore operations and data when the primary control is absent. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "BCD-24", "name": "Data Backups", "description": "Mechanisms exist to create recurring backups of data, software and/or system images, as well as verify the integrity of these backups, to ensure the availability of the data to satisfy Recovery Time Objectives (RTOs) and Recovery Point Objectives (RPOs).", "justification": "Data Backups (BCD-24) provides resilience and recovery capability that compensates for the absence of Cascading Hallucination Defense (AAT-38.2) by ensuring the organization can restore operations and data when the primary control is absent. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "AAT-38.3", "risk_if_not_implemented": "Without Resource Exhaustion & Denial of Service (DoS) Resilience, critical business processes and services may not withstand or recover from disruption, causing extended outages and data loss. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Business / Service Interruption (R-BC-1), Undetected / Delayed Detection of Adverse Activity (R-SA-1), Loss of Data / Service Availability (R-IP-4), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Artificial Intelligence & Autonomous Technologies (AAT) System Failure or Unintended Behavior (MT-13), Adversarial Artificial Intelligence (AI) Attack (MT-29).", "compensating_control_1": { "control_id": "BCD-02", "name": "Business Continuity Management System (BCMS)", "description": "Mechanisms exist to operate a Business Continuity Management System (BCMS) to achieve resilient Technology Assets, Applications, Services and/or Data (TAASD) during:\n(1) Routine operations; and\n(2) Adverse conditions.", "justification": "Business Continuity Management System (BCMS) (BCD-02) provides resilience and recovery capability that compensates for the absence of Resource Exhaustion & DoS Resilience (AAT-38.3) by ensuring the organization can restore operations and data when the primary control is absent. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "BCD-24", "name": "Data Backups", "description": "Mechanisms exist to create recurring backups of data, software and/or system images, as well as verify the integrity of these backups, to ensure the availability of the data to satisfy Recovery Time Objectives (RTOs) and Recovery Point Objectives (RPOs).", "justification": "Data Backups (BCD-24) provides resilience and recovery capability that compensates for the absence of Resource Exhaustion & DoS Resilience (AAT-38.3) by ensuring the organization can restore operations and data when the primary control is absent. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "AAT-39", "risk_if_not_implemented": "Without AI Agent Governance, AI and autonomous systems may produce unreliable, biased or unsafe outputs, act outside authorized scope, or expose sensitive data. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized / Harmful Autonomous Action (R-AI-3), and most likely increases susceptibility to Human Error (MT-9), Artificial Intelligence & Autonomous Technologies (AAT) System Failure or Unintended Behavior (MT-13).", "compensating_control_1": { "control_id": "AAT-02", "name": "Artificial Intelligence (AI) & Autonomous Technologies Governance", "description": "Mechanisms exist to ensure policies, processes, procedures and practices related to the mapping, measuring and managing of Artificial Intelligence (AI) and Autonomous Technologies (AAT)-related risks are in place, transparent and implemented effectively.", "justification": "Artificial Intelligence (AI) & Autonomous Technologies Governance (AAT-02) provides detective monitoring capability that compensates for the absence of AI Agent Governance (AAT-39) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "MON-02", "name": "Continuous Monitoring", "description": "Mechanisms exist to facilitate the implementation of enterprise-wide monitoring controls.", "justification": "Continuous Monitoring (MON-02) provides detective monitoring capability that compensates for the absence of AI Agent Governance (AAT-39) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "AAT-39.1", "risk_if_not_implemented": "Without Infrastructure Hardening & Isolation, Technology Assets, Applications and/or Services (TAAS) may operate with insecure, unauthorized or drifted configurations that expand the attack surface. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Excessive or Unauthorized Privilege (R-AC-2), Unauthorized Privilege Elevation (R-AC-3), Unauthorized Access (R-AC-4), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9), Artificial Intelligence & Autonomous Technologies (AAT) System Failure or Unintended Behavior (MT-13), Infrastructure Failure / Degradation (MT-27), Adversarial Artificial Intelligence (AI) Attack (MT-29).", "compensating_control_1": { "control_id": "IAC-25", "name": "Access Enforcement", "description": "Mechanisms exist to enforce Logical Access Control (LAC) permissions that conform to the principle of \"least privilege.\"", "justification": "Access Enforcement (IAC-25) provides access control enforcement that compensates for the absence of Infrastructure Hardening & Isolation (AAT-39.1) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "MON-18.1", "name": "Session Audit", "description": "Mechanisms exist to provide session audit capabilities that can: \n(1) Capture and log all content related to a user session; and\n(2) Remotely view all content related to an established user session in real time.", "justification": "Session Audit (MON-18.1) provides detective monitoring capability that compensates for the absence of Infrastructure Hardening & Isolation (AAT-39.1) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "AAT-39.2", "risk_if_not_implemented": "Without AI Agent Limitations, AI and autonomous systems may produce unreliable, biased or unsafe outputs, act outside authorized scope, or expose sensitive data. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Excessive or Unauthorized Privilege (R-AC-2), Unauthorized Access (R-AC-4), Unauthorized / Harmful Autonomous Action (R-AI-3), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9).", "compensating_control_1": { "control_id": "MON-02", "name": "Continuous Monitoring", "description": "Mechanisms exist to facilitate the implementation of enterprise-wide monitoring controls.", "justification": "Continuous Monitoring (MON-02) provides detective monitoring capability that compensates for the absence of AI Agent Limitations (AAT-39.2) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "IAC-25", "name": "Access Enforcement", "description": "Mechanisms exist to enforce Logical Access Control (LAC) permissions that conform to the principle of \"least privilege.\"", "justification": "Access Enforcement (IAC-25) provides access control enforcement that compensates for the absence of AI Agent Limitations (AAT-39.2) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "AAT-39.3", "risk_if_not_implemented": "Without Tool & Application Programming Interface (API) Invocation Controls, security, compliance and resilience activities may lack direction, ownership and executive support, leaving required controls unperformed. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss of Accountability / Attribution (R-AC-1), Unauthorized Access (R-AC-4), Loss of Investigative / Evidentiary Capability (R-IR-1), Undetected / Delayed Detection of Adverse Activity (R-SA-1), Unauthorized / Harmful Autonomous Action (R-AI-3), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Adversarial Artificial Intelligence (AI) Attack (MT-29).", "compensating_control_1": { "control_id": "IAC-30", "name": "Least Privilege", "description": "Mechanisms exist to utilize the concept of least privilege, allowing only authorized access to processes necessary to accomplish assigned tasks in accordance with organizational business functions.", "justification": "Least Privilege (IAC-30) provides access control enforcement that compensates for the absence of Tool & API Invocation Controls (AAT-39.3) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "MON-02", "name": "Continuous Monitoring", "description": "Mechanisms exist to facilitate the implementation of enterprise-wide monitoring controls.", "justification": "Continuous Monitoring (MON-02) provides detective monitoring capability that compensates for the absence of Tool & API Invocation Controls (AAT-39.3) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "AAT-39.4", "risk_if_not_implemented": "Without AI Agent Orchestration Protocol Safeguards, AI and autonomous systems may produce unreliable, biased or unsafe outputs, act outside authorized scope, or expose sensitive data. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Privilege Elevation (R-AC-3), AI Output / Decision Integrity Failure (R-AI-1), Unauthorized / Harmful Autonomous Action (R-AI-3), Unintended or Unsafe Technology Behavior (R-AI-5), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Artificial Intelligence & Autonomous Technologies (AAT) System Failure or Unintended Behavior (MT-13), Adversarial Artificial Intelligence (AI) Attack (MT-29).", "compensating_control_1": { "control_id": "MON-18.1", "name": "Session Audit", "description": "Mechanisms exist to provide session audit capabilities that can: \n(1) Capture and log all content related to a user session; and\n(2) Remotely view all content related to an established user session in real time.", "justification": "Session Audit (MON-18.1) provides detective monitoring capability that compensates for the absence of Orchestration Protocol Safeguards (AAT-39.4) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "IAC-25", "name": "Access Enforcement", "description": "Mechanisms exist to enforce Logical Access Control (LAC) permissions that conform to the principle of \"least privilege.\"", "justification": "Access Enforcement (IAC-25) provides access control enforcement that compensates for the absence of Orchestration Protocol Safeguards (AAT-39.4) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "AAT-39.5", "risk_if_not_implemented": "Without AI Agent Data Pipeline & Input Integrity, AI and autonomous systems may produce unreliable, biased or unsafe outputs, act outside authorized scope, or expose sensitive data. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to R-SA-1, R-AI-1, R-AI-2, R-IP-2, R-IP-3, R-IP-5, and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Data Quality Degradation / Data Poisoning (MT-12), Adversarial Artificial Intelligence (AI) Attack (MT-29).", "compensating_control_1": { "control_id": "AAT-02", "name": "Artificial Intelligence (AI) & Autonomous Technologies Governance", "description": "Mechanisms exist to ensure policies, processes, procedures and practices related to the mapping, measuring and managing of Artificial Intelligence (AI) and Autonomous Technologies (AAT)-related risks are in place, transparent and implemented effectively.", "justification": "Artificial Intelligence (AI) & Autonomous Technologies Governance (AAT-02) provides detective monitoring capability that compensates for the absence of Data Pipeline & Input Integrity (AAT-39.5) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "IAC-25", "name": "Access Enforcement", "description": "Mechanisms exist to enforce Logical Access Control (LAC) permissions that conform to the principle of \"least privilege.\"", "justification": "Access Enforcement (IAC-25) provides access control enforcement that compensates for the absence of Data Pipeline & Input Integrity (AAT-39.5) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "AAT-39.6", "risk_if_not_implemented": "Without AI Agent Privileged Role & Delegation Boundaries, users, services and processes may obtain or retain access beyond authorized need, enabling misuse or escalation. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Excessive or Unauthorized Privilege (R-AC-2), Unauthorized Privilege Elevation (R-AC-3), Unauthorized / Harmful Autonomous Action (R-AI-3), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9), Adversarial Artificial Intelligence (AI) Attack (MT-29).", "compensating_control_1": { "control_id": "IAC-25", "name": "Access Enforcement", "description": "Mechanisms exist to enforce Logical Access Control (LAC) permissions that conform to the principle of \"least privilege.\"", "justification": "Access Enforcement (IAC-25) provides access control enforcement that compensates for the absence of Privileged Role & Delegation Boundaries (AAT-39.6) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "AAT-02", "name": "Artificial Intelligence (AI) & Autonomous Technologies Governance", "description": "Mechanisms exist to ensure policies, processes, procedures and practices related to the mapping, measuring and managing of Artificial Intelligence (AI) and Autonomous Technologies (AAT)-related risks are in place, transparent and implemented effectively.", "justification": "Artificial Intelligence (AI) & Autonomous Technologies Governance (AAT-02) provides detective monitoring capability that compensates for the absence of Privileged Role & Delegation Boundaries (AAT-39.6) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "AAT-39.7", "risk_if_not_implemented": "Without AI Agent Data Access Restrictions, AI and autonomous systems may produce unreliable, biased or unsafe outputs, act outside authorized scope, or expose sensitive data. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Access (R-AC-4), AI Data Confidentiality / Integrity / Provenance Loss (R-AI-2), Sensitive Data / Compliance Exposure from Unsanctioned AI Use (R-AI-4), Loss of Confidentiality (R-IP-2), Privacy Harm / Unauthorized Processing (R-IP-6), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9).", "compensating_control_1": { "control_id": "MON-02", "name": "Continuous Monitoring", "description": "Mechanisms exist to facilitate the implementation of enterprise-wide monitoring controls.", "justification": "Continuous Monitoring (MON-02) provides detective monitoring capability that compensates for the absence of AI Agent Data Access Restrictions (AAT-39.7) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "AAT-02", "name": "Artificial Intelligence (AI) & Autonomous Technologies Governance", "description": "Mechanisms exist to ensure policies, processes, procedures and practices related to the mapping, measuring and managing of Artificial Intelligence (AI) and Autonomous Technologies (AAT)-related risks are in place, transparent and implemented effectively.", "justification": "Artificial Intelligence (AI) & Autonomous Technologies Governance (AAT-02) provides detective monitoring capability that compensates for the absence of AI Agent Data Access Restrictions (AAT-39.7) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "AAT-39.8", "risk_if_not_implemented": "Without AI Agent Data Extraction, AI and autonomous systems may produce unreliable, biased or unsafe outputs, act outside authorized scope, or expose sensitive data. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Retention / Inability to Dispose of Data (R-AM-3), AI Data Confidentiality / Integrity / Provenance Loss (R-AI-2), Loss of Confidentiality (R-IP-2), and most likely increases susceptibility to Malicious Cyber Activity (MT-2).", "compensating_control_1": { "control_id": "IAC-30", "name": "Least Privilege", "description": "Mechanisms exist to utilize the concept of least privilege, allowing only authorized access to processes necessary to accomplish assigned tasks in accordance with organizational business functions.", "justification": "Least Privilege (IAC-30) provides access control enforcement that compensates for the absence of Data Extraction (AAT-39.8) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "IAC-25", "name": "Access Enforcement", "description": "Mechanisms exist to enforce Logical Access Control (LAC) permissions that conform to the principle of \"least privilege.\"", "justification": "Access Enforcement (IAC-25) provides access control enforcement that compensates for the absence of Data Extraction (AAT-39.8) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "AAT-39.9", "risk_if_not_implemented": "Without AI Agent Identity & Impersonation Defense, unauthorized individuals, devices or services may gain access to Technology Assets, Applications, Services, Data and/or Facilities (TAASDF). Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss of Accountability / Attribution (R-AC-1), Unauthorized Access (R-AC-4), Identity Compromise / Impersonation (R-AC-5), Loss of Authenticity / Provenance (R-IP-5), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Adversarial Artificial Intelligence (AI) Attack (MT-29).", "compensating_control_1": { "control_id": "MON-18.1", "name": "Session Audit", "description": "Mechanisms exist to provide session audit capabilities that can: \n(1) Capture and log all content related to a user session; and\n(2) Remotely view all content related to an established user session in real time.", "justification": "Session Audit (MON-18.1) provides detective monitoring capability that compensates for the absence of AI Agent Identity & Impersonation Defense (AAT-39.9) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "MON-02", "name": "Continuous Monitoring", "description": "Mechanisms exist to facilitate the implementation of enterprise-wide monitoring controls.", "justification": "Continuous Monitoring (MON-02) provides detective monitoring capability that compensates for the absence of AI Agent Identity & Impersonation Defense (AAT-39.9) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "AAT-39.10", "risk_if_not_implemented": "Without AI Agent Logic Integrity, AI and autonomous systems may produce unreliable, biased or unsafe outputs, act outside authorized scope, or expose sensitive data. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Modification / Loss of System Integrity (R-AM-2), AI Output / Decision Integrity Failure (R-AI-1), Unauthorized / Harmful Autonomous Action (R-AI-3), Unintended or Unsafe Technology Behavior (R-AI-5), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Artificial Intelligence & Autonomous Technologies (AAT) System Failure or Unintended Behavior (MT-13), Adversarial Artificial Intelligence (AI) Attack (MT-29).", "compensating_control_1": { "control_id": "IAC-25", "name": "Access Enforcement", "description": "Mechanisms exist to enforce Logical Access Control (LAC) permissions that conform to the principle of \"least privilege.\"", "justification": "Access Enforcement (IAC-25) provides access control enforcement that compensates for the absence of AI Agent Logic Integrity (AAT-39.10) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "IAC-30", "name": "Least Privilege", "description": "Mechanisms exist to utilize the concept of least privilege, allowing only authorized access to processes necessary to accomplish assigned tasks in accordance with organizational business functions.", "justification": "Least Privilege (IAC-30) provides access control enforcement that compensates for the absence of AI Agent Logic Integrity (AAT-39.10) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "AAT-39.11", "risk_if_not_implemented": "Without Sandboxing AI Agents, security incidents may not be detected, contained, investigated or communicated in a timely manner, increasing their scope, duration and cost. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Excessive or Unauthorized Privilege (R-AC-2), Unauthorized Access (R-AC-4), Unauthorized / Harmful Autonomous Action (R-AI-3), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9), Adversarial Artificial Intelligence (AI) Attack (MT-29).", "compensating_control_1": { "control_id": "MON-02", "name": "Continuous Monitoring", "description": "Mechanisms exist to facilitate the implementation of enterprise-wide monitoring controls.", "justification": "Continuous Monitoring (MON-02) provides detective monitoring capability that compensates for the absence of Sandboxing AI Agents (AAT-39.11) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "MON-18.1", "name": "Session Audit", "description": "Mechanisms exist to provide session audit capabilities that can: \n(1) Capture and log all content related to a user session; and\n(2) Remotely view all content related to an established user session in real time.", "justification": "Session Audit (MON-18.1) provides detective monitoring capability that compensates for the absence of Sandboxing AI Agents (AAT-39.11) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "AAT-39.12", "risk_if_not_implemented": "Without AI Agent Prompt Injection Defense, AI and autonomous systems may produce unreliable, biased or unsafe outputs, act outside authorized scope, or expose sensitive data. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to System / Data Compromise (Technical Vector) (R-BC-4), Undetected / Delayed Detection of Adverse Activity (R-SA-1), AI Output / Decision Integrity Failure (R-AI-1), Unauthorized / Harmful Autonomous Action (R-AI-3), Unintended or Unsafe Technology Behavior (R-AI-5), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Artificial Intelligence & Autonomous Technologies (AAT) System Failure or Unintended Behavior (MT-13), Adversarial Artificial Intelligence (AI) Attack (MT-29).", "compensating_control_1": { "control_id": "IAC-30", "name": "Least Privilege", "description": "Mechanisms exist to utilize the concept of least privilege, allowing only authorized access to processes necessary to accomplish assigned tasks in accordance with organizational business functions.", "justification": "Least Privilege (IAC-30) provides access control enforcement that compensates for the absence of Prompt Injection Defense (AAT-39.12) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "MON-18.1", "name": "Session Audit", "description": "Mechanisms exist to provide session audit capabilities that can: \n(1) Capture and log all content related to a user session; and\n(2) Remotely view all content related to an established user session in real time.", "justification": "Session Audit (MON-18.1) provides detective monitoring capability that compensates for the absence of Prompt Injection Defense (AAT-39.12) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "AAT-39.13", "risk_if_not_implemented": "Without AI Agent Kill Switch / User Control, AI and autonomous systems may produce unreliable, biased or unsafe outputs, act outside authorized scope, or expose sensitive data. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Delayed Containment / Increased Incident Impact (R-IR-2), Unauthorized / Harmful Autonomous Action (R-AI-3), Unintended or Unsafe Technology Behavior (R-AI-5), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9).", "compensating_control_1": { "control_id": "MON-18.1", "name": "Session Audit", "description": "Mechanisms exist to provide session audit capabilities that can: \n(1) Capture and log all content related to a user session; and\n(2) Remotely view all content related to an established user session in real time.", "justification": "Session Audit (MON-18.1) provides detective monitoring capability that compensates for the absence of Agent Kill Switch / User Control (AAT-39.13) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "IAC-30", "name": "Least Privilege", "description": "Mechanisms exist to utilize the concept of least privilege, allowing only authorized access to processes necessary to accomplish assigned tasks in accordance with organizational business functions.", "justification": "Least Privilege (IAC-30) provides access control enforcement that compensates for the absence of Agent Kill Switch / User Control (AAT-39.13) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "AAT-39.14", "risk_if_not_implemented": "Without AI Agent Adversarial & Red Team Testing, AI and autonomous systems may produce unreliable, biased or unsafe outputs, act outside authorized scope, or expose sensitive data. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Exposure from Unaddressed Vulnerabilities (R-EX-6), and most likely increases susceptibility to Human Error (MT-9), Workforce Shortage / Loss of Critical Skills / Labor Disruption (MT-25), Adversarial Artificial Intelligence (AI) Attack (MT-29).", "compensating_control_1": { "control_id": "AAT-39", "name": "AI Agent Governance", "description": "Mechanisms exist to ensure AI agents are designed, developed and deployed to securely operate under human oversight.", "justification": "AI Agent Governance (AAT-39) provides policy-level governance that compensates for the absence of Adversarial & Red Team Testing (AAT-39.14) by establishing documented expectations, accountability structures, and organizational guardrails. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "MON-02", "name": "Continuous Monitoring", "description": "Mechanisms exist to facilitate the implementation of enterprise-wide monitoring controls.", "justification": "Continuous Monitoring (MON-02) provides detective monitoring capability that compensates for the absence of Adversarial & Red Team Testing (AAT-39.14) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "AAT-39.15", "risk_if_not_implemented": "Without AI Agent Self-Modification Controls, AI and autonomous systems may produce unreliable, biased or unsafe outputs, act outside authorized scope, or expose sensitive data. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss of Accountability / Attribution (R-AC-1), Unauthorized Modification / Loss of System Integrity (R-AM-2), Unauthorized / Harmful Autonomous Action (R-AI-3), Unintended or Unsafe Technology Behavior (R-AI-5), and most likely increases susceptibility to Artificial Intelligence & Autonomous Technologies (AAT) System Failure or Unintended Behavior (MT-13), Adversarial Artificial Intelligence (AI) Attack (MT-29).", "compensating_control_1": { "control_id": "IAC-25", "name": "Access Enforcement", "description": "Mechanisms exist to enforce Logical Access Control (LAC) permissions that conform to the principle of \"least privilege.\"", "justification": "Access Enforcement (IAC-25) provides access control enforcement that compensates for the absence of Self-Modification Controls (AAT-39.15) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "MON-02", "name": "Continuous Monitoring", "description": "Mechanisms exist to facilitate the implementation of enterprise-wide monitoring controls.", "justification": "Continuous Monitoring (MON-02) provides detective monitoring capability that compensates for the absence of Self-Modification Controls (AAT-39.15) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "AAT-39.16", "risk_if_not_implemented": "Without Purging AI Agent Data, AI and autonomous systems may produce unreliable, biased or unsafe outputs, act outside authorized scope, or expose sensitive data. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Data Loss / Integrity Compromise (R-BC-2), Loss of Investigative / Evidentiary Capability (R-IR-1), AI Data Confidentiality / Integrity / Provenance Loss (R-AI-2), Loss of Data / Service Availability (R-IP-4), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9), Fraud, Corruption and/or Intentional Criminal Conduct (MT-14).", "compensating_control_1": { "control_id": "MON-02", "name": "Continuous Monitoring", "description": "Mechanisms exist to facilitate the implementation of enterprise-wide monitoring controls.", "justification": "Continuous Monitoring (MON-02) provides detective monitoring capability that compensates for the absence of Purging AI Agent Data (AAT-39.16) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "IAC-30", "name": "Least Privilege", "description": "Mechanisms exist to utilize the concept of least privilege, allowing only authorized access to processes necessary to accomplish assigned tasks in accordance with organizational business functions.", "justification": "Least Privilege (IAC-30) provides access control enforcement that compensates for the absence of Purging AI Agent Data (AAT-39.16) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "AAT-39.17", "risk_if_not_implemented": "Without AI Agent Delegation and Chaining Control, AI and autonomous systems may produce unreliable, biased or unsafe outputs, act outside authorized scope, or expose sensitive data. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Privilege Elevation (R-AC-3), Unauthorized / Harmful Autonomous Action (R-AI-3), Unintended or Unsafe Technology Behavior (R-AI-5), and most likely increases susceptibility to Artificial Intelligence & Autonomous Technologies (AAT) System Failure or Unintended Behavior (MT-13), Adversarial Artificial Intelligence (AI) Attack (MT-29).", "compensating_control_1": { "control_id": "IAC-30", "name": "Least Privilege", "description": "Mechanisms exist to utilize the concept of least privilege, allowing only authorized access to processes necessary to accomplish assigned tasks in accordance with organizational business functions.", "justification": "Least Privilege (IAC-30) provides access control enforcement that compensates for the absence of Delegation and Chaining Control (AAT-39.17) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "MON-18.1", "name": "Session Audit", "description": "Mechanisms exist to provide session audit capabilities that can: \n(1) Capture and log all content related to a user session; and\n(2) Remotely view all content related to an established user session in real time.", "justification": "Session Audit (MON-18.1) provides detective monitoring capability that compensates for the absence of Delegation and Chaining Control (AAT-39.17) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "AAT-39.18", "risk_if_not_implemented": "Without AI Agent Behavioral Drift Detection, AI and autonomous systems may produce unreliable, biased or unsafe outputs, act outside authorized scope, or expose sensitive data. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Undetected / Delayed Detection of Adverse Activity (R-SA-1), Unintended or Unsafe Technology Behavior (R-AI-5), and most likely increases susceptibility to Data Quality Degradation / Data Poisoning (MT-12), Artificial Intelligence & Autonomous Technologies (AAT) System Failure or Unintended Behavior (MT-13), Adversarial Artificial Intelligence (AI) Attack (MT-29).", "compensating_control_1": { "control_id": "MON-18.1", "name": "Session Audit", "description": "Mechanisms exist to provide session audit capabilities that can: \n(1) Capture and log all content related to a user session; and\n(2) Remotely view all content related to an established user session in real time.", "justification": "Session Audit (MON-18.1) provides detective monitoring capability that compensates for the absence of Behavioral Drift Detection (AAT-39.18) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "IAC-25", "name": "Access Enforcement", "description": "Mechanisms exist to enforce Logical Access Control (LAC) permissions that conform to the principle of \"least privilege.\"", "justification": "Access Enforcement (IAC-25) provides access control enforcement that compensates for the absence of Behavioral Drift Detection (AAT-39.18) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "AAT-39.19", "risk_if_not_implemented": "Without AI Agent Action Authentication & Authorization, credentials may be phished, replayed, guessed or stolen, allowing unauthorized actors to authenticate as trusted identities. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to R-AC-1, R-AC-2, R-AC-3, R-AC-4, R-AC-5, R-AI-3, and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Adversarial Artificial Intelligence (AI) Attack (MT-29).", "compensating_control_1": { "control_id": "IAC-25", "name": "Access Enforcement", "description": "Mechanisms exist to enforce Logical Access Control (LAC) permissions that conform to the principle of \"least privilege.\"", "justification": "Access Enforcement (IAC-25) provides access control enforcement that compensates for the absence of AI Agent Action Authentication & Authorization (AAT-39.19) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "MON-18.1", "name": "Session Audit", "description": "Mechanisms exist to provide session audit capabilities that can: \n(1) Capture and log all content related to a user session; and\n(2) Remotely view all content related to an established user session in real time.", "justification": "Session Audit (MON-18.1) provides detective monitoring capability that compensates for the absence of AI Agent Action Authentication & Authorization (AAT-39.19) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "AAT-39.20", "risk_if_not_implemented": "Without AI Agent Transparency & Audit, AI and autonomous systems may produce unreliable, biased or unsafe outputs, act outside authorized scope, or expose sensitive data. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss of Accountability / Attribution (R-AC-1), Loss of Investigative / Evidentiary Capability (R-IR-1), and most likely increases susceptibility to Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "MON-02", "name": "Continuous Monitoring", "description": "Mechanisms exist to facilitate the implementation of enterprise-wide monitoring controls.", "justification": "Continuous Monitoring (MON-02) provides detective monitoring capability that compensates for the absence of Transparency & Audit (AAT-39.20) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "IAC-25", "name": "Access Enforcement", "description": "Mechanisms exist to enforce Logical Access Control (LAC) permissions that conform to the principle of \"least privilege.\"", "justification": "Access Enforcement (IAC-25) provides access control enforcement that compensates for the absence of Transparency & Audit (AAT-39.20) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "AAT-39.21", "risk_if_not_implemented": "Without AI Agent Explainability, AI and autonomous systems may produce unreliable, biased or unsafe outputs, act outside authorized scope, or expose sensitive data. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to AI Bias / Discriminatory Outcome (R-AI-6), and most likely increases susceptibility to Artificial Intelligence & Autonomous Technologies (AAT) System Failure or Unintended Behavior (MT-13).", "compensating_control_1": { "control_id": "IAC-30", "name": "Least Privilege", "description": "Mechanisms exist to utilize the concept of least privilege, allowing only authorized access to processes necessary to accomplish assigned tasks in accordance with organizational business functions.", "justification": "Least Privilege (IAC-30) provides access control enforcement that compensates for the absence of Explainability (AAT-39.21) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "MON-02", "name": "Continuous Monitoring", "description": "Mechanisms exist to facilitate the implementation of enterprise-wide monitoring controls.", "justification": "Continuous Monitoring (MON-02) provides detective monitoring capability that compensates for the absence of Explainability (AAT-39.21) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "AAT-39.22", "risk_if_not_implemented": "Without AI Agent Ethics, Fairness & Bias Detection, AI and autonomous systems may produce unreliable, biased or unsafe outputs, act outside authorized scope, or expose sensitive data. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to AI Output / Decision Integrity Failure (R-AI-1), AI Bias / Discriminatory Outcome (R-AI-6), and most likely increases susceptibility to Data Quality Degradation / Data Poisoning (MT-12).", "compensating_control_1": { "control_id": "MON-18.1", "name": "Session Audit", "description": "Mechanisms exist to provide session audit capabilities that can: \n(1) Capture and log all content related to a user session; and\n(2) Remotely view all content related to an established user session in real time.", "justification": "Session Audit (MON-18.1) provides detective monitoring capability that compensates for the absence of Ethics, Fairness & Bias Detection (AAT-39.22) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "MON-02", "name": "Continuous Monitoring", "description": "Mechanisms exist to facilitate the implementation of enterprise-wide monitoring controls.", "justification": "Continuous Monitoring (MON-02) provides detective monitoring capability that compensates for the absence of Ethics, Fairness & Bias Detection (AAT-39.22) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "AAT-39.23", "risk_if_not_implemented": "Without AI Agent Output Integrity & Verification, AI and autonomous systems may produce unreliable, biased or unsafe outputs, act outside authorized scope, or expose sensitive data. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Harm from Illegal, Abusive or Unsafe Content / Conduct (R-GV-8), AI Output / Decision Integrity Failure (R-AI-1), Unintended or Unsafe Technology Behavior (R-AI-5), and most likely increases susceptibility to Human Error (MT-9), Artificial Intelligence & Autonomous Technologies (AAT) System Failure or Unintended Behavior (MT-13), Adversarial Artificial Intelligence (AI) Attack (MT-29).", "compensating_control_1": { "control_id": "IAC-25", "name": "Access Enforcement", "description": "Mechanisms exist to enforce Logical Access Control (LAC) permissions that conform to the principle of \"least privilege.\"", "justification": "Access Enforcement (IAC-25) provides access control enforcement that compensates for the absence of Agent Output Integrity & Verification (AAT-39.23) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "IAC-30", "name": "Least Privilege", "description": "Mechanisms exist to utilize the concept of least privilege, allowing only authorized access to processes necessary to accomplish assigned tasks in accordance with organizational business functions.", "justification": "Least Privilege (IAC-30) provides access control enforcement that compensates for the absence of Agent Output Integrity & Verification (AAT-39.23) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "AAT-39.24", "risk_if_not_implemented": "Without AI Agent Resource Limiting, AI and autonomous systems may produce unreliable, biased or unsafe outputs, act outside authorized scope, or expose sensitive data. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Fraud / Theft / Direct Financial Loss (R-EX-10), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Artificial Intelligence & Autonomous Technologies (AAT) System Failure or Unintended Behavior (MT-13).", "compensating_control_1": { "control_id": "CAP-02", "name": "Capacity & Performance Management", "description": "Mechanisms exist to facilitate the implementation of capacity management controls to ensure optimal system performance to meet expected and anticipated future capacity requirements.", "justification": "Capacity & Performance Management (CAP-02) provides overlapping security capability that compensates for the absence of Resource Limiting (AAT-39.24) by addressing related risk objectives through an alternative control mechanism. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "MON-02", "name": "Continuous Monitoring", "description": "Mechanisms exist to facilitate the implementation of enterprise-wide monitoring controls.", "justification": "Continuous Monitoring (MON-02) provides detective monitoring capability that compensates for the absence of Resource Limiting (AAT-39.24) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "AAT-40", "risk_if_not_implemented": "Without Agentic Output Traceability & Repudiation, AI and autonomous systems may produce unreliable, biased or unsafe outputs, act outside authorized scope, or expose sensitive data. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss of Accountability / Attribution (R-AC-1), Loss of Investigative / Evidentiary Capability (R-IR-1), Loss of Authenticity / Provenance (R-IP-5), and most likely increases susceptibility to Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "MON-34", "name": "Non-Repudiation", "description": "Mechanisms exist to utilize a non-repudiation capability to protect against an individual falsely denying having performed a particular action.", "justification": "Non-Repudiation (MON-34) provides overlapping security capability that compensates for the absence of Agentic Output Traceability & Repudiation (AAT-40) by addressing related risk objectives through an alternative control mechanism aligned with Technology applicability. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "MON-18.1", "name": "Session Audit", "description": "Mechanisms exist to provide session audit capabilities that can: \n(1) Capture and log all content related to a user session; and\n(2) Remotely view all content related to an established user session in real time.", "justification": "Session Audit (MON-18.1) provides detective monitoring capability that compensates for the absence of Agentic Output Traceability & Repudiation (AAT-40) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "AAT-40.1", "risk_if_not_implemented": "Without AI Agent Logging, AI and autonomous systems may produce unreliable, biased or unsafe outputs, act outside authorized scope, or expose sensitive data. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss of Accountability / Attribution (R-AC-1), Loss of Investigative / Evidentiary Capability (R-IR-1), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "MON-12", "name": "Protection of Event Logs & Security-Relevant Telemetry", "description": "Mechanisms exist to protect event logs, security-relevant telemetry and audit tools from unauthorized access, modification and deletion.", "justification": "Protection of Event Logs & Security-Relevant Telemetry (MON-12) provides detective monitoring capability that compensates for the absence of AI Agent Logging (AAT-40.1) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "MON-34", "name": "Non-Repudiation", "description": "Mechanisms exist to utilize a non-repudiation capability to protect against an individual falsely denying having performed a particular action.", "justification": "Non-Repudiation (MON-34) provides overlapping security capability that compensates for the absence of AI Agent Logging (AAT-40.1) by addressing related risk objectives through an alternative control mechanism aligned with Technology applicability. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "AAT-40.2", "risk_if_not_implemented": "Without AI Agent Session Management, AI and autonomous systems may produce unreliable, biased or unsafe outputs, act outside authorized scope, or expose sensitive data. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss of Accountability / Attribution (R-AC-1), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "MON-34", "name": "Non-Repudiation", "description": "Mechanisms exist to utilize a non-repudiation capability to protect against an individual falsely denying having performed a particular action.", "justification": "Non-Repudiation (MON-34) provides overlapping security capability that compensates for the absence of Session Management (AAT-40.2) by addressing related risk objectives through an alternative control mechanism aligned with Technology applicability. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "MON-12", "name": "Protection of Event Logs & Security-Relevant Telemetry", "description": "Mechanisms exist to protect event logs, security-relevant telemetry and audit tools from unauthorized access, modification and deletion.", "justification": "Protection of Event Logs & Security-Relevant Telemetry (MON-12) provides detective monitoring capability that compensates for the absence of Session Management (AAT-40.2) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "AAT-41", "risk_if_not_implemented": "Without Human-in-the-Loop Workload & Manipulation, AI and autonomous systems may produce unreliable, biased or unsafe outputs, act outside authorized scope, or expose sensitive data. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to AI Output / Decision Integrity Failure (R-AI-1), Unauthorized / Harmful Autonomous Action (R-AI-3), and most likely increases susceptibility to Human Error (MT-9), Workforce Shortage / Loss of Critical Skills / Labor Disruption (MT-25), Adversarial Artificial Intelligence (AI) Attack (MT-29).", "compensating_control_1": { "control_id": "HRS-14", "name": "Separation of Duties (SoD)", "description": "Mechanisms exist to implement and maintain Separation of Duties (SoD) to prevent potential inappropriate activity without collusion.", "justification": "Separation of Duties (SoD) (HRS-14) provides overlapping security capability that compensates for the absence of Human-in-the-Loop Workload & Manipulation (AAT-41) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "IAC-30", "name": "Least Privilege", "description": "Mechanisms exist to utilize the concept of least privilege, allowing only authorized access to processes necessary to accomplish assigned tasks in accordance with organizational business functions.", "justification": "Least Privilege (IAC-30) provides access control enforcement that compensates for the absence of Human-in-the-Loop Workload & Manipulation (AAT-41) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "AAT-42", "risk_if_not_implemented": "Without Robotic Process Automation (RPA), AI and autonomous systems may produce unreliable, biased or unsafe outputs, act outside authorized scope, or expose sensitive data. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Reduced Operational Productivity (R-BC-3), and most likely increases susceptibility to Human Error (MT-9), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "AAT-02", "name": "Artificial Intelligence (AI) & Autonomous Technologies Governance", "description": "Mechanisms exist to ensure policies, processes, procedures and practices related to the mapping, measuring and managing of Artificial Intelligence (AI) and Autonomous Technologies (AAT)-related risks are in place, transparent and implemented effectively.", "justification": "Artificial Intelligence (AI) & Autonomous Technologies Governance (AAT-02) provides detective monitoring capability that compensates for the absence of Robotic Process Automation (RPA) (AAT-42) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CHG-02", "name": "Change Management Program", "description": "Mechanisms exist to facilitate the implementation of a change management program.", "justification": "Change Management Program (CHG-02) provides policy-level governance that compensates for the absence of Robotic Process Automation (RPA) (AAT-42) by establishing documented expectations, accountability structures, and organizational guardrails. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "AAT-43", "risk_if_not_implemented": "Without Business Process Task Enumeration, AI and autonomous systems may produce unreliable, biased or unsafe outputs, act outside authorized scope, or expose sensitive data. Based on the risk and threat mapping for this control, no risk is rated Likely; risks rated Possible include Reduced Operational Productivity (R-BC-3), Unaddressed Security / Compliance Exposure (R-GV-2), Unperformed / Unowned Control Responsibilities (R-GV-3), and most likely increases susceptibility to Human Error (MT-9).", "compensating_control_1": { "control_id": "CHG-03", "name": "Configuration Change Control", "description": "Mechanisms exist to govern the technical configuration change control processes.", "justification": "Configuration Change Control (CHG-03) provides configuration hardening that compensates for the absence of Business Process Task Enumeration (AAT-43) by eliminating unnecessary services and enforcing secure settings to reduce inherent exposure. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "MON-02", "name": "Continuous Monitoring", "description": "Mechanisms exist to facilitate the implementation of enterprise-wide monitoring controls.", "justification": "Continuous Monitoring (MON-02) provides detective monitoring capability that compensates for the absence of Business Process Task Enumeration (AAT-43) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "AST-03", "risk_if_not_implemented": "Without Standardized Naming Convention, Technology Assets, Applications and/or Services (TAAS) may be unknown, untracked, lost, stolen or left unprotected because they are not inventoried. Based on the risk and threat mapping for this control, no risk is rated Likely; risks rated Possible include Loss of Accountability / Attribution (R-AC-1), Loss, Theft or Damage of Assets (R-AM-1), Unauthorized Modification / Loss of System Integrity (R-AM-2), and most likely increases susceptibility to Human Error (MT-9).", "compensating_control_1": { "control_id": "DCH-03", "name": "Sensitive / Regulated Data Governance", "description": "Mechanisms exist to facilitate data governance so that sensitive and/or regulated data is effectively managed and maintained in accordance with applicable statutory, regulatory and contractual obligations.", "justification": "Sensitive / Regulated Data Governance (DCH-03) provides policy-level governance that compensates for the absence of Standardized Naming Convention (AST-03) by establishing documented expectations, accountability structures, and organizational guardrails. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "AST-04", "name": "Asset Inventories", "description": "Mechanisms exist to perform inventories of Technology Assets, Applications, Services and/or Data (TAASD) that:\n(1) Accurately reflects the current TAASD in use; \n(2) Identifies authorized software products, including business justification details;\n(3) Is at the level of granularity deemed necessary for tracking and reporting;\n(4) Includes organization-defined information deemed necessary to achieve effective property accountability; and\n(5) Is available for review and audit by designated organizational personnel.", "justification": "Asset Inventories (AST-04) provides overlapping security capability that compensates for the absence of Standardized Naming Convention (AST-03) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "AST-04.1", "risk_if_not_implemented": "Without Updates During Installations / Removals, Technology Assets, Applications and/or Services (TAAS) may be unknown, untracked, lost, stolen or left unprotected because they are not inventoried. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss, Theft or Damage of Assets (R-AM-1), and most likely increases susceptibility to Human Error (MT-9).", "compensating_control_1": { "control_id": "AST-15", "name": "Asset Categorization", "description": "Mechanisms exist to categorize Technology Assets, Applications and/or Services (TAAS).", "justification": "Asset Categorization (AST-15) provides overlapping security capability that compensates for the absence of Updates During Installations / Removals (AST-04.1) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "DCH-04", "name": "Data & Asset Classification", "description": "Mechanisms exist to ensure data and assets are categorized in accordance with applicable statutory, regulatory and contractual requirements.", "justification": "Data & Asset Classification (DCH-04) provides overlapping security capability that compensates for the absence of Updates During Installations / Removals (AST-04.1) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "AST-04.2", "risk_if_not_implemented": "Without Component Duplication Avoidance, Technology Assets, Applications and/or Services (TAAS) may be unknown, untracked, lost, stolen or left unprotected because they are not inventoried. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss of Accountability / Attribution (R-AC-1), Unreliable Assurance / Decision Information (R-GV-10), and most likely increases susceptibility to Human Error (MT-9), Data Quality Degradation / Data Poisoning (MT-12).", "compensating_control_1": { "control_id": "AST-04", "name": "Asset Inventories", "description": "Mechanisms exist to perform inventories of Technology Assets, Applications, Services and/or Data (TAASD) that:\n(1) Accurately reflects the current TAASD in use; \n(2) Identifies authorized software products, including business justification details;\n(3) Is at the level of granularity deemed necessary for tracking and reporting;\n(4) Includes organization-defined information deemed necessary to achieve effective property accountability; and\n(5) Is available for review and audit by designated organizational personnel.", "justification": "Asset Inventories (AST-04) provides overlapping security capability that compensates for the absence of Component Duplication Avoidance (AST-04.2) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CFG-04", "name": "Secure Baseline Configurations", "description": "Mechanisms exist to develop, document and maintain secure baseline configurations for Technology Assets, Applications and/or Services (TAAS) that are consistent with industry-accepted hardening standards.", "justification": "Secure Baseline Configurations (CFG-04) provides configuration hardening that compensates for the absence of Component Duplication Avoidance (AST-04.2) by eliminating unnecessary services and enforcing secure settings to reduce inherent exposure. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "AST-05", "risk_if_not_implemented": "Without Identify Critical Assets, the organization's most critical assets may not receive proportionate protection, leaving them disproportionately exposed to compromise. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Recovery Failure / Unacceptable Recovery Delay (R-OR-1), and most likely increases susceptibility to Human Error (MT-9).", "compensating_control_1": { "control_id": "AST-04", "name": "Asset Inventories", "description": "Mechanisms exist to perform inventories of Technology Assets, Applications, Services and/or Data (TAASD) that:\n(1) Accurately reflects the current TAASD in use; \n(2) Identifies authorized software products, including business justification details;\n(3) Is at the level of granularity deemed necessary for tracking and reporting;\n(4) Includes organization-defined information deemed necessary to achieve effective property accountability; and\n(5) Is available for review and audit by designated organizational personnel.", "justification": "Asset Inventories (AST-04) provides overlapping security capability that compensates for the absence of Identify Critical Assets (AST-05) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "DCH-04", "name": "Data & Asset Classification", "description": "Mechanisms exist to ensure data and assets are categorized in accordance with applicable statutory, regulatory and contractual requirements.", "justification": "Data & Asset Classification (DCH-04) provides overlapping security capability that compensates for the absence of Identify Critical Assets (AST-05) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "AST-05.1", "risk_if_not_implemented": "Without Technology Assets, Applications, Services and/or Data (TAASD) Criticality Ratings, recovery efforts cannot be sequenced by business importance, so restoration resources may be spent on low-value assets while critical ones remain down. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unaddressed Security / Compliance Exposure (R-GV-2), Recovery Failure / Unacceptable Recovery Delay (R-OR-1), and most likely increases susceptibility to Human Error (MT-9).", "compensating_control_1": { "control_id": "RSK-08", "name": "Business Impact Analysis (BIA)", "description": "Mechanisms exist to conduct a Business Impact Analysis (BIA) to identify and assess security, compliance and resilience risks.", "justification": "Business Impact Analysis (BIA) (RSK-08) compensates for the absence of Technology Assets, Applications, Services and/or Data (TAASD) Criticality Ratings (AST-05.1) by identifying critical business functions, their dependencies and Recovery Time / Point Objectives, which yields the same recovery-priority information that a formal criticality rating would provide. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "BCD-05", "name": "Recovery Operations Criteria", "description": "Mechanisms exist to define specific criteria that must be met to initiate Business Continuity / Disaster Recovery (BC/DR) plans that facilitate business continuity operations capable of meeting applicable Recovery Time Objectives (RTOs) and Recovery Point Objectives (RPOs).", "justification": "Recovery Operations Criteria (BCD-05) compensates for the absence of Technology Assets, Applications, Services and/or Data (TAASD) Criticality Ratings (AST-05.1) by defining the criteria under which recovery operations are initiated and the order in which they proceed, which forces an implicit criticality ranking of the assets and services in scope. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "AST-06", "risk_if_not_implemented": "Without Asset-Service Dependencies, Technology Assets, Applications and/or Services (TAAS) may be unknown, untracked, lost, stolen or left unprotected because they are not inventoried. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unaddressed Security / Compliance Exposure (R-GV-2), Concentration / Single-Point Dependency Failure (R-OR-2), and most likely increases susceptibility to Human Error (MT-9).", "compensating_control_1": { "control_id": "AST-04", "name": "Asset Inventories", "description": "Mechanisms exist to perform inventories of Technology Assets, Applications, Services and/or Data (TAASD) that:\n(1) Accurately reflects the current TAASD in use; \n(2) Identifies authorized software products, including business justification details;\n(3) Is at the level of granularity deemed necessary for tracking and reporting;\n(4) Includes organization-defined information deemed necessary to achieve effective property accountability; and\n(5) Is available for review and audit by designated organizational personnel.", "justification": "Asset Inventories (AST-04) provides overlapping security capability that compensates for the absence of Asset-Service Dependencies (AST-06) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "DCH-03", "name": "Sensitive / Regulated Data Governance", "description": "Mechanisms exist to facilitate data governance so that sensitive and/or regulated data is effectively managed and maintained in accordance with applicable statutory, regulatory and contractual obligations.", "justification": "Sensitive / Regulated Data Governance (DCH-03) provides policy-level governance that compensates for the absence of Asset-Service Dependencies (AST-06) by establishing documented expectations, accountability structures, and organizational guardrails. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "AST-07", "risk_if_not_implemented": "Without Stakeholder Identification & Involvement, Technology Assets, Applications and/or Services (TAAS) may be unknown, untracked, lost, stolen or left unprotected because they are not inventoried. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unperformed / Unowned Control Responsibilities (R-GV-3), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Workforce Shortage / Loss of Critical Skills / Labor Disruption (MT-25).", "compensating_control_1": { "control_id": "DCH-04", "name": "Data & Asset Classification", "description": "Mechanisms exist to ensure data and assets are categorized in accordance with applicable statutory, regulatory and contractual requirements.", "justification": "Data & Asset Classification (DCH-04) provides overlapping security capability that compensates for the absence of Stakeholder Identification & Involvement (AST-07) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "AST-04", "name": "Asset Inventories", "description": "Mechanisms exist to perform inventories of Technology Assets, Applications, Services and/or Data (TAASD) that:\n(1) Accurately reflects the current TAASD in use; \n(2) Identifies authorized software products, including business justification details;\n(3) Is at the level of granularity deemed necessary for tracking and reporting;\n(4) Includes organization-defined information deemed necessary to achieve effective property accountability; and\n(5) Is available for review and audit by designated organizational personnel.", "justification": "Asset Inventories (AST-04) provides overlapping security capability that compensates for the absence of Stakeholder Identification & Involvement (AST-07) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "AST-07.1", "risk_if_not_implemented": "Without Technology Assets, Applications, Services and/or Data (TAASD) Ownership Assignment, Technology Assets, Applications and/or Services (TAAS) may be unknown, untracked, lost, stolen or left unprotected because they are not inventoried. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss of Accountability / Attribution (R-AC-1), Unperformed / Unowned Control Responsibilities (R-GV-3), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9).", "compensating_control_1": { "control_id": "HRS-04", "name": "Defined Roles & Responsibilities", "description": "Mechanisms exist to define cybersecurity roles & responsibilities for all personnel.", "justification": "Defined Roles & Responsibilities (HRS-04) provides overlapping security capability that compensates for the absence of Asset Ownership Assignment (AST-07.1) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "GOV-05", "name": "Assigned Security, Compliance & Resilience Responsibilities", "description": "Mechanisms exist to assign one or more qualified individuals with the mission and resources to centrally-manage, coordinate, develop, implement and maintain an enterprise-wide Security, Compliance & Resilience Program (SCRP).", "justification": "Assigned Security, Compliance & Resilience Responsibilities (GOV-05) provides resilience and recovery capability that compensates for the absence of Asset Ownership Assignment (AST-07.1) by ensuring the organization can restore operations and data when the primary control is absent. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "AST-07.2", "risk_if_not_implemented": "Without Accountability Information, unauthorized individuals, devices or services may gain access to Technology Assets, Applications, Services, Data and/or Facilities (TAASDF). Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss of Accountability / Attribution (R-AC-1), Unperformed / Unowned Control Responsibilities (R-GV-3), and most likely increases susceptibility to Human Error (MT-9), Data Quality Degradation / Data Poisoning (MT-12).", "compensating_control_1": { "control_id": "HRS-04", "name": "Defined Roles & Responsibilities", "description": "Mechanisms exist to define cybersecurity roles & responsibilities for all personnel.", "justification": "Defined Roles & Responsibilities (HRS-04) provides overlapping security capability that compensates for the absence of Accountability Information (AST-07.2) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "IAC-33", "name": "Identification & Authentication for Non-Organizational Users", "description": "Mechanisms exist to uniquely identify and centrally Authenticate, Authorize and Audit (AAA) third-party users and processes that provide services to the organization.", "justification": "Identification & Authentication for Non-Organizational Users (IAC-33) provides access control enforcement that compensates for the absence of Accountability Information (AST-07.2) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "AST-08", "risk_if_not_implemented": "Without Comprehensive Asset Inventory Management, Technology Assets, Applications and/or Services (TAAS) may be unknown, untracked, lost, stolen or left unprotected because they are not inventoried. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss, Theft or Damage of Assets (R-AM-1), Unaddressed Security / Compliance Exposure (R-GV-2), and most likely increases susceptibility to Human Error (MT-9), Technical / Mechanical Failure (MT-10), Data Quality Degradation / Data Poisoning (MT-12).", "compensating_control_1": { "control_id": "AST-04", "name": "Asset Inventories", "description": "Mechanisms exist to perform inventories of Technology Assets, Applications, Services and/or Data (TAASD) that:\n(1) Accurately reflects the current TAASD in use; \n(2) Identifies authorized software products, including business justification details;\n(3) Is at the level of granularity deemed necessary for tracking and reporting;\n(4) Includes organization-defined information deemed necessary to achieve effective property accountability; and\n(5) Is available for review and audit by designated organizational personnel.", "justification": "Asset Inventories (AST-04) provides asset and inventory visibility that compensates for the absence of Comprehensive Asset Inventory Management (AST-08) by providing the foundational asset knowledge needed to manage risks associated with the primary control. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "AST-09", "name": "Asset Discovery", "description": "Automated mechanisms exist to perform asset discovery to identify Technology Assets, Applications and/or Services (TAAS) connected to organizational networks, including assets not present in existing inventories.", "justification": "Asset Discovery (AST-09) provides asset and inventory visibility that compensates for the absence of Comprehensive Asset Inventory Management (AST-08) by providing the foundational asset knowledge needed to manage risks associated with the primary control. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "AST-08.1", "risk_if_not_implemented": "Without Configuration Management Database (CMDB), Technology Assets, Applications and/or Services (TAAS) may operate with insecure, unauthorized or drifted configurations that expand the attack surface. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unaddressed Security / Compliance Exposure (R-GV-2), and most likely increases susceptibility to Human Error (MT-9), Technical / Mechanical Failure (MT-10), Data Quality Degradation / Data Poisoning (MT-12).", "compensating_control_1": { "control_id": "CFG-04", "name": "Secure Baseline Configurations", "description": "Mechanisms exist to develop, document and maintain secure baseline configurations for Technology Assets, Applications and/or Services (TAAS) that are consistent with industry-accepted hardening standards.", "justification": "Secure Baseline Configurations (CFG-04) provides configuration hardening that compensates for the absence of Configuration Management Database (CMDB) (AST-08.1) by eliminating unnecessary services and enforcing secure settings to reduce inherent exposure. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "AST-04", "name": "Asset Inventories", "description": "Mechanisms exist to perform inventories of Technology Assets, Applications, Services and/or Data (TAASD) that:\n(1) Accurately reflects the current TAASD in use; \n(2) Identifies authorized software products, including business justification details;\n(3) Is at the level of granularity deemed necessary for tracking and reporting;\n(4) Includes organization-defined information deemed necessary to achieve effective property accountability; and\n(5) Is available for review and audit by designated organizational personnel.", "justification": "Asset Inventories (AST-04) provides overlapping security capability that compensates for the absence of Configuration Management Database (CMDB) (AST-08.1) by addressing related risk objectives through an alternative control mechanism aligned with Technology applicability. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "AST-08.2", "risk_if_not_implemented": "Without Component Assignment, Technology Assets, Applications and/or Services (TAAS) may be unknown, untracked, lost, stolen or left unprotected because they are not inventoried. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unaddressed Security / Compliance Exposure (R-GV-2), and most likely increases susceptibility to Human Error (MT-9).", "compensating_control_1": { "control_id": "AST-15", "name": "Asset Categorization", "description": "Mechanisms exist to categorize Technology Assets, Applications and/or Services (TAAS).", "justification": "Asset Categorization (AST-15) provides overlapping security capability that compensates for the absence of Component Assignment (AST-08.2) by addressing related risk objectives through an alternative control mechanism aligned with Technology applicability. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "MON-02", "name": "Continuous Monitoring", "description": "Mechanisms exist to facilitate the implementation of enterprise-wide monitoring controls.", "justification": "Continuous Monitoring (MON-02) provides detective monitoring capability that compensates for the absence of Component Assignment (AST-08.2) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "AST-09", "risk_if_not_implemented": "Without Asset Discovery, Technology Assets, Applications and/or Services (TAAS) may be unknown, untracked, lost, stolen or left unprotected because they are not inventoried. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unaddressed Security / Compliance Exposure (R-GV-2), Undetected / Delayed Detection of Adverse Activity (R-SA-1), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "AST-04", "name": "Asset Inventories", "description": "Mechanisms exist to perform inventories of Technology Assets, Applications, Services and/or Data (TAASD) that:\n(1) Accurately reflects the current TAASD in use; \n(2) Identifies authorized software products, including business justification details;\n(3) Is at the level of granularity deemed necessary for tracking and reporting;\n(4) Includes organization-defined information deemed necessary to achieve effective property accountability; and\n(5) Is available for review and audit by designated organizational personnel.", "justification": "Asset Inventories (AST-04) provides asset and inventory visibility that compensates for the absence of Asset Discovery (AST-09) by providing the foundational asset knowledge needed to manage risks associated with the primary control. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "AST-11", "name": "Automated Unauthorized Component Detection", "description": "Automated mechanisms exist to detect and alert upon the detection of unauthorized hardware, software and firmware components.", "justification": "Automated Unauthorized Component Detection (AST-11) provides detective monitoring capability that compensates for the absence of Asset Discovery (AST-09) by identifying unauthorized, anomalous or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "AST-09.1", "risk_if_not_implemented": "Without Dynamic Host Configuration Protocol (DHCP) Server Logging, malicious, anomalous or unauthorized activity may go undetected or be detected too late to prevent or limit harm. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss of Investigative / Evidentiary Capability (R-IR-1), Undetected / Delayed Detection of Adverse Activity (R-SA-1), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "AST-15", "name": "Asset Categorization", "description": "Mechanisms exist to categorize Technology Assets, Applications and/or Services (TAAS).", "justification": "Asset Categorization (AST-15) provides overlapping security capability that compensates for the absence of Dynamic Host Configuration Protocol (DHCP) Server Logging (AST-09.1) by addressing related risk objectives through an alternative control mechanism aligned with Technology applicability. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "AST-04", "name": "Asset Inventories", "description": "Mechanisms exist to perform inventories of Technology Assets, Applications, Services and/or Data (TAASD) that:\n(1) Accurately reflects the current TAASD in use; \n(2) Identifies authorized software products, including business justification details;\n(3) Is at the level of granularity deemed necessary for tracking and reporting;\n(4) Includes organization-defined information deemed necessary to achieve effective property accountability; and\n(5) Is available for review and audit by designated organizational personnel.", "justification": "Asset Inventories (AST-04) provides overlapping security capability that compensates for the absence of Dynamic Host Configuration Protocol (DHCP) Server Logging (AST-09.1) by addressing related risk objectives through an alternative control mechanism aligned with Technology applicability. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "AST-09.2", "risk_if_not_implemented": "Without Automated Network Asset Discovery, adversaries may move laterally, exfiltrate data or reach systems that should have been isolated from untrusted networks. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unaddressed Security / Compliance Exposure (R-GV-2), Undetected / Delayed Detection of Adverse Activity (R-SA-1), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "AST-04", "name": "Asset Inventories", "description": "Mechanisms exist to perform inventories of Technology Assets, Applications, Services and/or Data (TAASD) that:\n(1) Accurately reflects the current TAASD in use; \n(2) Identifies authorized software products, including business justification details;\n(3) Is at the level of granularity deemed necessary for tracking and reporting;\n(4) Includes organization-defined information deemed necessary to achieve effective property accountability; and\n(5) Is available for review and audit by designated organizational personnel.", "justification": "Asset Inventories (AST-04) provides overlapping security capability that compensates for the absence of Automated Network Asset Discovery (AST-09.2) by addressing related risk objectives through an alternative control mechanism aligned with Technology applicability. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "MON-02", "name": "Continuous Monitoring", "description": "Mechanisms exist to facilitate the implementation of enterprise-wide monitoring controls.", "justification": "Continuous Monitoring (MON-02) provides detective monitoring capability that compensates for the absence of Automated Network Asset Discovery (AST-09.2) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "AST-09.3", "risk_if_not_implemented": "Without Automated Location\nTracking, Technology Assets, Applications and/or Services (TAAS) may be unknown, untracked, lost, stolen or left unprotected because they are not inventoried. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss, Theft or Damage of Assets (R-AM-1), and most likely increases susceptibility to Physical Crime (MT-5), Technical / Mechanical Failure (MT-10), Data Quality Degradation / Data Poisoning (MT-12).", "compensating_control_1": { "control_id": "AST-04", "name": "Asset Inventories", "description": "Mechanisms exist to perform inventories of Technology Assets, Applications, Services and/or Data (TAASD) that:\n(1) Accurately reflects the current TAASD in use; \n(2) Identifies authorized software products, including business justification details;\n(3) Is at the level of granularity deemed necessary for tracking and reporting;\n(4) Includes organization-defined information deemed necessary to achieve effective property accountability; and\n(5) Is available for review and audit by designated organizational personnel.", "justification": "Asset Inventories (AST-04) provides overlapping security capability that compensates for the absence of Automated Location\nTracking (AST-09.3) by addressing related risk objectives through an alternative control mechanism aligned with Technology applicability. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "MON-02", "name": "Continuous Monitoring", "description": "Mechanisms exist to facilitate the implementation of enterprise-wide monitoring controls.", "justification": "Continuous Monitoring (MON-02) provides detective monitoring capability that compensates for the absence of Automated Location\nTracking (AST-09.3) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "AST-10", "risk_if_not_implemented": "Without Approved Technologies, Technology Assets, Applications and/or Services (TAAS) may operate with insecure, unauthorized or drifted configurations that expand the attack surface. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unaddressed Security / Compliance Exposure (R-GV-2), Harm from Unauthorized / Unintended Product or Service Use (R-SC-5), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11).", "compensating_control_1": { "control_id": "AST-04", "name": "Asset Inventories", "description": "Mechanisms exist to perform inventories of Technology Assets, Applications, Services and/or Data (TAASD) that:\n(1) Accurately reflects the current TAASD in use; \n(2) Identifies authorized software products, including business justification details;\n(3) Is at the level of granularity deemed necessary for tracking and reporting;\n(4) Includes organization-defined information deemed necessary to achieve effective property accountability; and\n(5) Is available for review and audit by designated organizational personnel.", "justification": "Asset Inventories (AST-04) provides overlapping security capability that compensates for the absence of Approved Technologies (AST-10) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "DCH-04", "name": "Data & Asset Classification", "description": "Mechanisms exist to ensure data and assets are categorized in accordance with applicable statutory, regulatory and contractual requirements.", "justification": "Data & Asset Classification (DCH-04) provides overlapping security capability that compensates for the absence of Approved Technologies (AST-10) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "AST-10.1", "risk_if_not_implemented": "Without Authorized To Connect, Technology Assets, Applications and/or Services (TAAS) may be unknown, untracked, lost, stolen or left unprotected because they are not inventoried. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Access (R-AC-4), Unaddressed Security / Compliance Exposure (R-GV-2), and most likely increases susceptibility to Human Error (MT-9), Data Quality Degradation / Data Poisoning (MT-12).", "compensating_control_1": { "control_id": "RSK-02", "name": "Risk Management Program", "description": "Mechanisms exist to facilitate the implementation of strategic, operational and tactical risk management controls that are aligned with:\n(1) The organization's Enterprise Risk Management (ERM); and\n(2) Industry-recognized cybersecurity risk management practices.", "justification": "Risk Management Program (RSK-02) provides policy-level governance that compensates for the absence of Authorized To Connect (AST-10.1) by establishing documented expectations, accountability structures, and organizational guardrails. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "AST-04", "name": "Asset Inventories", "description": "Mechanisms exist to perform inventories of Technology Assets, Applications, Services and/or Data (TAASD) that:\n(1) Accurately reflects the current TAASD in use; \n(2) Identifies authorized software products, including business justification details;\n(3) Is at the level of granularity deemed necessary for tracking and reporting;\n(4) Includes organization-defined information deemed necessary to achieve effective property accountability; and\n(5) Is available for review and audit by designated organizational personnel.", "justification": "Asset Inventories (AST-04) provides overlapping security capability that compensates for the absence of Authorized To Connect (AST-10.1) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "AST-11", "risk_if_not_implemented": "Without Automated Unauthorized Component Detection, malicious, anomalous or unauthorized activity may go undetected or be detected too late to prevent or limit harm. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Modification / Loss of System Integrity (R-AM-2), Undetected / Delayed Detection of Adverse Activity (R-SA-1), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Technical / Mechanical Failure (MT-10), Data Quality Degradation / Data Poisoning (MT-12).", "compensating_control_1": { "control_id": "AST-09.2", "name": "Automated Network Asset Discovery", "description": "Mechanisms exist to automate network asset discovery through Software Defined Networking (SDN), or similar technologies, that analyzes network traffic to:\n(1) Identify;\n(2) Document; and \n(3) Track devices.", "justification": "Automated Network Asset Discovery (AST-09.2) provides network-level access restriction that compensates for the absence of Automated Unauthorized Component Detection (AST-11) by limiting attacker reach and lateral movement opportunities across the environment. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "MON-02", "name": "Continuous Monitoring", "description": "Mechanisms exist to facilitate the implementation of enterprise-wide monitoring controls.", "justification": "Continuous Monitoring (MON-02) provides detective monitoring capability that compensates for the absence of Automated Unauthorized Component Detection (AST-11) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "AST-12", "risk_if_not_implemented": "Without Prohibited Technology Assets, Applications and/or Services (TAAS), Technology Assets, Applications and/or Services (TAAS) may operate with insecure, unauthorized or drifted configurations that expand the attack surface. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Regulatory / Legal / Contractual Financial Liability (R-EX-5), Uncontrolled Third-Party Security / Privacy Exposure (R-GV-5), Third-Party Cybersecurity Compromise / Exposure (R-SC-1), Third-Party Legal / Compliance Exposure (R-SC-4), and most likely increases susceptibility to Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11), Foreign Ownership, Control, or Influence (FOCI) (MT-17), Sanctions / Trade Restriction Disruption (MT-19).", "compensating_control_1": { "control_id": "CFG-11", "name": "Software Usage Restrictions", "description": "Mechanisms exist to enforce software usage restrictions to comply with applicable contract agreements and copyright laws.", "justification": "Software Usage Restrictions (CFG-11) provides overlapping security capability that compensates for the absence of Prohibited Equipment & Services (AST-12) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "NET-03", "name": "Boundary Protection", "description": "Mechanisms exist to monitor and control communications at the external network boundary and at key internal boundaries within the network.", "justification": "Boundary Protection (NET-03) provides network-level access restriction that compensates for the absence of Prohibited Equipment & Services (AST-12) by limiting attacker reach and lateral movement opportunities across the environment. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "AST-13", "risk_if_not_implemented": "Without Software Licensing Restrictions, Technology Assets, Applications and/or Services (TAAS) may be unknown, untracked, lost, stolen or left unprotected because they are not inventoried. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Contractual Default / Termination (R-EX-2), Regulatory / Legal / Contractual Financial Liability (R-EX-5), Harm from Unauthorized / Unintended Product or Service Use (R-SC-5), and most likely increases susceptibility to Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11).", "compensating_control_1": { "control_id": "DCH-04", "name": "Data & Asset Classification", "description": "Mechanisms exist to ensure data and assets are categorized in accordance with applicable statutory, regulatory and contractual requirements.", "justification": "Data & Asset Classification (DCH-04) provides overlapping security capability that compensates for the absence of Software Licensing Restrictions (AST-13) by addressing related risk objectives through an alternative control mechanism aligned with Technology applicability. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "AST-15", "name": "Asset Categorization", "description": "Mechanisms exist to categorize Technology Assets, Applications and/or Services (TAAS).", "justification": "Asset Categorization (AST-15) provides overlapping security capability that compensates for the absence of Software Licensing Restrictions (AST-13) by addressing related risk objectives through an alternative control mechanism aligned with Technology applicability. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "AST-14", "risk_if_not_implemented": "Without Provenance, counterfeit, non-conforming or compromised components and services may enter the environment through the supply chain. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss of Accountability / Attribution (R-AC-1), Counterfeit / Non-Conforming Component Impact (R-SC-7), Loss of Authenticity / Provenance (R-IP-5), and most likely increases susceptibility to Human Error (MT-9), Data Quality Degradation / Data Poisoning (MT-12), Counterfeit / Non-Conforming Products (MT-20).", "compensating_control_1": { "control_id": "GOV-05", "name": "Assigned Security, Compliance & Resilience Responsibilities", "description": "Mechanisms exist to assign one or more qualified individuals with the mission and resources to centrally-manage, coordinate, develop, implement and maintain an enterprise-wide Security, Compliance & Resilience Program (SCRP).", "justification": "Assigned Security, Compliance & Resilience Responsibilities (GOV-05) provides resilience and recovery capability that compensates for the absence of Provenance (AST-14) by ensuring the organization can restore operations and data when the primary control is absent. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "HRS-04", "name": "Defined Roles & Responsibilities", "description": "Mechanisms exist to define cybersecurity roles & responsibilities for all personnel.", "justification": "Defined Roles & Responsibilities (HRS-04) provides overlapping security capability that compensates for the absence of Provenance (AST-14) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "AST-15", "risk_if_not_implemented": "Without Asset Categorization, Technology Assets, Applications and/or Services (TAAS) may be unknown, untracked, lost, stolen or left unprotected because they are not inventoried. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unaddressed Security / Compliance Exposure (R-GV-2), and most likely increases susceptibility to Human Error (MT-9).", "compensating_control_1": { "control_id": "DCH-04", "name": "Data & Asset Classification", "description": "Mechanisms exist to ensure data and assets are categorized in accordance with applicable statutory, regulatory and contractual requirements.", "justification": "Data & Asset Classification (DCH-04) provides overlapping security capability that compensates for the absence of Asset Categorization (AST-15) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "AST-04", "name": "Asset Inventories", "description": "Mechanisms exist to perform inventories of Technology Assets, Applications, Services and/or Data (TAASD) that:\n(1) Accurately reflects the current TAASD in use; \n(2) Identifies authorized software products, including business justification details;\n(3) Is at the level of granularity deemed necessary for tracking and reporting;\n(4) Includes organization-defined information deemed necessary to achieve effective property accountability; and\n(5) Is available for review and audit by designated organizational personnel.", "justification": "Asset Inventories (AST-04) provides overlapping security capability that compensates for the absence of Asset Categorization (AST-15) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "AST-15.1", "risk_if_not_implemented": "Without High-Risk Technology Assets, Applications and/or Services (TAAS) Categorization, Technology Assets, Applications and/or Services (TAAS) may be unknown, untracked, lost, stolen or left unprotected because they are not inventoried. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unaddressed Security / Compliance Exposure (R-GV-2), and most likely increases susceptibility to Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11).", "compensating_control_1": { "control_id": "DCH-04", "name": "Data & Asset Classification", "description": "Mechanisms exist to ensure data and assets are categorized in accordance with applicable statutory, regulatory and contractual requirements.", "justification": "Data & Asset Classification (DCH-04) provides overlapping security capability that compensates for the absence of High-Risk Asset Categorization (AST-15.1) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "MON-02", "name": "Continuous Monitoring", "description": "Mechanisms exist to facilitate the implementation of enterprise-wide monitoring controls.", "justification": "Continuous Monitoring (MON-02) provides detective monitoring capability that compensates for the absence of High-Risk Asset Categorization (AST-15.1) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "AST-15.2", "risk_if_not_implemented": "Without Categorize Artificial Intelligence (AI)-Related Technology Assets, Applications and/or Services (TAAS), AI and autonomous systems may produce unreliable, biased or unsafe outputs, act outside authorized scope, or expose sensitive data. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unaddressed Security / Compliance Exposure (R-GV-2), Sensitive Data / Compliance Exposure from Unsanctioned AI Use (R-AI-4), and most likely increases susceptibility to Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11).", "compensating_control_1": { "control_id": "AST-04", "name": "Asset Inventories", "description": "Mechanisms exist to perform inventories of Technology Assets, Applications, Services and/or Data (TAASD) that:\n(1) Accurately reflects the current TAASD in use; \n(2) Identifies authorized software products, including business justification details;\n(3) Is at the level of granularity deemed necessary for tracking and reporting;\n(4) Includes organization-defined information deemed necessary to achieve effective property accountability; and\n(5) Is available for review and audit by designated organizational personnel.", "justification": "Asset Inventories (AST-04) provides overlapping security capability that compensates for the absence of Categorize Artificial Intelligence (AI)-Related Technologies (AST-15.2) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "DCH-04", "name": "Data & Asset Classification", "description": "Mechanisms exist to ensure data and assets are categorized in accordance with applicable statutory, regulatory and contractual requirements.", "justification": "Data & Asset Classification (DCH-04) provides overlapping security capability that compensates for the absence of Categorize Artificial Intelligence (AI)-Related Technologies (AST-15.2) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "AST-15.3", "risk_if_not_implemented": "Without Asset Attributes, Technology Assets, Applications and/or Services (TAAS) may be unknown, untracked, lost, stolen or left unprotected because they are not inventoried. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Excessive or Unauthorized Privilege (R-AC-2), Unauthorized Access (R-AC-4), and most likely increases susceptibility to Human Error (MT-9), Technical / Mechanical Failure (MT-10), Data Quality Degradation / Data Poisoning (MT-12).", "compensating_control_1": { "control_id": "AST-15", "name": "Asset Categorization", "description": "Mechanisms exist to categorize Technology Assets, Applications and/or Services (TAAS).", "justification": "Asset Categorization (AST-15) provides overlapping security capability that compensates for the absence of Asset Attributes (AST-15.3) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "DCH-04", "name": "Data & Asset Classification", "description": "Mechanisms exist to ensure data and assets are categorized in accordance with applicable statutory, regulatory and contractual requirements.", "justification": "Data & Asset Classification (DCH-04) provides overlapping security capability that compensates for the absence of Asset Attributes (AST-15.3) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "AST-16", "risk_if_not_implemented": "Without Asset Scope Classification, Technology Assets, Applications and/or Services (TAAS) may be unknown, untracked, lost, stolen or left unprotected because they are not inventoried. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unaddressed Security / Compliance Exposure (R-GV-2), and most likely increases susceptibility to Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11).", "compensating_control_1": { "control_id": "NET-06", "name": "Network Segmentation (macrosegmentation)", "description": "Mechanisms exist to implement network segmentation within network architectures to isolate Technology Assets, Applications and/or Services (TAAS) from other network resources.", "justification": "Network Segmentation (macrosegmentation) (NET-06) provides network-level access restriction that compensates for the absence of Asset Scope Classification (AST-16) by limiting attacker reach and lateral movement opportunities across the environment. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "AST-17", "name": "Network Diagrams & Data Flow Diagrams (DFDs)", "description": "Mechanisms exist to maintain network architecture diagrams that: \n(1) Contain sufficient detail to assess the security of the network's architecture;\n(2) Reflect the current architecture of the network environment; and\n(3) Document all sensitive and/or regulated data flows.", "justification": "Network Diagrams & Data Flow Diagrams (DFDs) (AST-17) provides network-level access restriction that compensates for the absence of Asset Scope Classification (AST-16) by limiting attacker reach and lateral movement opportunities across the environment. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "AST-16.1", "risk_if_not_implemented": "Without Compliance-Specific Asset Identification, the organization may fail to meet statutory, regulatory or contractual obligations, or be unable to demonstrate conformity when required. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unaddressed Security / Compliance Exposure (R-GV-2), Inability to Demonstrate Due Diligence / Due Care (R-GV-9), and most likely increases susceptibility to Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11), Data Quality Degradation / Data Poisoning (MT-12).", "compensating_control_1": { "control_id": "AST-17", "name": "Network Diagrams & Data Flow Diagrams (DFDs)", "description": "Mechanisms exist to maintain network architecture diagrams that: \n(1) Contain sufficient detail to assess the security of the network's architecture;\n(2) Reflect the current architecture of the network environment; and\n(3) Document all sensitive and/or regulated data flows.", "justification": "Network Diagrams & Data Flow Diagrams (DFDs) (AST-17) provides network-level access restriction that compensates for the absence of Compliance-Specific Asset Identification (AST-16.1) by limiting attacker reach and lateral movement opportunities across the environment. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "NET-06", "name": "Network Segmentation (macrosegmentation)", "description": "Mechanisms exist to implement network segmentation within network architectures to isolate Technology Assets, Applications and/or Services (TAAS) from other network resources.", "justification": "Network Segmentation (macrosegmentation) (NET-06) provides network-level access restriction that compensates for the absence of Compliance-Specific Asset Identification (AST-16.1) by limiting attacker reach and lateral movement opportunities across the environment. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "AST-17.1", "risk_if_not_implemented": "Without Control Applicability Boundary Graphical Representation, adversaries may move laterally, exfiltrate data or reach systems that should have been isolated from untrusted networks. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unaddressed Security / Compliance Exposure (R-GV-2), Inability to Demonstrate Due Diligence / Due Care (R-GV-9), Unreliable Assurance / Decision Information (R-GV-10), and most likely increases susceptibility to Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11), Data Quality Degradation / Data Poisoning (MT-12).", "compensating_control_1": { "control_id": "NET-02", "name": "Network Security Controls (NSC)", "description": "Mechanisms exist to develop, govern & update procedures to facilitate the implementation of Network Security Controls (NSC).", "justification": "Network Security Controls (NSC) (NET-02) provides network-level access restriction that compensates for the absence of Control Applicability Boundary Graphical Representation (AST-17.1) by limiting attacker reach and lateral movement opportunities across the environment. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "AST-17", "name": "Network Diagrams & Data Flow Diagrams (DFDs)", "description": "Mechanisms exist to maintain network architecture diagrams that: \n(1) Contain sufficient detail to assess the security of the network's architecture;\n(2) Reflect the current architecture of the network environment; and\n(3) Document all sensitive and/or regulated data flows.", "justification": "Network Diagrams & Data Flow Diagrams (DFDs) (AST-17) provides network-level access restriction that compensates for the absence of Control Applicability Boundary Graphical Representation (AST-17.1) by limiting attacker reach and lateral movement opportunities across the environment. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "AST-17.2", "risk_if_not_implemented": "Without Data Action Mapping, Technology Assets, Applications and/or Services (TAAS) may be unknown, untracked, lost, stolen or left unprotected because they are not inventoried. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Retention / Inability to Dispose of Data (R-AM-3), Unaddressed Security / Compliance Exposure (R-GV-2), Inability to Demonstrate Due Diligence / Due Care (R-GV-9), and most likely increases susceptibility to Human Error (MT-9), Data Quality Degradation / Data Poisoning (MT-12).", "compensating_control_1": { "control_id": "AST-09.2", "name": "Automated Network Asset Discovery", "description": "Mechanisms exist to automate network asset discovery through Software Defined Networking (SDN), or similar technologies, that analyzes network traffic to:\n(1) Identify;\n(2) Document; and \n(3) Track devices.", "justification": "Automated Network Asset Discovery (AST-09.2) provides network-level access restriction that compensates for the absence of Data Action Mapping (AST-17.2) by limiting attacker reach and lateral movement opportunities across the environment. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "AST-04", "name": "Asset Inventories", "description": "Mechanisms exist to perform inventories of Technology Assets, Applications, Services and/or Data (TAASD) that:\n(1) Accurately reflects the current TAASD in use; \n(2) Identifies authorized software products, including business justification details;\n(3) Is at the level of granularity deemed necessary for tracking and reporting;\n(4) Includes organization-defined information deemed necessary to achieve effective property accountability; and\n(5) Is available for review and audit by designated organizational personnel.", "justification": "Asset Inventories (AST-04) provides overlapping security capability that compensates for the absence of Data Action Mapping (AST-17.2) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "AST-18", "risk_if_not_implemented": "Without Security of Assets & Media, sensitive and/or regulated data may be disclosed, altered or lost through inadequate classification, handling or protection. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Access (R-AC-4), Loss, Theft or Damage of Assets (R-AM-1), Unauthorized Modification / Loss of System Integrity (R-AM-2), Loss of Confidentiality (R-IP-2), Loss of Data Integrity (R-IP-3), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Physical Crime (MT-5), Human Error (MT-9).", "compensating_control_1": { "control_id": "PES-02", "name": "Physical & Environmental Protections", "description": "Mechanisms exist to facilitate the operation of physical and environmental protection controls.", "justification": "Physical & Environmental Protections (PES-02) provides physical access control that compensates for the absence of Security of Assets & Media (AST-18) by preventing unauthorized physical interaction with systems and infrastructure. Given the data-handling focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "DCH-13", "name": "Media Storage", "description": "Mechanisms exist to: \n(1) Physically control and securely store digital and non-digital media within controlled areas using organization-defined security measures; and\n(2) Protect system media until the media are destroyed or sanitized using approved equipment, techniques and procedures.", "justification": "Media Storage (DCH-13) provides overlapping security capability that compensates for the absence of Security of Assets & Media (AST-18) by addressing related risk objectives through an alternative control mechanism aligned with Data applicability. Given the data-handling focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "AST-18.1", "risk_if_not_implemented": "Without Management Approval For External Media Transfer, sensitive and/or regulated data may be disclosed, altered or lost through inadequate classification, handling or protection. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss of Confidentiality (R-IP-2), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Fraud, Corruption and/or Intentional Criminal Conduct (MT-14), Conflict of Interest (COI) / Undue Influence / Insider Misconduct (MT-15).", "compensating_control_1": { "control_id": "PES-08", "name": "Physical Access Control", "description": "Physical access control mechanisms exist to enforce physical access authorizations for all physical access points (including designated entry/exit points) to facilities (excluding those areas within the facility officially designated as publicly accessible).", "justification": "Physical Access Control (PES-08) provides access control enforcement that compensates for the absence of Management Approval For External Media Transfer (AST-18.1) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "DCH-13", "name": "Media Storage", "description": "Mechanisms exist to: \n(1) Physically control and securely store digital and non-digital media within controlled areas using organization-defined security measures; and\n(2) Protect system media until the media are destroyed or sanitized using approved equipment, techniques and procedures.", "justification": "Media Storage (DCH-13) provides overlapping security capability that compensates for the absence of Management Approval For External Media Transfer (AST-18.1) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "AST-19", "risk_if_not_implemented": "Without Technology Assets, Applications, Services and/or Data (TAASD) Storage, Technology Assets, Applications and/or Services (TAAS) may be unknown, untracked, lost, stolen or left unprotected because they are not inventoried. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Access (R-AC-4), Loss, Theft or Damage of Assets (R-AM-1), and most likely increases susceptibility to natural threats NT-2, NT-3, NT-4, NT-5, NT-6, NT-8, NT-11, NT-12, NT-13, NT-14; Physical Crime (MT-5), Terrorism & Armed Attacks (MT-6), Human Error (MT-9), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "PES-08", "name": "Physical Access Control", "description": "Physical access control mechanisms exist to enforce physical access authorizations for all physical access points (including designated entry/exit points) to facilities (excluding those areas within the facility officially designated as publicly accessible).", "justification": "Physical Access Control (PES-08) provides access control enforcement that compensates for the absence of Technology Assets, Applications, Services and/or Data (TAASD) Storage (AST-19) by restricting system and data access through alternative identity and access management mechanisms. Given the facility and physical environment focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "PES-14", "name": "Visitor Control", "description": "Physical access control mechanisms exist to identify, authorize and monitor visitors before allowing access to the facility (other than areas designated as publicly accessible).", "justification": "Visitor Control (PES-14) provides physical access control that compensates for the absence of Technology Assets, Applications, Services and/or Data (TAASD) Storage (AST-19) by preventing unauthorized physical interaction with systems and infrastructure. Given the facility and physical environment focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "AST-19.1", "risk_if_not_implemented": "Without Temporary Asset Storage In Automobiles, mobile and portable devices may expose organizational data through loss, theft, insecure configuration or unauthorized use. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss, Theft or Damage of Assets (R-AM-1), Lack of a security-minded workforce (R-SA-2), and most likely increases susceptibility to Physical Crime (MT-5), Human Error (MT-9).", "compensating_control_1": { "control_id": "CFG-04.3", "name": "Session Lock", "description": "Mechanisms exist to initiate a session lock after an organization-defined time period of inactivity, or upon receiving a request from a user and retain the session lock until the user reestablishes access using established identification and authentication methods.", "justification": "Session Lock (CFG-04.3) provides overlapping security capability that compensates for the absence of Asset Storage In Automobiles (AST-19.1) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "PES-08", "name": "Physical Access Control", "description": "Physical access control mechanisms exist to enforce physical access authorizations for all physical access points (including designated entry/exit points) to facilities (excluding those areas within the facility officially designated as publicly accessible).", "justification": "Physical Access Control (PES-08) provides access control enforcement that compensates for the absence of Asset Storage In Automobiles (AST-19.1) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "AST-20", "risk_if_not_implemented": "Without Unattended End-User Equipment, Technology Assets, Applications and/or Services (TAAS) may be unknown, untracked, lost, stolen or left unprotected because they are not inventoried. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Access (R-AC-4), Unauthorized Modification / Loss of System Integrity (R-AM-2), and most likely increases susceptibility to Physical Crime (MT-5), Human Error (MT-9).", "compensating_control_1": { "control_id": "PES-08", "name": "Physical Access Control", "description": "Physical access control mechanisms exist to enforce physical access authorizations for all physical access points (including designated entry/exit points) to facilities (excluding those areas within the facility officially designated as publicly accessible).", "justification": "Physical Access Control (PES-08) provides access control enforcement that compensates for the absence of Unattended End-User Equipment (AST-20) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CFG-04.3", "name": "Session Lock", "description": "Mechanisms exist to initiate a session lock after an organization-defined time period of inactivity, or upon receiving a request from a user and retain the session lock until the user reestablishes access using established identification and authentication methods.", "justification": "Session Lock (CFG-04.3) provides overlapping security capability that compensates for the absence of Unattended End-User Equipment (AST-20) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "AST-21", "risk_if_not_implemented": "Without Kiosks & Point of Interaction (PoI) Devices, mobile and portable devices may expose organizational data through loss, theft, insecure configuration or unauthorized use. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Modification / Loss of System Integrity (R-AM-2), System / Data Compromise (Non-Technical Vector) (R-BC-5), Loss of Confidentiality (R-IP-2), and most likely increases susceptibility to Physical Crime (MT-5), Fraud, Corruption and/or Intentional Criminal Conduct (MT-14), Counterfeit / Non-Conforming Products (MT-20).", "compensating_control_1": { "control_id": "PES-08", "name": "Physical Access Control", "description": "Physical access control mechanisms exist to enforce physical access authorizations for all physical access points (including designated entry/exit points) to facilities (excluding those areas within the facility officially designated as publicly accessible).", "justification": "Physical Access Control (PES-08) provides access control enforcement that compensates for the absence of Kiosks & Point of Interaction (PoI) Devices (AST-21) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CFG-03", "name": "Least Functionality", "description": "Mechanisms exist to configure Technology Assets, Applications and/or Services (TAAS) to provide only essential capabilities by specifically prohibiting or restricting the use of ports, protocols, and/or services.", "justification": "Least Functionality (CFG-03) provides configuration hardening that compensates for the absence of Kiosks & Point of Interaction (PoI) Devices (AST-21) by eliminating unnecessary services and enforcing secure settings to reduce inherent exposure. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "AST-23", "risk_if_not_implemented": "Without Return of Assets, Technology Assets, Applications and/or Services (TAAS) may be unknown, untracked, lost, stolen or left unprotected because they are not inventoried. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss, Theft or Damage of Assets (R-AM-1), and most likely increases susceptibility to Human Error (MT-9).", "compensating_control_1": { "control_id": "AST-07.1", "name": "Technology Assets, Applications, Services and/or Data (TAASD) Ownership Assignment", "description": "Mechanisms exist to ensure Technology Assets, Applications, Services and/or Data (TAASD) ownership responsibilities are assigned, tracked and managed at a team, individual, or responsible organization level to establish a common understanding of requirements for asset protection.", "justification": "Technology Assets, Applications, Services and/or Data (TAASD) Ownership Assignment (AST-07.1) provides overlapping security capability that compensates for the absence of Return of Assets (AST-23) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "AST-04", "name": "Asset Inventories", "description": "Mechanisms exist to perform inventories of Technology Assets, Applications, Services and/or Data (TAASD) that:\n(1) Accurately reflects the current TAASD in use; \n(2) Identifies authorized software products, including business justification details;\n(3) Is at the level of granularity deemed necessary for tracking and reporting;\n(4) Includes organization-defined information deemed necessary to achieve effective property accountability; and\n(5) Is available for review and audit by designated organizational personnel.", "justification": "Asset Inventories (AST-04) provides overlapping security capability that compensates for the absence of Return of Assets (AST-23) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "AST-24", "risk_if_not_implemented": "Without Removal of Assets, Technology Assets, Applications and/or Services (TAAS) may be unknown, untracked, lost, stolen or left unprotected because they are not inventoried. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss of Accountability / Attribution (R-AC-1), Loss, Theft or Damage of Assets (R-AM-1), and most likely increases susceptibility to Physical Crime (MT-5), Human Error (MT-9).", "compensating_control_1": { "control_id": "AST-04", "name": "Asset Inventories", "description": "Mechanisms exist to perform inventories of Technology Assets, Applications, Services and/or Data (TAASD) that:\n(1) Accurately reflects the current TAASD in use; \n(2) Identifies authorized software products, including business justification details;\n(3) Is at the level of granularity deemed necessary for tracking and reporting;\n(4) Includes organization-defined information deemed necessary to achieve effective property accountability; and\n(5) Is available for review and audit by designated organizational personnel.", "justification": "Asset Inventories (AST-04) provides overlapping security capability that compensates for the absence of Removal of Assets (AST-24) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "PES-15", "name": "Delivery & Removal", "description": "Physical security mechanisms exist to isolate information processing facilities from points such as delivery and loading areas and other points to avoid unauthorized access.", "justification": "Delivery & Removal (PES-15) provides overlapping security capability that compensates for the absence of Removal of Assets (AST-24) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "AST-26", "risk_if_not_implemented": "Without Use of Third-Party Devices, supplier and External Service Provider (ESP) weaknesses, incidents or failures may propagate into the organization's environment unmanaged. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Access (R-AC-4), System / Data Compromise (Technical Vector) (R-BC-4), Uncontrolled Third-Party Security / Privacy Exposure (R-GV-5), Third-Party Cybersecurity Compromise / Exposure (R-SC-1), Loss of Confidentiality (R-IP-2), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "TPM-13", "name": "Third-Party Personnel Security", "description": "Mechanisms exist to control personnel security requirements including security roles and responsibilities for third-party providers.", "justification": "Third-Party Personnel Security (TPM-13) provides third-party oversight that compensates for the absence of Use of Third-Party Devices (AST-26) by extending security obligations contractually and monitoring third-party risk in lieu of direct control. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "IAC-33", "name": "Identification & Authentication for Non-Organizational Users", "description": "Mechanisms exist to uniquely identify and centrally Authenticate, Authorize and Audit (AAA) third-party users and processes that provide services to the organization.", "justification": "Identification & Authentication for Non-Organizational Users (IAC-33) provides access control enforcement that compensates for the absence of Use of Third-Party Devices (AST-26) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "AST-28", "risk_if_not_implemented": "Without Usage Parameters, Technology Assets, Applications and/or Services (TAAS) may be unknown, untracked, lost, stolen or left unprotected because they are not inventoried. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Modification / Loss of System Integrity (R-AM-2), Undetected / Delayed Detection of Adverse Activity (R-SA-1), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "CFG-03", "name": "Least Functionality", "description": "Mechanisms exist to configure Technology Assets, Applications and/or Services (TAAS) to provide only essential capabilities by specifically prohibiting or restricting the use of ports, protocols, and/or services.", "justification": "Least Functionality (CFG-03) provides configuration hardening that compensates for the absence of Usage Parameters (AST-28) by eliminating unnecessary services and enforcing secure settings to reduce inherent exposure. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "IAC-25", "name": "Access Enforcement", "description": "Mechanisms exist to enforce Logical Access Control (LAC) permissions that conform to the principle of \"least privilege.\"", "justification": "Access Enforcement (IAC-25) provides access control enforcement that compensates for the absence of Usage Parameters (AST-28) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "AST-29", "risk_if_not_implemented": "Without Technology Asset Inspections, Technology Assets, Applications and/or Services (TAAS) may be unknown, untracked, lost, stolen or left unprotected because they are not inventoried. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Modification / Loss of System Integrity (R-AM-2), Undetected / Delayed Detection of Adverse Activity (R-SA-1), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Physical Crime (MT-5), Dysfunctional Management Practices (MT-8), Human Error (MT-9), Fraud, Corruption and/or Intentional Criminal Conduct (MT-14).", "compensating_control_1": { "control_id": "CRY-02", "name": "Use of Cryptographic Controls", "description": "Mechanisms exist to facilitate the implementation of cryptographic protections controls using known public standards and trusted cryptographic technologies.", "justification": "Use of Cryptographic Controls (CRY-02) provides cryptographic protection that compensates for the absence of Technology Asset Inspections (AST-29) by ensuring data confidentiality and integrity through alternative technical means. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "MON-02", "name": "Continuous Monitoring", "description": "Mechanisms exist to facilitate the implementation of enterprise-wide monitoring controls.", "justification": "Continuous Monitoring (MON-02) provides detective monitoring capability that compensates for the absence of Technology Asset Inspections (AST-29) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "AST-29.1", "risk_if_not_implemented": "Without Physical Tampering Detection, counterfeit, non-conforming or compromised components and services may enter the environment through the supply chain. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Modification / Loss of System Integrity (R-AM-2), Undetected / Delayed Detection of Adverse Activity (R-SA-1), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Physical Crime (MT-5), Dysfunctional Management Practices (MT-8), Human Error (MT-9), Fraud, Corruption and/or Intentional Criminal Conduct (MT-14).", "compensating_control_1": { "control_id": "PES-13", "name": "Monitoring Physical Access", "description": "Physical access control mechanisms exist to monitor for, detect and respond to physical security incidents.", "justification": "Monitoring Physical Access (PES-13) provides detective monitoring capability that compensates for the absence of Physical Tampering Detection (AST-29.1) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "MON-02", "name": "Continuous Monitoring", "description": "Mechanisms exist to facilitate the implementation of enterprise-wide monitoring controls.", "justification": "Continuous Monitoring (MON-02) provides detective monitoring capability that compensates for the absence of Physical Tampering Detection (AST-29.1) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "AST-29.2", "risk_if_not_implemented": "Without Logical Tampering Protection, counterfeit, non-conforming or compromised components and services may enter the environment through the supply chain. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Modification / Loss of System Integrity (R-AM-2), Undetected / Delayed Detection of Adverse Activity (R-SA-1), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Physical Crime (MT-5), Dysfunctional Management Practices (MT-8), Human Error (MT-9), Fraud, Corruption and/or Intentional Criminal Conduct (MT-14).", "compensating_control_1": { "control_id": "CFG-08.2", "name": "Integrity Assurance & Enforcement (IAE)", "description": "Automated mechanisms exist to:\n(1) Identify unauthorized deviations from an approved secure baseline configuration; and\n(2) Implement automated resiliency actions to remediate the unauthorized change.", "justification": "Integrity Assurance & Enforcement (IAE) (CFG-08.2) provides configuration hardening that compensates for the absence of Logical Tampering Protection (AST-29.2) by eliminating unnecessary services and enforcing secure settings to reduce inherent exposure. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "MON-02", "name": "Continuous Monitoring", "description": "Mechanisms exist to facilitate the implementation of enterprise-wide monitoring controls.", "justification": "Continuous Monitoring (MON-02) provides detective monitoring capability that compensates for the absence of Logical Tampering Protection (AST-29.2) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "AST-30", "risk_if_not_implemented": "Without Roots of Trust Protection, Technology Assets, Applications and/or Services (TAAS) may be unknown, untracked, lost, stolen or left unprotected because they are not inventoried. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Modification / Loss of System Integrity (R-AM-2), Loss of Confidentiality (R-IP-2), Loss of Authenticity / Provenance (R-IP-5), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9), Technical / Mechanical Failure (MT-10), Cryptographic Compromise / Cryptanalytic Capability Advancement (MT-31).", "compensating_control_1": { "control_id": "CFG-08.2", "name": "Integrity Assurance & Enforcement (IAE)", "description": "Automated mechanisms exist to:\n(1) Identify unauthorized deviations from an approved secure baseline configuration; and\n(2) Implement automated resiliency actions to remediate the unauthorized change.", "justification": "Integrity Assurance & Enforcement (IAE) (CFG-08.2) provides configuration hardening that compensates for the absence of Roots of Trust Protection (AST-30) by eliminating unnecessary services and enforcing secure settings to reduce inherent exposure. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "MON-02", "name": "Continuous Monitoring", "description": "Mechanisms exist to facilitate the implementation of enterprise-wide monitoring controls.", "justification": "Continuous Monitoring (MON-02) provides detective monitoring capability that compensates for the absence of Roots of Trust Protection (AST-30) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "AST-31", "risk_if_not_implemented": "Without Telecommunications Equipment, Technology Assets, Applications and/or Services (TAAS) may be unknown, untracked, lost, stolen or left unprotected because they are not inventoried. Based on the risk and threat mapping for this control, no risk is rated Likely; risks rated Possible include Unauthorized Access (R-AC-4), Loss, Theft or Damage of Assets (R-AM-1), Unauthorized Modification / Loss of System Integrity (R-AM-2), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9).", "compensating_control_1": { "control_id": "NET-24", "name": "Wireless Networking", "description": "Mechanisms exist to control authorized wireless usage and monitor for unauthorized wireless access.", "justification": "Wireless Networking (NET-24) provides network-level access restriction that compensates for the absence of Telecommunications Equipment (AST-31) by limiting attacker reach and lateral movement opportunities across the environment. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "PES-02", "name": "Physical & Environmental Protections", "description": "Mechanisms exist to facilitate the operation of physical and environmental protection controls.", "justification": "Physical & Environmental Protections (PES-02) provides physical access control that compensates for the absence of Telecommunications Equipment (AST-31) by preventing unauthorized physical interaction with systems and infrastructure. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "AST-32", "risk_if_not_implemented": "Without Travel-Only Devices, mobile and portable devices may expose organizational data through loss, theft, insecure configuration or unauthorized use. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Intellectual Property / Trade Secret Loss (R-EX-9), Loss of Confidentiality (R-IP-2), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Geopolitical Conflict / Government Intervention (MT-18).", "compensating_control_1": { "control_id": "MDM-02", "name": "Centralized Management Of Mobile Devices", "description": "Mechanisms exist to implement and govern Mobile Device Management (MDM) controls.", "justification": "Centralized Management Of Mobile Devices (MDM-02) provides overlapping security capability that compensates for the absence of Travel-Only Devices (AST-32) by addressing related risk objectives through an alternative control mechanism aligned with Technology applicability. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CFG-04", "name": "Secure Baseline Configurations", "description": "Mechanisms exist to develop, document and maintain secure baseline configurations for Technology Assets, Applications and/or Services (TAAS) that are consistent with industry-accepted hardening standards.", "justification": "Secure Baseline Configurations (CFG-04) provides configuration hardening that compensates for the absence of Travel-Only Devices (AST-32) by eliminating unnecessary services and enforcing secure settings to reduce inherent exposure. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "AST-33", "risk_if_not_implemented": "Without Re-Imaging Devices After Travel, mobile and portable devices may expose organizational data through loss, theft, insecure configuration or unauthorized use. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Modification / Loss of System Integrity (R-AM-2), System / Data Compromise (Technical Vector) (R-BC-4), Incident Persistence / Recurrence (R-IR-3), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Dysfunctional Management Practices (MT-8), Human Error (MT-9).", "compensating_control_1": { "control_id": "CFG-04", "name": "Secure Baseline Configurations", "description": "Mechanisms exist to develop, document and maintain secure baseline configurations for Technology Assets, Applications and/or Services (TAAS) that are consistent with industry-accepted hardening standards.", "justification": "Secure Baseline Configurations (CFG-04) provides configuration hardening that compensates for the absence of Re-Imaging Devices After Travel (AST-33) by eliminating unnecessary services and enforcing secure settings to reduce inherent exposure. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "END-03", "name": "Endpoint Protection Mechanisms", "description": "Mechanisms exist to protect the confidentiality, integrity, availability and safety of endpoint devices.", "justification": "Endpoint Protection Mechanisms (END-03) provides overlapping security capability that compensates for the absence of Re-Imaging Devices After Travel (AST-33) by addressing related risk objectives through an alternative control mechanism aligned with Technology applicability. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "AST-34", "risk_if_not_implemented": "Without Jump Server, Technology Assets, Applications and/or Services (TAAS) may be unknown, untracked, lost, stolen or left unprotected because they are not inventoried. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Access (R-AC-4), System / Data Compromise (Technical Vector) (R-BC-4), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "IAC-10", "name": "Privileged Account Management (PAM)", "description": "Mechanisms exist to restrict and control privileged access rights for users and Technology Assets, Applications and/or Services (TAAS).", "justification": "Privileged Account Management (PAM) (IAC-10) provides access control enforcement that compensates for the absence of Jump Server (AST-34) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "MON-18.1", "name": "Session Audit", "description": "Mechanisms exist to provide session audit capabilities that can: \n(1) Capture and log all content related to a user session; and\n(2) Remotely view all content related to an established user session in real time.", "justification": "Session Audit (MON-18.1) provides detective monitoring capability that compensates for the absence of Jump Server (AST-34) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "AST-35", "risk_if_not_implemented": "Without Database Management System (DBMS), Technology Assets, Applications and/or Services (TAAS) may be unknown, untracked, lost, stolen or left unprotected because they are not inventoried. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Data Loss / Integrity Compromise (R-BC-2), Loss of Data Integrity (R-IP-3), Loss of Data / Service Availability (R-IP-4), and most likely increases susceptibility to Human Error (MT-9), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "MON-18.1", "name": "Session Audit", "description": "Mechanisms exist to provide session audit capabilities that can: \n(1) Capture and log all content related to a user session; and\n(2) Remotely view all content related to an established user session in real time.", "justification": "Session Audit (MON-18.1) provides detective monitoring capability that compensates for the absence of Database Management System (DBMS) (AST-35) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "IAC-10", "name": "Privileged Account Management (PAM)", "description": "Mechanisms exist to restrict and control privileged access rights for users and Technology Assets, Applications and/or Services (TAAS).", "justification": "Privileged Account Management (PAM) (IAC-10) provides access control enforcement that compensates for the absence of Database Management System (DBMS) (AST-35) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "AST-36", "risk_if_not_implemented": "Without Decommissioning, sensitive and/or regulated data may be retained beyond authorized periods or recovered from improperly disposed media and equipment. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Retention / Inability to Dispose of Data (R-AM-3), Data Loss / Integrity Compromise (R-BC-2), Loss of Confidentiality (R-IP-2), and most likely increases susceptibility to Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11).", "compensating_control_1": { "control_id": "AST-22", "name": "Secure Disposal, Destruction or Re-Use of Equipment", "description": "Mechanisms exist to securely dispose of, destroy or repurpose technology assets using organization-defined techniques and methods to prevent:\n(1) Data recovery; and\n(2) Components from being resold, redistributed and/or reused through unauthorized channels.", "justification": "Secure Disposal, Destruction or Re-Use of Equipment (AST-22) provides overlapping security capability that compensates for the absence of Decommissioning (AST-36) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "AST-04", "name": "Asset Inventories", "description": "Mechanisms exist to perform inventories of Technology Assets, Applications, Services and/or Data (TAASD) that:\n(1) Accurately reflects the current TAASD in use; \n(2) Identifies authorized software products, including business justification details;\n(3) Is at the level of granularity deemed necessary for tracking and reporting;\n(4) Includes organization-defined information deemed necessary to achieve effective property accountability; and\n(5) Is available for review and audit by designated organizational personnel.", "justification": "Asset Inventories (AST-04) provides overlapping security capability that compensates for the absence of Decommissioning (AST-36) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "AST-37", "risk_if_not_implemented": "Without Technology Lifecycle Management, Technology Assets, Applications and/or Services (TAAS) may be unknown, untracked, lost, stolen or left unprotected because they are not inventoried. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Exposure from Unaddressed Vulnerabilities (R-EX-6), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9).", "compensating_control_1": { "control_id": "RSK-13", "name": "Risk Assessment", "description": "Mechanisms exist to conduct recurring assessments of risk that includes the likelihood and magnitude of harm, from unauthorized access, use, disclosure, disruption, modification or destruction of the organization's Technology Assets, Applications, Services and/or Data (TAASD).", "justification": "Risk Assessment (RSK-13) provides periodic assessment and assurance that compensates for the absence of Technology Lifecycle Management (AST-37) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "BCD-02", "name": "Business Continuity Management System (BCMS)", "description": "Mechanisms exist to operate a Business Continuity Management System (BCMS) to achieve resilient Technology Assets, Applications, Services and/or Data (TAASD) during:\n(1) Routine operations; and\n(2) Adverse conditions.", "justification": "Business Continuity Management System (BCMS) (BCD-02) provides resilience and recovery capability that compensates for the absence of Technology Lifecycle Management (AST-37) by ensuring the organization can restore operations and data when the primary control is absent. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "AST-37.1", "risk_if_not_implemented": "Without Stable Versions, Technology Assets, Applications and/or Services (TAAS) may be unknown, untracked, lost, stolen or left unprotected because they are not inventoried. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Exposure from Unaddressed Vulnerabilities (R-EX-6), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9).", "compensating_control_1": { "control_id": "MON-02", "name": "Continuous Monitoring", "description": "Mechanisms exist to facilitate the implementation of enterprise-wide monitoring controls.", "justification": "Continuous Monitoring (MON-02) provides detective monitoring capability that compensates for the absence of Stable Versions (AST-37.1) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "VPM-08", "name": "Software & Firmware Patching", "description": "Mechanisms exist to conduct software patching for all deployed Technology Assets, Applications and/or Services (TAAS), including firmware.", "justification": "Software & Firmware Patching (VPM-08) provides vulnerability management that compensates for the absence of Stable Versions (AST-37.1) by reducing the exploitable attack surface by addressing known weaknesses before they are leveraged. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "AST-37.2", "risk_if_not_implemented": "Without Removal of Previous Versions, Technology Assets, Applications and/or Services (TAAS) may be unknown, untracked, lost, stolen or left unprotected because they are not inventoried. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Exposure from Unaddressed Vulnerabilities (R-EX-6), and most likely increases susceptibility to Human Error (MT-9).", "compensating_control_1": { "control_id": "CFG-04", "name": "Secure Baseline Configurations", "description": "Mechanisms exist to develop, document and maintain secure baseline configurations for Technology Assets, Applications and/or Services (TAAS) that are consistent with industry-accepted hardening standards.", "justification": "Secure Baseline Configurations (CFG-04) provides configuration hardening that compensates for the absence of Removal of Previous Versions (AST-37.2) by eliminating unnecessary services and enforcing secure settings to reduce inherent exposure. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "VPM-12", "name": "Vulnerability Scanning", "description": "Mechanisms exist to detect vulnerabilities and configuration errors by routine vulnerability scanning of systems and applications.", "justification": "Vulnerability Scanning (VPM-12) provides vulnerability management that compensates for the absence of Removal of Previous Versions (AST-37.2) by reducing the exploitable attack surface by addressing known weaknesses before they are leveraged. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "AST-38", "risk_if_not_implemented": "Without Technical Debt Reviews, Technology Assets, Applications and/or Services (TAAS) may be unknown, untracked, lost, stolen or left unprotected because they are not inventoried. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Exposure from Unaddressed Vulnerabilities (R-EX-6), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9).", "compensating_control_1": { "control_id": "SEA-05", "name": "Secure Engineering Principles", "description": "Mechanisms exist to facilitate the implementation of industry-recognized security, compliance and resilience practices in the specification, design, development, implementation and modification of Technology Assets, Applications and/or Services (TAAS).", "justification": "Secure Engineering Principles (SEA-05) provides overlapping security capability that compensates for the absence of Technical Debt Reviews (AST-38) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "SEA-04", "name": "Alignment With Enterprise Architecture", "description": "Mechanisms exist to develop an enterprise architecture, aligned with industry-recognized leading practices, with consideration for security, compliance and resilience principles that addresses risk to organizational operations, assets, individuals and other organizations.", "justification": "Alignment With Enterprise Architecture (SEA-04) provides overlapping security capability that compensates for the absence of Technical Debt Reviews (AST-38) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "AST-39.1", "risk_if_not_implemented": "Without Alternate Sources for Continued Support, Technology Assets, Applications and/or Services (TAAS) may be unknown, untracked, lost, stolen or left unprotected because they are not inventoried. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Exposure from Unaddressed Vulnerabilities (R-EX-6), Concentration / Single-Point Dependency Failure (R-OR-2), Third-Party Dependency Failure (R-SC-6), and most likely increases susceptibility to Supplier Financial Distress / Insolvency (MT-24), Workforce Shortage / Loss of Critical Skills / Labor Disruption (MT-25).", "compensating_control_1": { "control_id": "CFG-02", "name": "Configuration Management Program", "description": "Mechanisms exist to facilitate the implementation of configuration management controls.", "justification": "Configuration Management Program (CFG-02) provides policy-level governance that compensates for the absence of Alternate Sources for Continued Support (AST-39.1) by establishing documented expectations, accountability structures, and organizational guardrails. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "VPM-06", "name": "Vulnerability Remediation Process", "description": "Mechanisms exist to ensure that vulnerabilities are properly identified, tracked and remediated.", "justification": "Vulnerability Remediation Process (VPM-06) provides vulnerability management that compensates for the absence of Alternate Sources for Continued Support (AST-39.1) by reducing the exploitable attack surface by addressing known weaknesses before they are leveraged. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "AST-40", "risk_if_not_implemented": "Without Predictable Failure Analysis, Technology Assets, Applications and/or Services (TAAS) may be unknown, untracked, lost, stolen or left unprotected because they are not inventoried. Based on the risk and threat mapping for this control, no risk is rated Likely; risks rated Possible include Loss, Theft or Damage of Assets (R-AM-1), Business / Service Interruption (R-BC-1), Reduced Operational Productivity (R-BC-3), and most likely increases susceptibility to Human Error (MT-9), Data Quality Degradation / Data Poisoning (MT-12), Hazardous / Degraded Operational Environment (MT-21).", "compensating_control_1": { "control_id": "BCD-02", "name": "Business Continuity Management System (BCMS)", "description": "Mechanisms exist to operate a Business Continuity Management System (BCMS) to achieve resilient Technology Assets, Applications, Services and/or Data (TAASD) during:\n(1) Routine operations; and\n(2) Adverse conditions.", "justification": "Business Continuity Management System (BCMS) (BCD-02) provides resilience and recovery capability that compensates for the absence of Predictable Failure Analysis (AST-40) by ensuring the organization can restore operations and data when the primary control is absent. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "RSK-13", "name": "Risk Assessment", "description": "Mechanisms exist to conduct recurring assessments of risk that includes the likelihood and magnitude of harm, from unauthorized access, use, disclosure, disruption, modification or destruction of the organization's Technology Assets, Applications, Services and/or Data (TAASD).", "justification": "Risk Assessment (RSK-13) provides periodic assessment and assurance that compensates for the absence of Predictable Failure Analysis (AST-40) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "BCD-02.1", "risk_if_not_implemented": "Without Defined Operational Resilience Requirements, critical business processes and services may not withstand or recover from disruption, causing extended outages and data loss. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Recovery Failure / Unacceptable Recovery Delay (R-OR-1), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11).", "compensating_control_1": { "control_id": "BCD-03", "name": "Operational Resilience Capabilities", "description": "Mechanisms exist to ensure capabilities are implemented to provide operational resilience to:\n(1) Unintentional errors; and \n(2) Intentional attack or circumvention.", "justification": "Operational Resilience Capabilities (BCD-03) provides resilience and recovery capability that compensates for the absence of Defined Operational Resilience Requirements (BCD-02.1) by ensuring the organization can restore operations and data when the primary control is absent. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "RSK-08", "name": "Business Impact Analysis (BIA)", "description": "Mechanisms exist to conduct a Business Impact Analysis (BIA) to identify and assess security, compliance and resilience risks.", "justification": "Business Impact Analysis (BIA) (RSK-08) provides risk identification and prioritization that compensates for the absence of Defined Operational Resilience Requirements (BCD-02.1) by enabling informed decisions about where to focus resources to manage residual exposure. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "BCD-03", "risk_if_not_implemented": "Without Operational Resilience Capabilities, critical business processes and services may not withstand or recover from disruption, causing extended outages and data loss. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Business / Service Interruption (R-BC-1), Recovery Failure / Unacceptable Recovery Delay (R-OR-1), Loss of Data / Service Availability (R-IP-4), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "TDA-05", "name": "Secure Software Development Practices (SSDP)", "description": "Mechanisms exist to develop applications based on Secure Software Development Practices (SSDP).", "justification": "Secure Software Development Practices (SSDP) (TDA-05) provides overlapping security capability that compensates for the absence of Resilience Capabilities (BCD-03) by addressing related risk objectives through an alternative control mechanism aligned with Technology applicability. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "SEA-05", "name": "Secure Engineering Principles", "description": "Mechanisms exist to facilitate the implementation of industry-recognized security, compliance and resilience practices in the specification, design, development, implementation and modification of Technology Assets, Applications and/or Services (TAAS).", "justification": "Secure Engineering Principles (SEA-05) provides overlapping security capability that compensates for the absence of Resilience Capabilities (BCD-03) by addressing related risk objectives through an alternative control mechanism aligned with Technology applicability. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "BCD-04", "risk_if_not_implemented": "Without Business Continuity & Disaster Recovery (BC/DR) Plans, data, software and system images cannot be reliably restored within required recovery objectives following a disruption. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Business / Service Interruption (R-BC-1), Unperformed / Unowned Control Responsibilities (R-GV-3), Inability to Demonstrate Due Diligence / Due Care (R-GV-9), Recovery Failure / Unacceptable Recovery Delay (R-OR-1), Loss of Data / Service Availability (R-IP-4), and most likely increases susceptibility to Human Error (MT-9), Data Quality Degradation / Data Poisoning (MT-12).", "compensating_control_1": { "control_id": "BCD-13", "name": "Alternate Processing Site", "description": "Mechanisms exist to establish an alternate processing site that provides processing capability and security measures equivalent to that of the primary site.", "justification": "Alternate Processing Site (BCD-13) provides resilience and recovery capability that compensates for the absence of Business Continuity & Disaster Recovery (BC/DR) Plans (BCD-04) by ensuring the organization can restore operations and data when the primary control is absent. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "RSK-02", "name": "Risk Management Program", "description": "Mechanisms exist to facilitate the implementation of strategic, operational and tactical risk management controls that are aligned with:\n(1) The organization's Enterprise Risk Management (ERM); and\n(2) Industry-recognized cybersecurity risk management practices.", "justification": "Risk Management Program (RSK-02) provides policy-level governance that compensates for the absence of Business Continuity & Disaster Recovery (BC/DR) Plans (BCD-04) by establishing documented expectations, accountability structures, and organizational guardrails. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "BCD-04.1", "risk_if_not_implemented": "Without Recovery Time / Point Objectives (RTO / RPO), data, software and system images cannot be reliably restored within required recovery objectives following a disruption. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Business / Service Interruption (R-BC-1), Data Loss / Integrity Compromise (R-BC-2), Recovery Failure / Unacceptable Recovery Delay (R-OR-1), Loss of Data / Service Availability (R-IP-4), and most likely increases susceptibility to Human Error (MT-9).", "compensating_control_1": { "control_id": "BCD-10", "name": "Contingency Plan Testing & Exercises", "description": "Mechanisms exist to conduct tests and/or exercises to evaluate the contingency plan's effectiveness and the organization's readiness to execute the plan.", "justification": "Contingency Plan Testing & Exercises (BCD-10) provides periodic assessment and assurance that compensates for the absence of Recovery Time / Point Objectives (RTO / RPO) (BCD-04.1) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "BCD-11", "name": "Contingency Plan Root Cause Analysis (RCA) & Lessons Learned", "description": "Mechanisms exist to conduct a Root Cause Analysis (RCA) and \"lessons learned\" activity every time the contingency plan is activated.", "justification": "Contingency Plan Root Cause Analysis (RCA) & Lessons Learned (BCD-11) provides overlapping security capability that compensates for the absence of Recovery Time / Point Objectives (RTO / RPO) (BCD-04.1) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "BCD-05", "risk_if_not_implemented": "Without Recovery Operations Criteria, data, software and system images cannot be reliably restored within required recovery objectives following a disruption. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Business / Service Interruption (R-BC-1), Recovery Failure / Unacceptable Recovery Delay (R-OR-1), Loss of Data / Service Availability (R-IP-4), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9).", "compensating_control_1": { "control_id": "RSK-02", "name": "Risk Management Program", "description": "Mechanisms exist to facilitate the implementation of strategic, operational and tactical risk management controls that are aligned with:\n(1) The organization's Enterprise Risk Management (ERM); and\n(2) Industry-recognized cybersecurity risk management practices.", "justification": "Risk Management Program (RSK-02) provides policy-level governance that compensates for the absence of Recovery Operations Criteria (BCD-05) by establishing documented expectations, accountability structures, and organizational guardrails. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "BCD-02", "name": "Business Continuity Management System (BCMS)", "description": "Mechanisms exist to operate a Business Continuity Management System (BCMS) to achieve resilient Technology Assets, Applications, Services and/or Data (TAASD) during:\n(1) Routine operations; and\n(2) Adverse conditions.", "justification": "Business Continuity Management System (BCMS) (BCD-02) provides resilience and recovery capability that compensates for the absence of Recovery Operations Criteria (BCD-05) by ensuring the organization can restore operations and data when the primary control is absent. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "BCD-06", "risk_if_not_implemented": "Without Recovery Operations Communications, data, software and system images cannot be reliably restored within required recovery objectives following a disruption. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unreliable Assurance / Decision Information (R-GV-10), and most likely increases susceptibility to Utility Service Disruption (MT-7), Human Error (MT-9), Infrastructure Failure / Degradation (MT-27).", "compensating_control_1": { "control_id": "BCD-24", "name": "Data Backups", "description": "Mechanisms exist to create recurring backups of data, software and/or system images, as well as verify the integrity of these backups, to ensure the availability of the data to satisfy Recovery Time Objectives (RTOs) and Recovery Point Objectives (RPOs).", "justification": "Data Backups (BCD-24) provides resilience and recovery capability that compensates for the absence of Recovery Operations Communications (BCD-06) by ensuring the organization can restore operations and data when the primary control is absent. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "RSK-02", "name": "Risk Management Program", "description": "Mechanisms exist to facilitate the implementation of strategic, operational and tactical risk management controls that are aligned with:\n(1) The organization's Enterprise Risk Management (ERM); and\n(2) Industry-recognized cybersecurity risk management practices.", "justification": "Risk Management Program (RSK-02) provides policy-level governance that compensates for the absence of Recovery Operations Communications (BCD-06) by establishing documented expectations, accountability structures, and organizational guardrails. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "BCD-06.1", "risk_if_not_implemented": "Without Alternate Communications Channels, critical business processes and services may not withstand or recover from disruption, causing extended outages and data loss. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unperformed / Unowned Control Responsibilities (R-GV-3), Delayed Containment / Increased Incident Impact (R-IR-2), Loss of Critical Knowledge / Capability (R-PE-1), and most likely increases susceptibility to Utility Service Disruption (MT-7), Human Error (MT-9), Workforce Shortage / Loss of Critical Skills / Labor Disruption (MT-25), Infrastructure Failure / Degradation (MT-27).", "compensating_control_1": { "control_id": "BCD-17", "name": "Telecommunications Services Availability", "description": "Mechanisms exist to reduce the likelihood of a single point of failure with primary telecommunications services.", "justification": "Telecommunications Services Availability (BCD-17) provides overlapping security capability that compensates for the absence of Alternate Communications Channels (BCD-06.1) by addressing related risk objectives through an alternative control mechanism aligned with Facility applicability. Given the facility and physical environment focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "NET-07", "name": "Out-of-Band Channels", "description": "Mechanisms exist to utilize out-of-band channels for the electronic transmission of information and/or the physical shipment of system components or devices to authorized individuals.", "justification": "Out-of-Band Channels (NET-07) provides overlapping security capability that compensates for the absence of Alternate Communications Channels (BCD-06.1) by addressing related risk objectives through an alternative control mechanism aligned with Facility applicability. Given the facility and physical environment focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "BCD-07", "risk_if_not_implemented": "Without Ongoing Contingency Planning, critical business processes and services may not withstand or recover from disruption, causing extended outages and data loss. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Recovery Failure / Unacceptable Recovery Delay (R-OR-1), and most likely increases susceptibility to Human Error (MT-9), Data Quality Degradation / Data Poisoning (MT-12).", "compensating_control_1": { "control_id": "RSK-13.2", "name": "Risk Assessment Update", "description": "Mechanisms exist to routinely update risk assessments and react accordingly upon identifying new security vulnerabilities, including using outside sources for security vulnerability information.", "justification": "Risk Assessment Update (RSK-13.2) provides periodic assessment and assurance that compensates for the absence of Ongoing Contingency Planning (BCD-07) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "BCD-02", "name": "Business Continuity Management System (BCMS)", "description": "Mechanisms exist to operate a Business Continuity Management System (BCMS) to achieve resilient Technology Assets, Applications, Services and/or Data (TAASD) during:\n(1) Routine operations; and\n(2) Adverse conditions.", "justification": "Business Continuity Management System (BCMS) (BCD-02) provides resilience and recovery capability that compensates for the absence of Ongoing Contingency Planning (BCD-07) by ensuring the organization can restore operations and data when the primary control is absent. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "BCD-07.1", "risk_if_not_implemented": "Without Contingency Planning Components, critical business processes and services may not withstand or recover from disruption, causing extended outages and data loss. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unaddressed Security / Compliance Exposure (R-GV-2), and most likely increases susceptibility to Human Error (MT-9), Data Quality Degradation / Data Poisoning (MT-12).", "compensating_control_1": { "control_id": "RSK-13", "name": "Risk Assessment", "description": "Mechanisms exist to conduct recurring assessments of risk that includes the likelihood and magnitude of harm, from unauthorized access, use, disclosure, disruption, modification or destruction of the organization's Technology Assets, Applications, Services and/or Data (TAASD).", "justification": "Risk Assessment (RSK-13) provides periodic assessment and assurance that compensates for the absence of Contingency Planning Components (BCD-07.1) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "BCD-02", "name": "Business Continuity Management System (BCMS)", "description": "Mechanisms exist to operate a Business Continuity Management System (BCMS) to achieve resilient Technology Assets, Applications, Services and/or Data (TAASD) during:\n(1) Routine operations; and\n(2) Adverse conditions.", "justification": "Business Continuity Management System (BCMS) (BCD-02) provides resilience and recovery capability that compensates for the absence of Contingency Planning Components (BCD-07.1) by ensuring the organization can restore operations and data when the primary control is absent. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "BCD-07.2", "risk_if_not_implemented": "Without Contingency Plan Update Notifications, critical business processes and services may not withstand or recover from disruption, causing extended outages and data loss. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unreliable Assurance / Decision Information (R-GV-10), and most likely increases susceptibility to Human Error (MT-9).", "compensating_control_1": { "control_id": "BCD-02", "name": "Business Continuity Management System (BCMS)", "description": "Mechanisms exist to operate a Business Continuity Management System (BCMS) to achieve resilient Technology Assets, Applications, Services and/or Data (TAASD) during:\n(1) Routine operations; and\n(2) Adverse conditions.", "justification": "Business Continuity Management System (BCMS) (BCD-02) provides resilience and recovery capability that compensates for the absence of Contingency Plan Update Notifications (BCD-07.2) by ensuring the organization can restore operations and data when the primary control is absent. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "RSK-13.2", "name": "Risk Assessment Update", "description": "Mechanisms exist to routinely update risk assessments and react accordingly upon identifying new security vulnerabilities, including using outside sources for security vulnerability information.", "justification": "Risk Assessment Update (RSK-13.2) provides periodic assessment and assurance that compensates for the absence of Contingency Plan Update Notifications (BCD-07.2) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "BCD-07.3", "risk_if_not_implemented": "Without Coordinate with Related Plans, critical business processes and services may not withstand or recover from disruption, causing extended outages and data loss. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unperformed / Unowned Control Responsibilities (R-GV-3), and most likely increases susceptibility to Human Error (MT-9).", "compensating_control_1": { "control_id": "BCD-24", "name": "Data Backups", "description": "Mechanisms exist to create recurring backups of data, software and/or system images, as well as verify the integrity of these backups, to ensure the availability of the data to satisfy Recovery Time Objectives (RTOs) and Recovery Point Objectives (RPOs).", "justification": "Data Backups (BCD-24) provides resilience and recovery capability that compensates for the absence of Coordinate with Related Plans (BCD-07.3) by ensuring the organization can restore operations and data when the primary control is absent. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "BCD-13", "name": "Alternate Processing Site", "description": "Mechanisms exist to establish an alternate processing site that provides processing capability and security measures equivalent to that of the primary site.", "justification": "Alternate Processing Site (BCD-13) provides resilience and recovery capability that compensates for the absence of Coordinate with Related Plans (BCD-07.3) by ensuring the organization can restore operations and data when the primary control is absent. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "BCD-07.4", "risk_if_not_implemented": "Without Coordinate With External Service Providers, supplier and External Service Provider (ESP) weaknesses, incidents or failures may propagate into the organization's environment unmanaged. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Uncontrolled Third-Party Security / Privacy Exposure (R-GV-5), Third-Party Dependency Failure (R-SC-6), and most likely increases susceptibility to Human Error (MT-9).", "compensating_control_1": { "control_id": "BCD-13", "name": "Alternate Processing Site", "description": "Mechanisms exist to establish an alternate processing site that provides processing capability and security measures equivalent to that of the primary site.", "justification": "Alternate Processing Site (BCD-13) provides resilience and recovery capability that compensates for the absence of Coordinate With External Service Providers (BCD-07.4) by ensuring the organization can restore operations and data when the primary control is absent. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "BCD-12", "name": "Alternate Storage Site", "description": "Mechanisms exist to establish an alternate storage site that stores both the assets and necessary agreements needed for the recovery of Technology Assets, Applications, Services and/or Data (TAASD).", "justification": "Alternate Storage Site (BCD-12) provides resilience and recovery capability that compensates for the absence of Coordinate With External Service Providers (BCD-07.4) by ensuring the organization can restore operations and data when the primary control is absent. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "BCD-08", "risk_if_not_implemented": "Without Resume All Missions & Business Functions, security, compliance and resilience activities may lack direction, ownership and executive support, leaving required controls unperformed. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Business / Service Interruption (R-BC-1), Recovery Failure / Unacceptable Recovery Delay (R-OR-1), Loss of Data / Service Availability (R-IP-4), and most likely increases susceptibility to Human Error (MT-9).", "compensating_control_1": { "control_id": "AST-15", "name": "Asset Categorization", "description": "Mechanisms exist to categorize Technology Assets, Applications and/or Services (TAAS).", "justification": "Asset Categorization (AST-15) provides overlapping security capability that compensates for the absence of Resume All Missions & Business Functions (BCD-08) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "AST-04", "name": "Asset Inventories", "description": "Mechanisms exist to perform inventories of Technology Assets, Applications, Services and/or Data (TAASD) that:\n(1) Accurately reflects the current TAASD in use; \n(2) Identifies authorized software products, including business justification details;\n(3) Is at the level of granularity deemed necessary for tracking and reporting;\n(4) Includes organization-defined information deemed necessary to achieve effective property accountability; and\n(5) Is available for review and audit by designated organizational personnel.", "justification": "Asset Inventories (AST-04) provides overlapping security capability that compensates for the absence of Resume All Missions & Business Functions (BCD-08) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "BCD-08.1", "risk_if_not_implemented": "Without Continue Essential Mission & Business Functions, security, compliance and resilience activities may lack direction, ownership and executive support, leaving required controls unperformed. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Business / Service Interruption (R-BC-1), Reduced Operational Productivity (R-BC-3), Recovery Failure / Unacceptable Recovery Delay (R-OR-1), Loss of Data / Service Availability (R-IP-4), and most likely increases susceptibility to Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "DCH-04", "name": "Data & Asset Classification", "description": "Mechanisms exist to ensure data and assets are categorized in accordance with applicable statutory, regulatory and contractual requirements.", "justification": "Data & Asset Classification (DCH-04) provides overlapping security capability that compensates for the absence of Continue Essential Mission & Business Functions (BCD-08.1) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "AST-04", "name": "Asset Inventories", "description": "Mechanisms exist to perform inventories of Technology Assets, Applications, Services and/or Data (TAASD) that:\n(1) Accurately reflects the current TAASD in use; \n(2) Identifies authorized software products, including business justification details;\n(3) Is at the level of granularity deemed necessary for tracking and reporting;\n(4) Includes organization-defined information deemed necessary to achieve effective property accountability; and\n(5) Is available for review and audit by designated organizational personnel.", "justification": "Asset Inventories (AST-04) provides overlapping security capability that compensates for the absence of Continue Essential Mission & Business Functions (BCD-08.1) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "BCD-08.2", "risk_if_not_implemented": "Without Resume Essential Missions & Business Functions, security, compliance and resilience activities may lack direction, ownership and executive support, leaving required controls unperformed. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Business / Service Interruption (R-BC-1), Reduced Operational Productivity (R-BC-3), Recovery Failure / Unacceptable Recovery Delay (R-OR-1), Loss of Data / Service Availability (R-IP-4), and most likely increases susceptibility to Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "AST-04", "name": "Asset Inventories", "description": "Mechanisms exist to perform inventories of Technology Assets, Applications, Services and/or Data (TAASD) that:\n(1) Accurately reflects the current TAASD in use; \n(2) Identifies authorized software products, including business justification details;\n(3) Is at the level of granularity deemed necessary for tracking and reporting;\n(4) Includes organization-defined information deemed necessary to achieve effective property accountability; and\n(5) Is available for review and audit by designated organizational personnel.", "justification": "Asset Inventories (AST-04) provides overlapping security capability that compensates for the absence of Resume Essential Missions & Business Functions (BCD-08.2) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "AST-05", "name": "Identify Critical Assets", "description": "Mechanisms exist to identify and document the critical Technology Assets, Applications, Services and/or Data (TAASD) that support essential missions and business functions.", "justification": "Identify Critical Assets (AST-05) provides overlapping security capability that compensates for the absence of Resume Essential Missions & Business Functions (BCD-08.2) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "BCD-09", "risk_if_not_implemented": "Without Contingency Training, critical business processes and services may not withstand or recover from disruption, causing extended outages and data loss. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Recovery Failure / Unacceptable Recovery Delay (R-OR-1), Loss of Critical Knowledge / Capability (R-PE-1), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Workforce Shortage / Loss of Critical Skills / Labor Disruption (MT-25).", "compensating_control_1": { "control_id": "SAT-04", "name": "Security, Compliance & Resilience Awareness Training", "description": "Mechanisms exist to provide all employees and contractors appropriate security, compliance and resilience awareness education and training that is relevant for their job function.", "justification": "Security, Compliance & Resilience Awareness Training (SAT-04) provides personnel training and awareness that compensates for the absence of Contingency Training (BCD-09) by reducing human-factor risk by equipping personnel to recognize and respond to relevant threats. Given the people-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "SAT-05", "name": "Role-Based Security, Compliance & Resilience Training", "description": "Mechanisms exist to provide role-based security, compliance and resilience-related training: \n(1) Before authorizing access to the system or performing assigned duties; \n(2) When required by system changes; and \n(3) Annually thereafter.", "justification": "Role-Based Security, Compliance & Resilience Training (SAT-05) provides personnel training and awareness that compensates for the absence of Contingency Training (BCD-09) by reducing human-factor risk by equipping personnel to recognize and respond to relevant threats. Given the people-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "BCD-09.1", "risk_if_not_implemented": "Without Simulated Events, critical business processes and services may not withstand or recover from disruption, causing extended outages and data loss. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss of Critical Knowledge / Capability (R-PE-1), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Workforce Shortage / Loss of Critical Skills / Labor Disruption (MT-25).", "compensating_control_1": { "control_id": "SAT-05", "name": "Role-Based Security, Compliance & Resilience Training", "description": "Mechanisms exist to provide role-based security, compliance and resilience-related training: \n(1) Before authorizing access to the system or performing assigned duties; \n(2) When required by system changes; and \n(3) Annually thereafter.", "justification": "Role-Based Security, Compliance & Resilience Training (SAT-05) provides personnel training and awareness that compensates for the absence of Simulated Events (BCD-09.1) by reducing human-factor risk by equipping personnel to recognize and respond to relevant threats. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "SAT-04", "name": "Security, Compliance & Resilience Awareness Training", "description": "Mechanisms exist to provide all employees and contractors appropriate security, compliance and resilience awareness education and training that is relevant for their job function.", "justification": "Security, Compliance & Resilience Awareness Training (SAT-04) provides personnel training and awareness that compensates for the absence of Simulated Events (BCD-09.1) by reducing human-factor risk by equipping personnel to recognize and respond to relevant threats. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "BCD-09.2", "risk_if_not_implemented": "Without Automated Training Environments, personnel are more likely to make unsafe decisions, fall victim to social engineering, mishandle data or violate requirements. Based on the risk and threat mapping for this control, no risk is rated Likely; risks rated Possible include Reduced Operational Productivity (R-BC-3), Failure to Achieve Strategic / Mission Objectives (R-EX-8), Inability to Demonstrate Due Diligence / Due Care (R-GV-9), and most likely increases susceptibility to Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "SAT-04", "name": "Security, Compliance & Resilience Awareness Training", "description": "Mechanisms exist to provide all employees and contractors appropriate security, compliance and resilience awareness education and training that is relevant for their job function.", "justification": "Security, Compliance & Resilience Awareness Training (SAT-04) provides personnel training and awareness that compensates for the absence of Automated Training Environments (BCD-09.2) by reducing human-factor risk by equipping personnel to recognize and respond to relevant threats. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "BCD-09", "name": "Contingency Training", "description": "Mechanisms exist to adequately train contingency personnel and applicable stakeholders in their contingency roles and responsibilities.", "justification": "Contingency Training (BCD-09) provides personnel training and awareness that compensates for the absence of Automated Training Environments (BCD-09.2) by reducing human-factor risk by equipping personnel to recognize and respond to relevant threats. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "BCD-10", "risk_if_not_implemented": "Without Contingency Plan Testing & Exercises, critical business processes and services may not withstand or recover from disruption, causing extended outages and data loss. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Inability to Demonstrate Due Diligence / Due Care (R-GV-9), Unreliable Assurance / Decision Information (R-GV-10), Recovery Failure / Unacceptable Recovery Delay (R-OR-1), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Workforce Shortage / Loss of Critical Skills / Labor Disruption (MT-25).", "compensating_control_1": { "control_id": "BCD-11", "name": "Contingency Plan Root Cause Analysis (RCA) & Lessons Learned", "description": "Mechanisms exist to conduct a Root Cause Analysis (RCA) and \"lessons learned\" activity every time the contingency plan is activated.", "justification": "Contingency Plan Root Cause Analysis (RCA) & Lessons Learned (BCD-11) provides overlapping security capability that compensates for the absence of Contingency Plan Testing & Exercises (BCD-10) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "BCD-24", "name": "Data Backups", "description": "Mechanisms exist to create recurring backups of data, software and/or system images, as well as verify the integrity of these backups, to ensure the availability of the data to satisfy Recovery Time Objectives (RTOs) and Recovery Point Objectives (RPOs).", "justification": "Data Backups (BCD-24) provides resilience and recovery capability that compensates for the absence of Contingency Plan Testing & Exercises (BCD-10) by ensuring the organization can restore operations and data when the primary control is absent. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "BCD-10.1", "risk_if_not_implemented": "Without Coordinated Testing with Related Plans, critical business processes and services may not withstand or recover from disruption, causing extended outages and data loss. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unperformed / Unowned Control Responsibilities (R-GV-3), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Workforce Shortage / Loss of Critical Skills / Labor Disruption (MT-25).", "compensating_control_1": { "control_id": "BCD-11", "name": "Contingency Plan Root Cause Analysis (RCA) & Lessons Learned", "description": "Mechanisms exist to conduct a Root Cause Analysis (RCA) and \"lessons learned\" activity every time the contingency plan is activated.", "justification": "Contingency Plan Root Cause Analysis (RCA) & Lessons Learned (BCD-11) provides overlapping security capability that compensates for the absence of Coordinated Testing with Related Plans (BCD-10.1) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "BCD-10", "name": "Contingency Plan Testing & Exercises", "description": "Mechanisms exist to conduct tests and/or exercises to evaluate the contingency plan's effectiveness and the organization's readiness to execute the plan.", "justification": "Contingency Plan Testing & Exercises (BCD-10) provides periodic assessment and assurance that compensates for the absence of Coordinated Testing with Related Plans (BCD-10.1) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "BCD-10.2", "risk_if_not_implemented": "Without Contingency Plan Testing For Alternate Storage & Processing Sites, data, software and system images cannot be reliably restored within required recovery objectives following a disruption. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Recovery Failure / Unacceptable Recovery Delay (R-OR-1), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Workforce Shortage / Loss of Critical Skills / Labor Disruption (MT-25).", "compensating_control_1": { "control_id": "BCD-10", "name": "Contingency Plan Testing & Exercises", "description": "Mechanisms exist to conduct tests and/or exercises to evaluate the contingency plan's effectiveness and the organization's readiness to execute the plan.", "justification": "Contingency Plan Testing & Exercises (BCD-10) provides periodic assessment and assurance that compensates for the absence of Alternate Storage & Processing Sites (BCD-10.2) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the facility and physical environment focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "IRO-09", "name": "Incident Response Capabilities Testing", "description": "Mechanisms exist to formally test incident response capabilities through realistic exercises to determine the operational effectiveness of those capabilities.", "justification": "Incident Response Capabilities Testing (IRO-09) provides periodic assessment and assurance that compensates for the absence of Alternate Storage & Processing Sites (BCD-10.2) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the facility and physical environment focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "BCD-11", "risk_if_not_implemented": "Without Contingency Plan Root Cause Analysis (RCA) & Lessons Learned, critical business processes and services may not withstand or recover from disruption, causing extended outages and data loss. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Lack of oversight of internal controls (R-GV-6), Incident Persistence / Recurrence (R-IR-3), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Workforce Shortage / Loss of Critical Skills / Labor Disruption (MT-25).", "compensating_control_1": { "control_id": "IRO-14", "name": "Root Cause Analysis (RCA) & Lessons Learned", "description": "Mechanisms exist to incorporate lessons learned from analyzing and resolving cybersecurity and data protection incidents to reduce the likelihood or impact of future incidents.", "justification": "Root Cause Analysis (RCA) & Lessons Learned (IRO-14) provides overlapping security capability that compensates for the absence of Contingency Plan Root Cause Analysis (RCA) & Lessons Learned (BCD-11) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "BCD-10", "name": "Contingency Plan Testing & Exercises", "description": "Mechanisms exist to conduct tests and/or exercises to evaluate the contingency plan's effectiveness and the organization's readiness to execute the plan.", "justification": "Contingency Plan Testing & Exercises (BCD-10) provides periodic assessment and assurance that compensates for the absence of Contingency Plan Root Cause Analysis (RCA) & Lessons Learned (BCD-11) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "BCD-12", "risk_if_not_implemented": "Without Alternate Storage Site, data, software and system images cannot be reliably restored within required recovery objectives following a disruption. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Data Loss / Integrity Compromise (R-BC-2), Recovery Failure / Unacceptable Recovery Delay (R-OR-1), Concentration / Single-Point Dependency Failure (R-OR-2), Loss of Data / Service Availability (R-IP-4), and most likely increases susceptibility to natural threats NT-2, NT-3, NT-4, NT-5, NT-6, NT-8, NT-11, NT-12, NT-13, NT-14; Hazardous Materials Emergencies (MT-3), Nuclear, Biological and Chemical (NBC) Weapons (MT-4), Physical Crime (MT-5), Terrorism & Armed Attacks (MT-6).", "compensating_control_1": { "control_id": "BCD-24", "name": "Data Backups", "description": "Mechanisms exist to create recurring backups of data, software and/or system images, as well as verify the integrity of these backups, to ensure the availability of the data to satisfy Recovery Time Objectives (RTOs) and Recovery Point Objectives (RPOs).", "justification": "Data Backups (BCD-24) provides resilience and recovery capability that compensates for the absence of Alternate Storage Site (BCD-12) by ensuring the organization can restore operations and data when the primary control is absent. Given the facility and physical environment focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "BCD-13", "name": "Alternate Processing Site", "description": "Mechanisms exist to establish an alternate processing site that provides processing capability and security measures equivalent to that of the primary site.", "justification": "Alternate Processing Site (BCD-13) provides resilience and recovery capability that compensates for the absence of Alternate Storage Site (BCD-12) by ensuring the organization can restore operations and data when the primary control is absent. Given the facility and physical environment focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "BCD-12.1", "risk_if_not_implemented": "Without Separation from Primary Storage Site, security may be bolted on rather than designed in, resulting in structural weaknesses that are costly to remediate and easy to exploit. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Concentration / Single-Point Dependency Failure (R-OR-2), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9).", "compensating_control_1": { "control_id": "BCD-13", "name": "Alternate Processing Site", "description": "Mechanisms exist to establish an alternate processing site that provides processing capability and security measures equivalent to that of the primary site.", "justification": "Alternate Processing Site (BCD-13) provides resilience and recovery capability that compensates for the absence of Separation from Primary Storage Site (BCD-11.1) by ensuring the organization can restore operations and data when the primary control is absent. Given the facility and physical environment focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "BCD-24", "name": "Data Backups", "description": "Mechanisms exist to create recurring backups of data, software and/or system images, as well as verify the integrity of these backups, to ensure the availability of the data to satisfy Recovery Time Objectives (RTOs) and Recovery Point Objectives (RPOs).", "justification": "Data Backups (BCD-24) provides resilience and recovery capability that compensates for the absence of Separation from Primary Storage Site (BCD-11.1) by ensuring the organization can restore operations and data when the primary control is absent. Given the facility and physical environment focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "BCD-12.2", "risk_if_not_implemented": "Without Primary Storage Site Accessibility, critical business processes and services may not withstand or recover from disruption, causing extended outages and data loss. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Recovery Failure / Unacceptable Recovery Delay (R-OR-1), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Transportation / Logistics Disruption (MT-26), Infrastructure Failure / Degradation (MT-27).", "compensating_control_1": { "control_id": "BCD-12", "name": "Alternate Storage Site", "description": "Mechanisms exist to establish an alternate storage site that stores both the assets and necessary agreements needed for the recovery of Technology Assets, Applications, Services and/or Data (TAASD).", "justification": "Alternate Storage Site (BCD-12) provides resilience and recovery capability that compensates for the absence of Primary Storage Site Accessibility (BCD-11.2) by ensuring the organization can restore operations and data when the primary control is absent. Given the facility and physical environment focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "BCD-24", "name": "Data Backups", "description": "Mechanisms exist to create recurring backups of data, software and/or system images, as well as verify the integrity of these backups, to ensure the availability of the data to satisfy Recovery Time Objectives (RTOs) and Recovery Point Objectives (RPOs).", "justification": "Data Backups (BCD-24) provides resilience and recovery capability that compensates for the absence of Primary Storage Site Accessibility (BCD-11.2) by ensuring the organization can restore operations and data when the primary control is absent. Given the facility and physical environment focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "BCD-13", "risk_if_not_implemented": "Without Alternate Processing Site, data, software and system images cannot be reliably restored within required recovery objectives following a disruption. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Business / Service Interruption (R-BC-1), Recovery Failure / Unacceptable Recovery Delay (R-OR-1), Concentration / Single-Point Dependency Failure (R-OR-2), Loss of Data / Service Availability (R-IP-4), and most likely increases susceptibility to natural threats NT-2, NT-3, NT-4, NT-5, NT-6, NT-8, NT-11, NT-12, NT-13, NT-14; Utility Service Disruption (MT-7), Technical / Mechanical Failure (MT-10), Infrastructure Failure / Degradation (MT-27).", "compensating_control_1": { "control_id": "BCD-12", "name": "Alternate Storage Site", "description": "Mechanisms exist to establish an alternate storage site that stores both the assets and necessary agreements needed for the recovery of Technology Assets, Applications, Services and/or Data (TAASD).", "justification": "Alternate Storage Site (BCD-12) provides resilience and recovery capability that compensates for the absence of Alternate Processing Site (BCD-13) by ensuring the organization can restore operations and data when the primary control is absent. Given the facility and physical environment focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CAP-06", "name": "Elastic Expansion", "description": "Mechanisms exist to automatically scale the resources available for Technology Assets, Applications and/or Services (TAAS), as demand conditions change.", "justification": "Elastic Expansion (CAP-06) provides overlapping security capability that compensates for the absence of Alternate Processing Site (BCD-13) by addressing related risk objectives through an alternative control mechanism aligned with Facility applicability. Given the facility and physical environment focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "BCD-13.1", "risk_if_not_implemented": "Without Separation from Primary Processing Site, security may be bolted on rather than designed in, resulting in structural weaknesses that are costly to remediate and easy to exploit. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Recovery Failure / Unacceptable Recovery Delay (R-OR-1), Concentration / Single-Point Dependency Failure (R-OR-2), and most likely increases susceptibility to natural threats NT-2, NT-3, NT-4, NT-5, NT-6, NT-8, NT-11, NT-12, NT-13, NT-14.", "compensating_control_1": { "control_id": "CAP-06", "name": "Elastic Expansion", "description": "Mechanisms exist to automatically scale the resources available for Technology Assets, Applications and/or Services (TAAS), as demand conditions change.", "justification": "Elastic Expansion (CAP-06) provides overlapping security capability that compensates for the absence of Separation from Primary Processing Site (BCD-13.1) by addressing related risk objectives through an alternative control mechanism aligned with Facility applicability. Given the facility and physical environment focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "BCD-20", "name": "Reserve Hardware", "description": "Mechanisms exist to purchase and maintain a sufficient reserve of spare hardware to ensure essential missions and business functions can be maintained in the event of a supply chain disruption.", "justification": "Reserve Hardware (BCD-20) provides overlapping security capability that compensates for the absence of Separation from Primary Processing Site (BCD-13.1) by addressing related risk objectives through an alternative control mechanism aligned with Facility applicability. Given the facility and physical environment focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "BCD-13.2", "risk_if_not_implemented": "Without Alternate Processing Site Accessibility, data, software and system images cannot be reliably restored within required recovery objectives following a disruption. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Recovery Failure / Unacceptable Recovery Delay (R-OR-1), and most likely increases susceptibility to natural threats NT-2, NT-3, NT-4, NT-5, NT-6, NT-7, NT-8, NT-11, NT-12, NT-13, NT-14; Civil or Political Unrest (MT-1), Transportation / Logistics Disruption (MT-26), Infrastructure Failure / Degradation (MT-27).", "compensating_control_1": { "control_id": "BCD-20", "name": "Reserve Hardware", "description": "Mechanisms exist to purchase and maintain a sufficient reserve of spare hardware to ensure essential missions and business functions can be maintained in the event of a supply chain disruption.", "justification": "Reserve Hardware (BCD-20) provides overlapping security capability that compensates for the absence of Alternate Processing Site Accessibility (BCD-13.2) by addressing related risk objectives through an alternative control mechanism aligned with Facility applicability. Given the facility and physical environment focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CAP-06", "name": "Elastic Expansion", "description": "Mechanisms exist to automatically scale the resources available for Technology Assets, Applications and/or Services (TAAS), as demand conditions change.", "justification": "Elastic Expansion (CAP-06) provides overlapping security capability that compensates for the absence of Alternate Processing Site Accessibility (BCD-13.2) by addressing related risk objectives through an alternative control mechanism aligned with Facility applicability. Given the facility and physical environment focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "BCD-14", "risk_if_not_implemented": "Without Alternate Site Priority of Service, data, software and system images cannot be reliably restored within required recovery objectives following a disruption. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Recovery Failure / Unacceptable Recovery Delay (R-OR-1), Concentration / Single-Point Dependency Failure (R-OR-2), Third-Party Dependency Failure (R-SC-6), and most likely increases susceptibility to Supplier Financial Distress / Insolvency (MT-24).", "compensating_control_1": { "control_id": "BCD-13", "name": "Alternate Processing Site", "description": "Mechanisms exist to establish an alternate processing site that provides processing capability and security measures equivalent to that of the primary site.", "justification": "Alternate Processing Site (BCD-13) provides resilience and recovery capability that compensates for the absence of Alternate Site Priority of Service (BCD-14) by ensuring the organization can restore operations and data when the primary control is absent. Given the facility and physical environment focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CAP-06", "name": "Elastic Expansion", "description": "Mechanisms exist to automatically scale the resources available for Technology Assets, Applications and/or Services (TAAS), as demand conditions change.", "justification": "Elastic Expansion (CAP-06) provides overlapping security capability that compensates for the absence of Alternate Site Priority of Service (BCD-14) by addressing related risk objectives through an alternative control mechanism aligned with Facility applicability. Given the facility and physical environment focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "BCD-15", "risk_if_not_implemented": "Without Preparation for Use, critical business processes and services may not withstand or recover from disruption, causing extended outages and data loss. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Business / Service Interruption (R-BC-1), Recovery Failure / Unacceptable Recovery Delay (R-OR-1), Loss of Data / Service Availability (R-IP-4), and most likely increases susceptibility to natural threats NT-2, NT-3, NT-4, NT-5, NT-6, NT-8, NT-11, NT-12, NT-13, NT-14; Utility Service Disruption (MT-7), Human Error (MT-9), Technical / Mechanical Failure (MT-10), Infrastructure Failure / Degradation (MT-27).", "compensating_control_1": { "control_id": "CAP-06", "name": "Elastic Expansion", "description": "Mechanisms exist to automatically scale the resources available for Technology Assets, Applications and/or Services (TAAS), as demand conditions change.", "justification": "Elastic Expansion (CAP-06) provides overlapping security capability that compensates for the absence of Preparation for Use (BCD-15) by addressing related risk objectives through an alternative control mechanism aligned with Facility applicability. Given the facility and physical environment focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "BCD-13", "name": "Alternate Processing Site", "description": "Mechanisms exist to establish an alternate processing site that provides processing capability and security measures equivalent to that of the primary site.", "justification": "Alternate Processing Site (BCD-13) provides resilience and recovery capability that compensates for the absence of Preparation for Use (BCD-15) by ensuring the organization can restore operations and data when the primary control is absent. Given the facility and physical environment focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "BCD-16", "risk_if_not_implemented": "Without Inability to Return to Primary Site, critical business processes and services may not withstand or recover from disruption, causing extended outages and data loss. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Recovery Failure / Unacceptable Recovery Delay (R-OR-1), and most likely increases susceptibility to natural threats NT-2, NT-3, NT-4, NT-5, NT-6, NT-8, NT-11, NT-12, NT-13, NT-14.", "compensating_control_1": { "control_id": "BCD-12", "name": "Alternate Storage Site", "description": "Mechanisms exist to establish an alternate storage site that stores both the assets and necessary agreements needed for the recovery of Technology Assets, Applications, Services and/or Data (TAASD).", "justification": "Alternate Storage Site (BCD-12) provides resilience and recovery capability that compensates for the absence of Inability to Return to Primary Site (BCD-16) by ensuring the organization can restore operations and data when the primary control is absent. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "BCD-13", "name": "Alternate Processing Site", "description": "Mechanisms exist to establish an alternate processing site that provides processing capability and security measures equivalent to that of the primary site.", "justification": "Alternate Processing Site (BCD-13) provides resilience and recovery capability that compensates for the absence of Inability to Return to Primary Site (BCD-16) by ensuring the organization can restore operations and data when the primary control is absent. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "BCD-16.1", "risk_if_not_implemented": "Without Personnel Transfer to Alternate Processing / Storage Site, data, software and system images cannot be reliably restored within required recovery objectives following a disruption. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Recovery Failure / Unacceptable Recovery Delay (R-OR-1), Loss of Critical Knowledge / Capability (R-PE-1), and most likely increases susceptibility to Pandemic (Disease) Outbreaks (NT-7); Dysfunctional Management Practices (MT-8), Human Error (MT-9), Workforce Shortage / Loss of Critical Skills / Labor Disruption (MT-25).", "compensating_control_1": { "control_id": "BCD-09", "name": "Contingency Training", "description": "Mechanisms exist to adequately train contingency personnel and applicable stakeholders in their contingency roles and responsibilities.", "justification": "Contingency Training (BCD-09) provides personnel training and awareness that compensates for the absence of Transfer to Alternate Processing / Storage Site (BCD-16.1) by reducing human-factor risk by equipping personnel to recognize and respond to relevant threats. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "SAT-04", "name": "Security, Compliance & Resilience Awareness Training", "description": "Mechanisms exist to provide all employees and contractors appropriate security, compliance and resilience awareness education and training that is relevant for their job function.", "justification": "Security, Compliance & Resilience Awareness Training (SAT-04) provides personnel training and awareness that compensates for the absence of Transfer to Alternate Processing / Storage Site (BCD-16.1) by reducing human-factor risk by equipping personnel to recognize and respond to relevant threats. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "BCD-17", "risk_if_not_implemented": "Without Telecommunications Services Availability, critical business processes and services may not withstand or recover from disruption, causing extended outages and data loss. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Business / Service Interruption (R-BC-1), Concentration / Single-Point Dependency Failure (R-OR-2), Third-Party Dependency Failure (R-SC-6), Loss of Data / Service Availability (R-IP-4), and most likely increases susceptibility to Space Weather (NT-9); Utility Service Disruption (MT-7), Technical / Mechanical Failure (MT-10), Infrastructure Failure / Degradation (MT-27).", "compensating_control_1": { "control_id": "NET-13", "name": "Domain Name Service (DNS) Resolution", "description": "Mechanisms exist to ensure Domain Name Service (DNS) resolution is designed, implemented and managed to protect the security of name / address resolution.", "justification": "Domain Name Service (DNS) Resolution (NET-13) provides overlapping security capability that compensates for the absence of Telecommunications Services Availability (BCD-17) by addressing related risk objectives through an alternative control mechanism aligned with Facility applicability. Given the facility and physical environment focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "BCD-13", "name": "Alternate Processing Site", "description": "Mechanisms exist to establish an alternate processing site that provides processing capability and security measures equivalent to that of the primary site.", "justification": "Alternate Processing Site (BCD-13) provides resilience and recovery capability that compensates for the absence of Telecommunications Services Availability (BCD-17) by ensuring the organization can restore operations and data when the primary control is absent. Given the facility and physical environment focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "BCD-17.1", "risk_if_not_implemented": "Without Telecommunications Priority of Service Provisions, critical business processes and services may not withstand or recover from disruption, causing extended outages and data loss. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Recovery Failure / Unacceptable Recovery Delay (R-OR-1), Third-Party Dependency Failure (R-SC-6), and most likely increases susceptibility to Supplier Financial Distress / Insolvency (MT-24).", "compensating_control_1": { "control_id": "NET-07", "name": "Out-of-Band Channels", "description": "Mechanisms exist to utilize out-of-band channels for the electronic transmission of information and/or the physical shipment of system components or devices to authorized individuals.", "justification": "Out-of-Band Channels (NET-07) provides overlapping security capability that compensates for the absence of Telecommunications Priority of Service Provisions (BCD-17.1) by addressing related risk objectives through an alternative control mechanism aligned with Facility applicability. Given the facility and physical environment focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "BCD-17", "name": "Telecommunications Services Availability", "description": "Mechanisms exist to reduce the likelihood of a single point of failure with primary telecommunications services.", "justification": "Telecommunications Services Availability (BCD-17) provides overlapping security capability that compensates for the absence of Telecommunications Priority of Service Provisions (BCD-17.1) by addressing related risk objectives through an alternative control mechanism aligned with Facility applicability. Given the facility and physical environment focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "BCD-17.2", "risk_if_not_implemented": "Without Separation of Primary / Alternate Providers, security may be bolted on rather than designed in, resulting in structural weaknesses that are costly to remediate and easy to exploit. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Concentration / Single-Point Dependency Failure (R-OR-2), Sub-Tier / Fourth-Party Supply Chain Exposure (R-SC-3), Third-Party Dependency Failure (R-SC-6). No threat is rated Likely for this control; threats rated Possible include Civil or Political Unrest (MT-1), Malicious Cyber Activity (MT-2), Hazardous Materials Emergencies (MT-3).", "compensating_control_1": { "control_id": "BCD-13", "name": "Alternate Processing Site", "description": "Mechanisms exist to establish an alternate processing site that provides processing capability and security measures equivalent to that of the primary site.", "justification": "Alternate Processing Site (BCD-13) provides resilience and recovery capability that compensates for the absence of Separation of Primary / Alternate Providers (BCD-17.2) by ensuring the organization can restore operations and data when the primary control is absent. Given the facility and physical environment focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "NET-07", "name": "Out-of-Band Channels", "description": "Mechanisms exist to utilize out-of-band channels for the electronic transmission of information and/or the physical shipment of system components or devices to authorized individuals.", "justification": "Out-of-Band Channels (NET-07) provides overlapping security capability that compensates for the absence of Separation of Primary / Alternate Providers (BCD-17.2) by addressing related risk objectives through an alternative control mechanism aligned with Facility applicability. Given the facility and physical environment focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "BCD-18", "risk_if_not_implemented": "Without Technology Assets, Applications and/or Services (TAAS) Recovery & Reconstitution, data, software and system images cannot be reliably restored within required recovery objectives following a disruption. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to R-AM-2, R-BC-1, R-BC-2, R-IR-3, R-OR-1, R-IP-4, and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "BCD-24", "name": "Data Backups", "description": "Mechanisms exist to create recurring backups of data, software and/or system images, as well as verify the integrity of these backups, to ensure the availability of the data to satisfy Recovery Time Objectives (RTOs) and Recovery Point Objectives (RPOs).", "justification": "Data Backups (BCD-24) provides resilience and recovery capability that compensates for the absence of Technology Assets, Applications and/or Services (TAAS) Recovery & Reconstitution (BCD-18) by ensuring the organization can restore operations and data when the primary control is absent. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "BCD-13", "name": "Alternate Processing Site", "description": "Mechanisms exist to establish an alternate processing site that provides processing capability and security measures equivalent to that of the primary site.", "justification": "Alternate Processing Site (BCD-13) provides resilience and recovery capability that compensates for the absence of Technology Assets, Applications and/or Services (TAAS) Recovery & Reconstitution (BCD-18) by ensuring the organization can restore operations and data when the primary control is absent. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "BCD-18.1", "risk_if_not_implemented": "Without Restore Within Time Period, data, software and system images cannot be reliably restored within required recovery objectives following a disruption. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to R-AM-2, R-BC-1, R-BC-2, R-OR-1, R-IP-3, R-IP-4, and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9), Technical / Mechanical Failure (MT-10), Data Quality Degradation / Data Poisoning (MT-12).", "compensating_control_1": { "control_id": "BCD-13", "name": "Alternate Processing Site", "description": "Mechanisms exist to establish an alternate processing site that provides processing capability and security measures equivalent to that of the primary site.", "justification": "Alternate Processing Site (BCD-13) provides resilience and recovery capability that compensates for the absence of Restore Within Time Period (BCD-18.1) by ensuring the organization can restore operations and data when the primary control is absent. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "BCD-24", "name": "Data Backups", "description": "Mechanisms exist to create recurring backups of data, software and/or system images, as well as verify the integrity of these backups, to ensure the availability of the data to satisfy Recovery Time Objectives (RTOs) and Recovery Point Objectives (RPOs).", "justification": "Data Backups (BCD-24) provides resilience and recovery capability that compensates for the absence of Restore Within Time Period (BCD-18.1) by ensuring the organization can restore operations and data when the primary control is absent. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "BCD-18.2", "risk_if_not_implemented": "Without Recovery Images, data, software and system images cannot be reliably restored within required recovery objectives following a disruption. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Modification / Loss of System Integrity (R-AM-2), Business / Service Interruption (R-BC-1), Incident Persistence / Recurrence (R-IR-3), Recovery Failure / Unacceptable Recovery Delay (R-OR-1), Loss of Data / Service Availability (R-IP-4), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "CRY-07", "name": "Encrypting Data At Rest", "description": "Cryptographic mechanisms exist to prevent the unauthorized disclosure of data at rest.", "justification": "Encrypting Data At Rest (CRY-07) provides cryptographic protection that compensates for the absence of Recovery Images (BCD-18.2) by ensuring data confidentiality and integrity through alternative technical means. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "BCD-31", "name": "Data Backup & Restoration Hardware Protection", "description": "Mechanisms exist to protect data backup and restoration hardware and software.", "justification": "Data Backup & Restoration Hardware Protection (BCD-31) provides resilience and recovery capability that compensates for the absence of Recovery Images (BCD-18.2) by ensuring the organization can restore operations and data when the primary control is absent. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "BCD-19", "risk_if_not_implemented": "Without Isolated Recovery Environment, data, software and system images cannot be reliably restored within required recovery objectives following a disruption. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Business / Service Interruption (R-BC-1), Data Loss / Integrity Compromise (R-BC-2), Recovery Failure / Unacceptable Recovery Delay (R-OR-1), Loss of Data / Service Availability (R-IP-4), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "NET-06", "name": "Network Segmentation (macrosegmentation)", "description": "Mechanisms exist to implement network segmentation within network architectures to isolate Technology Assets, Applications and/or Services (TAAS) from other network resources.", "justification": "Network Segmentation (macrosegmentation) (NET-06) provides network-level access restriction that compensates for the absence of Isolated Recovery Environment (BCD-19) by limiting attacker reach and lateral movement opportunities across the environment. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "BCD-24", "name": "Data Backups", "description": "Mechanisms exist to create recurring backups of data, software and/or system images, as well as verify the integrity of these backups, to ensure the availability of the data to satisfy Recovery Time Objectives (RTOs) and Recovery Point Objectives (RPOs).", "justification": "Data Backups (BCD-24) provides resilience and recovery capability that compensates for the absence of Isolated Recovery Environment (BCD-19) by ensuring the organization can restore operations and data when the primary control is absent. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "BCD-20", "risk_if_not_implemented": "Without Reserve Hardware, data, software and system images cannot be reliably restored within required recovery objectives following a disruption. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Business / Service Interruption (R-BC-1), Recovery Failure / Unacceptable Recovery Delay (R-OR-1), Concentration / Single-Point Dependency Failure (R-OR-2), Third-Party Dependency Failure (R-SC-6), Loss of Data / Service Availability (R-IP-4), and most likely increases susceptibility to man-made threats MT-5, MT-9, MT-19, MT-20, MT-22, MT-23, MT-24, MT-26.", "compensating_control_1": { "control_id": "BCD-13", "name": "Alternate Processing Site", "description": "Mechanisms exist to establish an alternate processing site that provides processing capability and security measures equivalent to that of the primary site.", "justification": "Alternate Processing Site (BCD-13) provides resilience and recovery capability that compensates for the absence of Reserve Hardware (BCD-20) by ensuring the organization can restore operations and data when the primary control is absent. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CAP-06", "name": "Elastic Expansion", "description": "Mechanisms exist to automatically scale the resources available for Technology Assets, Applications and/or Services (TAAS), as demand conditions change.", "justification": "Elastic Expansion (CAP-06) provides overlapping security capability that compensates for the absence of Reserve Hardware (BCD-20) by addressing related risk objectives through an alternative control mechanism aligned with Technology applicability. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "BCD-21", "risk_if_not_implemented": "Without Redundant Secondary System, data, software and system images cannot be reliably restored within required recovery objectives following a disruption. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Business / Service Interruption (R-BC-1), Data Loss / Integrity Compromise (R-BC-2), Recovery Failure / Unacceptable Recovery Delay (R-OR-1), Concentration / Single-Point Dependency Failure (R-OR-2), Loss of Data / Service Availability (R-IP-4), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "BCD-31", "name": "Data Backup & Restoration Hardware Protection", "description": "Mechanisms exist to protect data backup and restoration hardware and software.", "justification": "Data Backup & Restoration Hardware Protection (BCD-31) provides resilience and recovery capability that compensates for the absence of Redundant Secondary System (BCD-21) by ensuring the organization can restore operations and data when the primary control is absent. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "BCD-24", "name": "Data Backups", "description": "Mechanisms exist to create recurring backups of data, software and/or system images, as well as verify the integrity of these backups, to ensure the availability of the data to satisfy Recovery Time Objectives (RTOs) and Recovery Point Objectives (RPOs).", "justification": "Data Backups (BCD-24) provides resilience and recovery capability that compensates for the absence of Redundant Secondary System (BCD-21) by ensuring the organization can restore operations and data when the primary control is absent. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "BCD-22", "risk_if_not_implemented": "Without Failover Capability, data, software and system images cannot be reliably restored within required recovery objectives following a disruption. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Business / Service Interruption (R-BC-1), Recovery Failure / Unacceptable Recovery Delay (R-OR-1), Concentration / Single-Point Dependency Failure (R-OR-2), Loss of Data / Service Availability (R-IP-4), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9), Technical / Mechanical Failure (MT-10), Infrastructure Failure / Degradation (MT-27).", "compensating_control_1": { "control_id": "BCD-13", "name": "Alternate Processing Site", "description": "Mechanisms exist to establish an alternate processing site that provides processing capability and security measures equivalent to that of the primary site.", "justification": "Alternate Processing Site (BCD-13) provides resilience and recovery capability that compensates for the absence of Failover Capability (BCD-22) by ensuring the organization can restore operations and data when the primary control is absent. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "BCD-20", "name": "Reserve Hardware", "description": "Mechanisms exist to purchase and maintain a sufficient reserve of spare hardware to ensure essential missions and business functions can be maintained in the event of a supply chain disruption.", "justification": "Reserve Hardware (BCD-20) provides overlapping security capability that compensates for the absence of Failover Capability (BCD-22) by addressing related risk objectives through an alternative control mechanism aligned with Technology applicability. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "BCD-23", "risk_if_not_implemented": "Without Resilient Data Backup Architecture, data, software and system images cannot be reliably restored within required recovery objectives following a disruption. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Business / Service Interruption (R-BC-1), Data Loss / Integrity Compromise (R-BC-2), Recovery Failure / Unacceptable Recovery Delay (R-OR-1), Loss of Data Integrity (R-IP-3), Loss of Data / Service Availability (R-IP-4), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9), Technical / Mechanical Failure (MT-10), Fraud, Corruption and/or Intentional Criminal Conduct (MT-14).", "compensating_control_1": { "control_id": "BCD-24", "name": "Data Backups", "description": "Mechanisms exist to create recurring backups of data, software and/or system images, as well as verify the integrity of these backups, to ensure the availability of the data to satisfy Recovery Time Objectives (RTOs) and Recovery Point Objectives (RPOs).", "justification": "Data Backups (BCD-24) provides resilience and recovery capability that compensates for the absence of Resilient Data Backup Architecture (BCD-23) by ensuring the organization can restore operations and data when the primary control is absent. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "BCD-19", "name": "Isolated Recovery Environment", "description": "Mechanisms exist to utilize an isolated, non-production environment to perform data backup and recovery operations through offline, cloud or off-site capabilities.", "justification": "Isolated Recovery Environment (BCD-19) provides resilience and recovery capability that compensates for the absence of Resilient Data Backup Architecture (BCD-23) by ensuring the organization can restore operations and data when the primary control is absent. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "BCD-24.1", "risk_if_not_implemented": "Without Transfer to Alternate Storage Site, data, software and system images cannot be reliably restored within required recovery objectives following a disruption. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Business / Service Interruption (R-BC-1), Data Loss / Integrity Compromise (R-BC-2), Recovery Failure / Unacceptable Recovery Delay (R-OR-1), Loss of Data / Service Availability (R-IP-4), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Utility Service Disruption (MT-7), Human Error (MT-9), Technical / Mechanical Failure (MT-10), Infrastructure Failure / Degradation (MT-27).", "compensating_control_1": { "control_id": "BCD-19", "name": "Isolated Recovery Environment", "description": "Mechanisms exist to utilize an isolated, non-production environment to perform data backup and recovery operations through offline, cloud or off-site capabilities.", "justification": "Isolated Recovery Environment (BCD-19) provides resilience and recovery capability that compensates for the absence of Transfer to Alternate Storage Site (BCD-24.1) by ensuring the organization can restore operations and data when the primary control is absent. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CRY-07", "name": "Encrypting Data At Rest", "description": "Cryptographic mechanisms exist to prevent the unauthorized disclosure of data at rest.", "justification": "Encrypting Data At Rest (CRY-07) provides cryptographic protection that compensates for the absence of Transfer to Alternate Storage Site (BCD-24.1) by ensuring data confidentiality and integrity through alternative technical means. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "BCD-24.2", "risk_if_not_implemented": "Without Separate Storage for Critical Information, critical business processes and services may not withstand or recover from disruption, causing extended outages and data loss. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Business / Service Interruption (R-BC-1), Data Loss / Integrity Compromise (R-BC-2), Recovery Failure / Unacceptable Recovery Delay (R-OR-1), Concentration / Single-Point Dependency Failure (R-OR-2), Loss of Data / Service Availability (R-IP-4), and most likely increases susceptibility to natural threats NT-2, NT-3, NT-4, NT-5, NT-6, NT-8, NT-11, NT-12, NT-13, NT-14; Malicious Cyber Activity (MT-2), Physical Crime (MT-5), Human Error (MT-9), Infrastructure Failure / Degradation (MT-27).", "compensating_control_1": { "control_id": "BCD-19", "name": "Isolated Recovery Environment", "description": "Mechanisms exist to utilize an isolated, non-production environment to perform data backup and recovery operations through offline, cloud or off-site capabilities.", "justification": "Isolated Recovery Environment (BCD-19) provides resilience and recovery capability that compensates for the absence of Separate Storage for Critical Information (BCD-24.2) by ensuring the organization can restore operations and data when the primary control is absent. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "BCD-24", "name": "Data Backups", "description": "Mechanisms exist to create recurring backups of data, software and/or system images, as well as verify the integrity of these backups, to ensure the availability of the data to satisfy Recovery Time Objectives (RTOs) and Recovery Point Objectives (RPOs).", "justification": "Data Backups (BCD-24) provides resilience and recovery capability that compensates for the absence of Separate Storage for Critical Information (BCD-24.2) by ensuring the organization can restore operations and data when the primary control is absent. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "BCD-24.3", "risk_if_not_implemented": "Without Cryptographic Protection, data in transit and at rest may be exposed through weak, misconfigured or compromised cryptographic protections. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Data Loss / Integrity Compromise (R-BC-2), Long-Term Confidentiality Loss from Cryptographic Obsolescence (R-IP-1), Loss of Confidentiality (R-IP-2), Loss of Data Integrity (R-IP-3), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9), Harvest Now / Decrypt Later (HNDL) (MT-28), Cryptographic Compromise / Cryptanalytic Capability Advancement (MT-31).", "compensating_control_1": { "control_id": "BCD-31", "name": "Data Backup & Restoration Hardware Protection", "description": "Mechanisms exist to protect data backup and restoration hardware and software.", "justification": "Data Backup & Restoration Hardware Protection (BCD-31) provides resilience and recovery capability that compensates for the absence of Cryptographic Protection (BCD-24.3) by ensuring the organization can restore operations and data when the primary control is absent. Given the data-handling focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CRY-07", "name": "Encrypting Data At Rest", "description": "Cryptographic mechanisms exist to prevent the unauthorized disclosure of data at rest.", "justification": "Encrypting Data At Rest (CRY-07) provides cryptographic protection that compensates for the absence of Cryptographic Protection (BCD-24.3) by ensuring data confidentiality and integrity through alternative technical means. Given the data-handling focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "BCD-25", "risk_if_not_implemented": "Without Redundant Copies of Business-Critical Data, data, software and system images cannot be reliably restored within required recovery objectives following a disruption. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Business / Service Interruption (R-BC-1), Data Loss / Integrity Compromise (R-BC-2), Recovery Failure / Unacceptable Recovery Delay (R-OR-1), Concentration / Single-Point Dependency Failure (R-OR-2), Loss of Data / Service Availability (R-IP-4), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9), Technical / Mechanical Failure (MT-10), Fraud, Corruption and/or Intentional Criminal Conduct (MT-14).", "compensating_control_1": { "control_id": "BCD-24", "name": "Data Backups", "description": "Mechanisms exist to create recurring backups of data, software and/or system images, as well as verify the integrity of these backups, to ensure the availability of the data to satisfy Recovery Time Objectives (RTOs) and Recovery Point Objectives (RPOs).", "justification": "Data Backups (BCD-24) provides resilience and recovery capability that compensates for the absence of Redundant Copies of Business-Critical Data (BCD-25) by ensuring the organization can restore operations and data when the primary control is absent. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "BCD-27", "name": "Data Replication", "description": "Mechanisms exist to replicate data to alternate storage or processing locations at a frequency capable of satisfying Recovery Point Objectives (RPOs).", "justification": "Data Replication (BCD-27) provides resilience and recovery capability that compensates for the absence of Redundant Copies of Business-Critical Data (BCD-25) by ensuring the organization can restore operations and data when the primary control is absent. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "BCD-26", "risk_if_not_implemented": "Without Transaction Recovery, data, software and system images cannot be reliably restored within required recovery objectives following a disruption. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Business / Service Interruption (R-BC-1), Data Loss / Integrity Compromise (R-BC-2), Recovery Failure / Unacceptable Recovery Delay (R-OR-1), Loss of Data / Service Availability (R-IP-4), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "BCD-19", "name": "Isolated Recovery Environment", "description": "Mechanisms exist to utilize an isolated, non-production environment to perform data backup and recovery operations through offline, cloud or off-site capabilities.", "justification": "Isolated Recovery Environment (BCD-19) provides resilience and recovery capability that compensates for the absence of Transaction Recovery (BCD-26) by ensuring the organization can restore operations and data when the primary control is absent. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "BCD-24", "name": "Data Backups", "description": "Mechanisms exist to create recurring backups of data, software and/or system images, as well as verify the integrity of these backups, to ensure the availability of the data to satisfy Recovery Time Objectives (RTOs) and Recovery Point Objectives (RPOs).", "justification": "Data Backups (BCD-24) provides resilience and recovery capability that compensates for the absence of Transaction Recovery (BCD-26) by ensuring the organization can restore operations and data when the primary control is absent. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "BCD-27", "risk_if_not_implemented": "Without Data Replication, data, software and system images cannot be reliably restored within required recovery objectives following a disruption. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Data Loss / Integrity Compromise (R-BC-2), Recovery Failure / Unacceptable Recovery Delay (R-OR-1), Loss of Data / Service Availability (R-IP-4), and most likely increases susceptibility to Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "BCD-24", "name": "Data Backups", "description": "Mechanisms exist to create recurring backups of data, software and/or system images, as well as verify the integrity of these backups, to ensure the availability of the data to satisfy Recovery Time Objectives (RTOs) and Recovery Point Objectives (RPOs).", "justification": "Data Backups (BCD-24) provides resilience and recovery capability that compensates for the absence of Data Replication (BCD-27) by ensuring the organization can restore operations and data when the primary control is absent. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "BCD-21", "name": "Redundant Secondary System", "description": "Mechanisms exist to maintain a failover capability, which is not collocated with the primary Technology Asset, Application and/or Service (TAAS), which can be activated with little-to-no loss of information or disruption to operations.", "justification": "Redundant Secondary System (BCD-21) provides resilience and recovery capability that compensates for the absence of Data Replication (BCD-27) by ensuring the organization can restore operations and data when the primary control is absent. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "BCD-28", "risk_if_not_implemented": "Without Data Archiving, data, software and system images cannot be reliably restored within required recovery objectives following a disruption. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Retention / Inability to Dispose of Data (R-AM-3), Data Loss / Integrity Compromise (R-BC-2), and most likely increases susceptibility to Human Error (MT-9), Technical / Mechanical Failure (MT-10), Statutory / Regulatory / Contractual Change (MT-11).", "compensating_control_1": { "control_id": "DCH-27", "name": "Media & Data Retention", "description": "Mechanisms exist to retain media and data in accordance with applicable statutory, regulatory and contractual obligations.", "justification": "Media & Data Retention (DCH-27) provides data lifecycle and media protection that compensates for the absence of Data Archiving (BCD-28) by ensuring data is protected, retained appropriately and securely disposed of through alternative mechanisms. Given the data-handling focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "BCD-24", "name": "Data Backups", "description": "Mechanisms exist to create recurring backups of data, software and/or system images, as well as verify the integrity of these backups, to ensure the availability of the data to satisfy Recovery Time Objectives (RTOs) and Recovery Point Objectives (RPOs).", "justification": "Data Backups (BCD-24) provides resilience and recovery capability that compensates for the absence of Data Archiving (BCD-28) by ensuring the organization can restore operations and data when the primary control is absent. Given the data-handling focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "BCD-29", "risk_if_not_implemented": "Without Continuous Data Protection (CDP), data, software and system images cannot be reliably restored within required recovery objectives following a disruption. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Data Loss / Integrity Compromise (R-BC-2), Recovery Failure / Unacceptable Recovery Delay (R-OR-1), Loss of Data / Service Availability (R-IP-4), and most likely increases susceptibility to Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "BCD-24", "name": "Data Backups", "description": "Mechanisms exist to create recurring backups of data, software and/or system images, as well as verify the integrity of these backups, to ensure the availability of the data to satisfy Recovery Time Objectives (RTOs) and Recovery Point Objectives (RPOs).", "justification": "Data Backups (BCD-24) provides resilience and recovery capability that compensates for the absence of Continuous Data Protection (CDP) (BCD-29) by ensuring the organization can restore operations and data when the primary control is absent. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "BCD-26", "name": "Transaction Recovery", "description": "Mechanisms exist to utilize specialized backup mechanisms that will allow transaction recovery for transaction-based Technology Assets, Applications and/or Services (TAAS) in accordance with Recovery Point Objectives (RPOs).", "justification": "Transaction Recovery (BCD-26) provides resilience and recovery capability that compensates for the absence of Continuous Data Protection (CDP) (BCD-29) by ensuring the organization can restore operations and data when the primary control is absent. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "BCD-30", "risk_if_not_implemented": "Without Data Backup Access, data, software and system images cannot be reliably restored within required recovery objectives following a disruption. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Excessive or Unauthorized Privilege (R-AC-2), Unauthorized Access (R-AC-4), Loss of Confidentiality (R-IP-2), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9).", "compensating_control_1": { "control_id": "BCD-12", "name": "Alternate Storage Site", "description": "Mechanisms exist to establish an alternate storage site that stores both the assets and necessary agreements needed for the recovery of Technology Assets, Applications, Services and/or Data (TAASD).", "justification": "Alternate Storage Site (BCD-12) provides resilience and recovery capability that compensates for the absence of Backup Access (BCD-30) by ensuring the organization can restore operations and data when the primary control is absent. Given the data-handling focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "BCD-31", "name": "Data Backup & Restoration Hardware Protection", "description": "Mechanisms exist to protect data backup and restoration hardware and software.", "justification": "Data Backup & Restoration Hardware Protection (BCD-31) provides resilience and recovery capability that compensates for the absence of Backup Access (BCD-30) by ensuring the organization can restore operations and data when the primary control is absent. Given the data-handling focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "BCD-31", "risk_if_not_implemented": "Without Data Backup & Restoration Hardware Protection, data, software and system images cannot be reliably restored within required recovery objectives following a disruption. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss, Theft or Damage of Assets (R-AM-1), Unauthorized Modification / Loss of System Integrity (R-AM-2), and most likely increases susceptibility to natural threats NT-2, NT-3, NT-4, NT-5, NT-6, NT-8, NT-11, NT-12, NT-13, NT-14; Malicious Cyber Activity (MT-2), Physical Crime (MT-5).", "compensating_control_1": { "control_id": "PES-02", "name": "Physical & Environmental Protections", "description": "Mechanisms exist to facilitate the operation of physical and environmental protection controls.", "justification": "Physical & Environmental Protections (PES-02) provides physical access control that compensates for the absence of Backup & Restoration Hardware Protection (BCD-31) by preventing unauthorized physical interaction with systems and infrastructure. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "BCD-24", "name": "Data Backups", "description": "Mechanisms exist to create recurring backups of data, software and/or system images, as well as verify the integrity of these backups, to ensure the availability of the data to satisfy Recovery Time Objectives (RTOs) and Recovery Point Objectives (RPOs).", "justification": "Data Backups (BCD-24) provides resilience and recovery capability that compensates for the absence of Backup & Restoration Hardware Protection (BCD-31) by ensuring the organization can restore operations and data when the primary control is absent. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "BCD-31.1", "risk_if_not_implemented": "Without Restoration Integrity Verification, data, software and system images cannot be reliably restored within required recovery objectives following a disruption. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Data Loss / Integrity Compromise (R-BC-2), Recovery Failure / Unacceptable Recovery Delay (R-OR-1), Loss of Data Integrity (R-IP-3), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9), Data Quality Degradation / Data Poisoning (MT-12).", "compensating_control_1": { "control_id": "BCD-24", "name": "Data Backups", "description": "Mechanisms exist to create recurring backups of data, software and/or system images, as well as verify the integrity of these backups, to ensure the availability of the data to satisfy Recovery Time Objectives (RTOs) and Recovery Point Objectives (RPOs).", "justification": "Data Backups (BCD-24) provides resilience and recovery capability that compensates for the absence of Restoration Integrity Verification (BCD-31.1) by ensuring the organization can restore operations and data when the primary control is absent. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "PES-02", "name": "Physical & Environmental Protections", "description": "Mechanisms exist to facilitate the operation of physical and environmental protection controls.", "justification": "Physical & Environmental Protections (PES-02) provides physical access control that compensates for the absence of Restoration Integrity Verification (BCD-31.1) by preventing unauthorized physical interaction with systems and infrastructure. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "BCD-32", "risk_if_not_implemented": "Without Testing for Reliability & Integrity, critical business processes and services may not withstand or recover from disruption, causing extended outages and data loss. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Data Loss / Integrity Compromise (R-BC-2), Lack of oversight of internal controls (R-GV-6), Inability to Demonstrate Due Diligence / Due Care (R-GV-9), Unreliable Assurance / Decision Information (R-GV-10), Recovery Failure / Unacceptable Recovery Delay (R-OR-1), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9).", "compensating_control_1": { "control_id": "BCD-31", "name": "Data Backup & Restoration Hardware Protection", "description": "Mechanisms exist to protect data backup and restoration hardware and software.", "justification": "Data Backup & Restoration Hardware Protection (BCD-31) provides resilience and recovery capability that compensates for the absence of Testing for Reliability & Integrity (BCD-32) by ensuring the organization can restore operations and data when the primary control is absent. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "BCD-19", "name": "Isolated Recovery Environment", "description": "Mechanisms exist to utilize an isolated, non-production environment to perform data backup and recovery operations through offline, cloud or off-site capabilities.", "justification": "Isolated Recovery Environment (BCD-19) provides resilience and recovery capability that compensates for the absence of Testing for Reliability & Integrity (BCD-32) by ensuring the organization can restore operations and data when the primary control is absent. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "BCD-32.1", "risk_if_not_implemented": "Without Test Restoration Using Sampling, data, software and system images cannot be reliably restored within required recovery objectives following a disruption. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Recovery Failure / Unacceptable Recovery Delay (R-OR-1), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9).", "compensating_control_1": { "control_id": "CRY-07", "name": "Encrypting Data At Rest", "description": "Cryptographic mechanisms exist to prevent the unauthorized disclosure of data at rest.", "justification": "Encrypting Data At Rest (CRY-07) provides cryptographic protection that compensates for the absence of Test Restoration Using Sampling (BCD-32.1) by ensuring data confidentiality and integrity through alternative technical means. Given the data-handling focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "BCD-24", "name": "Data Backups", "description": "Mechanisms exist to create recurring backups of data, software and/or system images, as well as verify the integrity of these backups, to ensure the availability of the data to satisfy Recovery Time Objectives (RTOs) and Recovery Point Objectives (RPOs).", "justification": "Data Backups (BCD-24) provides resilience and recovery capability that compensates for the absence of Test Restoration Using Sampling (BCD-32.1) by ensuring the organization can restore operations and data when the primary control is absent. Given the data-handling focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "BCD-33", "risk_if_not_implemented": "Without Data Backup Modification and/or Destruction, data, software and system images cannot be reliably restored within required recovery objectives following a disruption. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Excessive or Unauthorized Privilege (R-AC-2), Unauthorized Access (R-AC-4), Unauthorized Modification / Loss of System Integrity (R-AM-2), Data Loss / Integrity Compromise (R-BC-2), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9), Fraud, Corruption and/or Intentional Criminal Conduct (MT-14).", "compensating_control_1": { "control_id": "BCD-31", "name": "Data Backup & Restoration Hardware Protection", "description": "Mechanisms exist to protect data backup and restoration hardware and software.", "justification": "Data Backup & Restoration Hardware Protection (BCD-31) provides resilience and recovery capability that compensates for the absence of Backup Modification and/or Destruction (BCD-33) by ensuring the organization can restore operations and data when the primary control is absent. Given the data-handling focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "BCD-12", "name": "Alternate Storage Site", "description": "Mechanisms exist to establish an alternate storage site that stores both the assets and necessary agreements needed for the recovery of Technology Assets, Applications, Services and/or Data (TAASD).", "justification": "Alternate Storage Site (BCD-12) provides resilience and recovery capability that compensates for the absence of Backup Modification and/or Destruction (BCD-33) by ensuring the organization can restore operations and data when the primary control is absent. Given the data-handling focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "BCD-33.1", "risk_if_not_implemented": "Without Dual Authorization For Sensitive / Regulated Backup Media Destruction, data, software and system images cannot be reliably restored within required recovery objectives following a disruption. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss of Accountability / Attribution (R-AC-1), Data Loss / Integrity Compromise (R-BC-2), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Fraud, Corruption and/or Intentional Criminal Conduct (MT-14), Conflict of Interest (COI) / Undue Influence / Insider Misconduct (MT-15), Workforce Shortage / Loss of Critical Skills / Labor Disruption (MT-25).", "compensating_control_1": { "control_id": "BCD-24", "name": "Data Backups", "description": "Mechanisms exist to create recurring backups of data, software and/or system images, as well as verify the integrity of these backups, to ensure the availability of the data to satisfy Recovery Time Objectives (RTOs) and Recovery Point Objectives (RPOs).", "justification": "Data Backups (BCD-24) provides resilience and recovery capability that compensates for the absence of Dual Authorization For Backup Media Destruction (BCD-33.1) by ensuring the organization can restore operations and data when the primary control is absent. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "BCD-31", "name": "Data Backup & Restoration Hardware Protection", "description": "Mechanisms exist to protect data backup and restoration hardware and software.", "justification": "Data Backup & Restoration Hardware Protection (BCD-31) provides resilience and recovery capability that compensates for the absence of Dual Authorization For Backup Media Destruction (BCD-33.1) by ensuring the organization can restore operations and data when the primary control is absent. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "CAP-02", "risk_if_not_implemented": "Without Capacity & Performance Management, Technology Assets, Applications and/or Services (TAAS) may become unavailable, degraded or unable to meet demand when required. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Business / Service Interruption (R-BC-1), Reduced Operational Productivity (R-BC-3), Loss of Data / Service Availability (R-IP-4), and most likely increases susceptibility to Human Error (MT-9), Data Quality Degradation / Data Poisoning (MT-12).", "compensating_control_1": { "control_id": "MON-02", "name": "Continuous Monitoring", "description": "Mechanisms exist to facilitate the implementation of enterprise-wide monitoring controls.", "justification": "Continuous Monitoring (MON-02) provides detective monitoring capability that compensates for the absence of Capacity & Performance Management (CAP-02) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "BCD-02", "name": "Business Continuity Management System (BCMS)", "description": "Mechanisms exist to operate a Business Continuity Management System (BCMS) to achieve resilient Technology Assets, Applications, Services and/or Data (TAASD) during:\n(1) Routine operations; and\n(2) Adverse conditions.", "justification": "Business Continuity Management System (BCMS) (BCD-02) provides resilience and recovery capability that compensates for the absence of Capacity & Performance Management (CAP-02) by ensuring the organization can restore operations and data when the primary control is absent. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "CAP-03", "risk_if_not_implemented": "Without Capacity Planning, Technology Assets, Applications and/or Services (TAAS) may become unavailable, degraded or unable to meet demand when required. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Recovery Failure / Unacceptable Recovery Delay (R-OR-1), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Data Quality Degradation / Data Poisoning (MT-12).", "compensating_control_1": { "control_id": "RSK-13", "name": "Risk Assessment", "description": "Mechanisms exist to conduct recurring assessments of risk that includes the likelihood and magnitude of harm, from unauthorized access, use, disclosure, disruption, modification or destruction of the organization's Technology Assets, Applications, Services and/or Data (TAASD).", "justification": "Risk Assessment (RSK-13) provides periodic assessment and assurance that compensates for the absence of Capacity Planning (CAP-03) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "BCD-02", "name": "Business Continuity Management System (BCMS)", "description": "Mechanisms exist to operate a Business Continuity Management System (BCMS) to achieve resilient Technology Assets, Applications, Services and/or Data (TAASD) during:\n(1) Routine operations; and\n(2) Adverse conditions.", "justification": "Business Continuity Management System (BCMS) (BCD-02) provides resilience and recovery capability that compensates for the absence of Capacity Planning (CAP-03) by ensuring the organization can restore operations and data when the primary control is absent. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "CAP-04", "risk_if_not_implemented": "Without Resource Priority, Technology Assets, Applications and/or Services (TAAS) may become unavailable, degraded or unable to meet demand when required. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Business / Service Interruption (R-BC-1), System / Data Compromise (Technical Vector) (R-BC-4), Loss of Data / Service Availability (R-IP-4), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "BCD-13", "name": "Alternate Processing Site", "description": "Mechanisms exist to establish an alternate processing site that provides processing capability and security measures equivalent to that of the primary site.", "justification": "Alternate Processing Site (BCD-13) provides resilience and recovery capability that compensates for the absence of Resource Priority (CAP-04) by ensuring the organization can restore operations and data when the primary control is absent. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "MON-02", "name": "Continuous Monitoring", "description": "Mechanisms exist to facilitate the implementation of enterprise-wide monitoring controls.", "justification": "Continuous Monitoring (MON-02) provides detective monitoring capability that compensates for the absence of Resource Priority (CAP-04) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "CAP-05", "risk_if_not_implemented": "Without Performance Monitoring, Technology Assets, Applications and/or Services (TAAS) may become unavailable, degraded or unable to meet demand when required. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Undetected / Delayed Detection of Adverse Activity (R-SA-1), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "MON-02", "name": "Continuous Monitoring", "description": "Mechanisms exist to facilitate the implementation of enterprise-wide monitoring controls.", "justification": "Continuous Monitoring (MON-02) provides detective monitoring capability that compensates for the absence of Performance Monitoring (CAP-05) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "MON-06", "name": "Monitoring Reporting", "description": "Mechanisms exist to provide an event log report generation capability to aid in detecting and assessing anomalous activities.", "justification": "Monitoring Reporting (MON-06) provides detective monitoring capability that compensates for the absence of Performance Monitoring (CAP-05) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "CAP-06", "risk_if_not_implemented": "Without Elastic Expansion, Technology Assets, Applications and/or Services (TAAS) may become unavailable, degraded or unable to meet demand when required. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Business / Service Interruption (R-BC-1), Loss of Data / Service Availability (R-IP-4), and most likely increases susceptibility to Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "BCD-13", "name": "Alternate Processing Site", "description": "Mechanisms exist to establish an alternate processing site that provides processing capability and security measures equivalent to that of the primary site.", "justification": "Alternate Processing Site (BCD-13) provides resilience and recovery capability that compensates for the absence of Elastic Expansion (CAP-06) by ensuring the organization can restore operations and data when the primary control is absent. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CAP-03", "name": "Capacity Planning", "description": "Mechanisms exist to conduct capacity planning so that necessary capacity for information processing, telecommunications and environmental support will exist during contingency operations.", "justification": "Capacity Planning (CAP-03) provides overlapping security capability that compensates for the absence of Elastic Expansion (CAP-06) by addressing related risk objectives through an alternative control mechanism aligned with Technology applicability. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "CAP-07", "risk_if_not_implemented": "Without Regional Delivery, Technology Assets, Applications and/or Services (TAAS) may become unavailable, degraded or unable to meet demand when required. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Business / Service Interruption (R-BC-1), Concentration / Single-Point Dependency Failure (R-OR-2), and most likely increases susceptibility to Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "NET-02", "name": "Network Security Controls (NSC)", "description": "Mechanisms exist to develop, govern & update procedures to facilitate the implementation of Network Security Controls (NSC).", "justification": "Network Security Controls (NSC) (NET-02) provides network-level access restriction that compensates for the absence of Regional Delivery (CAP-07) by limiting attacker reach and lateral movement opportunities across the environment. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "BCD-17", "name": "Telecommunications Services Availability", "description": "Mechanisms exist to reduce the likelihood of a single point of failure with primary telecommunications services.", "justification": "Telecommunications Services Availability (BCD-17) provides overlapping security capability that compensates for the absence of Regional Delivery (CAP-07) by addressing related risk objectives through an alternative control mechanism aligned with Technology applicability. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "CAP-08", "risk_if_not_implemented": "Without Resiliency Planning For Alternate Sites, data, software and system images cannot be reliably restored within required recovery objectives following a disruption. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Recovery Failure / Unacceptable Recovery Delay (R-OR-1), Concentration / Single-Point Dependency Failure (R-OR-2), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9).", "compensating_control_1": { "control_id": "BCD-13", "name": "Alternate Processing Site", "description": "Mechanisms exist to establish an alternate processing site that provides processing capability and security measures equivalent to that of the primary site.", "justification": "Alternate Processing Site (BCD-13) provides resilience and recovery capability that compensates for the absence of Resiliency Planning For Alternate Sites (CAP-08) by ensuring the organization can restore operations and data when the primary control is absent. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CAP-03", "name": "Capacity Planning", "description": "Mechanisms exist to conduct capacity planning so that necessary capacity for information processing, telecommunications and environmental support will exist during contingency operations.", "justification": "Capacity Planning (CAP-03) provides overlapping security capability that compensates for the absence of Resiliency Planning For Alternate Sites (CAP-08) by addressing related risk objectives through an alternative control mechanism. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "CHG-03", "risk_if_not_implemented": "Without Configuration Change Control, unauthorized, untested or undocumented changes may introduce vulnerabilities, instability or loss of system integrity. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Modification / Loss of System Integrity (R-AM-2), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9).", "compensating_control_1": { "control_id": "CFG-08.2", "name": "Integrity Assurance & Enforcement (IAE)", "description": "Automated mechanisms exist to:\n(1) Identify unauthorized deviations from an approved secure baseline configuration; and\n(2) Implement automated resiliency actions to remediate the unauthorized change.", "justification": "Integrity Assurance & Enforcement (IAE) (CFG-08.2) provides configuration hardening that compensates for the absence of Configuration Change Control (CHG-03) by eliminating unnecessary services and enforcing secure settings to reduce inherent exposure. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "MON-02", "name": "Continuous Monitoring", "description": "Mechanisms exist to facilitate the implementation of enterprise-wide monitoring controls.", "justification": "Continuous Monitoring (MON-02) provides detective monitoring capability that compensates for the absence of Configuration Change Control (CHG-03) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "CHG-04.1", "risk_if_not_implemented": "Without Access Restriction For Change, unauthorized, untested or undocumented changes may introduce vulnerabilities, instability or loss of system integrity. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Excessive or Unauthorized Privilege (R-AC-2), Unauthorized Modification / Loss of System Integrity (R-AM-2), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Dysfunctional Management Practices (MT-8), Human Error (MT-9).", "compensating_control_1": { "control_id": "IAC-30", "name": "Least Privilege", "description": "Mechanisms exist to utilize the concept of least privilege, allowing only authorized access to processes necessary to accomplish assigned tasks in accordance with organizational business functions.", "justification": "Least Privilege (IAC-30) provides access control enforcement that compensates for the absence of Access Restriction For Change (CHG-04) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "IAC-10", "name": "Privileged Account Management (PAM)", "description": "Mechanisms exist to restrict and control privileged access rights for users and Technology Assets, Applications and/or Services (TAAS).", "justification": "Privileged Account Management (PAM) (IAC-10) provides access control enforcement that compensates for the absence of Access Restriction For Change (CHG-04) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "CHG-04.2", "risk_if_not_implemented": "Without Role-Based Permissions To Implement Changes, users, services and processes may obtain or retain access beyond authorized need, enabling misuse or escalation. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Excessive or Unauthorized Privilege (R-AC-2), Unauthorized Modification / Loss of System Integrity (R-AM-2), and most likely increases susceptibility to Malicious Cyber Activity (MT-2).", "compensating_control_1": { "control_id": "HRS-14", "name": "Separation of Duties (SoD)", "description": "Mechanisms exist to implement and maintain Separation of Duties (SoD) to prevent potential inappropriate activity without collusion.", "justification": "Separation of Duties (SoD) (HRS-14) provides overlapping security capability that compensates for the absence of Permissions To Implement Changes (CHG-04.4) by addressing related risk objectives through an alternative control mechanism aligned with Technology applicability. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CHG-04", "name": "Prohibition Of Changes", "description": "Mechanisms exist to prohibit unauthorized changes, unless approved through the organization's defined change management processes.", "justification": "Prohibition Of Changes (CHG-04) provides access control enforcement that compensates for the absence of Permissions To Implement Changes (CHG-04.4) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "CHG-04.3", "risk_if_not_implemented": "Without Dual Authorization for Changes To Critical / Sensitive Technology Assets, Applications and/or Services (TAAS), users, services and processes may obtain or retain access beyond authorized need, enabling misuse or escalation. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Modification / Loss of System Integrity (R-AM-2), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Fraud, Corruption and/or Intentional Criminal Conduct (MT-14), Conflict of Interest (COI) / Undue Influence / Insider Misconduct (MT-15), Workforce Shortage / Loss of Critical Skills / Labor Disruption (MT-25).", "compensating_control_1": { "control_id": "IAC-30", "name": "Least Privilege", "description": "Mechanisms exist to utilize the concept of least privilege, allowing only authorized access to processes necessary to accomplish assigned tasks in accordance with organizational business functions.", "justification": "Least Privilege (IAC-30) provides access control enforcement that compensates for the absence of Dual Authorization for Change (CHG-04.3) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CHG-04", "name": "Prohibition Of Changes", "description": "Mechanisms exist to prohibit unauthorized changes, unless approved through the organization's defined change management processes.", "justification": "Prohibition Of Changes (CHG-04) provides access control enforcement that compensates for the absence of Dual Authorization for Change (CHG-04.3) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "CHG-04.4", "risk_if_not_implemented": "Without Dual Approval For High-Impact Environments, unauthorized, untested or undocumented changes may introduce vulnerabilities, instability or loss of system integrity. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Modification / Loss of System Integrity (R-AM-2), Business / Service Interruption (R-BC-1), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Fraud, Corruption and/or Intentional Criminal Conduct (MT-14), Conflict of Interest (COI) / Undue Influence / Insider Misconduct (MT-15), Workforce Shortage / Loss of Critical Skills / Labor Disruption (MT-25).", "compensating_control_1": { "control_id": "HRS-14", "name": "Separation of Duties (SoD)", "description": "Mechanisms exist to implement and maintain Separation of Duties (SoD) to prevent potential inappropriate activity without collusion.", "justification": "Separation of Duties (SoD) (HRS-14) provides overlapping security capability that compensates for the absence of Dual Approval For High-Impact Environments (CHG-04.4) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "IAC-30", "name": "Least Privilege", "description": "Mechanisms exist to utilize the concept of least privilege, allowing only authorized access to processes necessary to accomplish assigned tasks in accordance with organizational business functions.", "justification": "Least Privilege (IAC-30) provides access control enforcement that compensates for the absence of Dual Approval For High-Impact Environments (CHG-04.4) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "CHG-05", "risk_if_not_implemented": "Without Security, Compliance & Resilience Representative for Asset Lifecycle Changes, unauthorized, untested or undocumented changes may introduce vulnerabilities, instability or loss of system integrity. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unaddressed Security / Compliance Exposure (R-GV-2), Unperformed / Unowned Control Responsibilities (R-GV-3), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Workforce Shortage / Loss of Critical Skills / Labor Disruption (MT-25).", "compensating_control_1": { "control_id": "CHG-10", "name": "Emergency Changes", "description": "Mechanisms exist to govern change management procedures for \"emergency\" changes.", "justification": "Emergency Changes (CHG-10) provides change management discipline that compensates for the absence of Security, Compliance & Resilience Representative for Asset Lifecycle Changes (CHG-05) by ensuring changes to systems and configurations are controlled and reviewed to prevent unintended security impacts. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CHG-04.4", "name": "Dual Approval For High-Impact Environments", "description": "Mechanisms exist to require dual approval for any changes that might result in a serious incident that could adversely impact:\n(1) Business processes; and/or\n(2) Technology Assets, Applications, Services and/or Data (TAASD).", "justification": "Dual Approval For High-Impact Environments (CHG-04.4) provides overlapping security capability that compensates for the absence of Security, Compliance & Resilience Representative for Asset Lifecycle Changes (CHG-05) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "CHG-06", "risk_if_not_implemented": "Without Security Impact Analysis for Changes, unauthorized, untested or undocumented changes may introduce vulnerabilities, instability or loss of system integrity. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unaddressed Security / Compliance Exposure (R-GV-2), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9).", "compensating_control_1": { "control_id": "RSK-13", "name": "Risk Assessment", "description": "Mechanisms exist to conduct recurring assessments of risk that includes the likelihood and magnitude of harm, from unauthorized access, use, disclosure, disruption, modification or destruction of the organization's Technology Assets, Applications, Services and/or Data (TAASD).", "justification": "Risk Assessment (RSK-13) provides periodic assessment and assurance that compensates for the absence of Security Impact Analysis for Changes (CHG-06) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CPL-05", "name": "Conformity Monitoring", "description": "Mechanisms exist to validate that Technology Assets, Applications, Services and/or Data (TAASD) conform to the organization's security, compliance and/or resilience policies, standards and other applicable requirements.", "justification": "Conformity Monitoring (CPL-05) provides periodic assessment and assurance that compensates for the absence of Security Impact Analysis for Changes (CHG-06) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "CHG-07", "risk_if_not_implemented": "Without Test, Validate & Document Changes, unauthorized, untested or undocumented changes may introduce vulnerabilities, instability or loss of system integrity. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Modification / Loss of System Integrity (R-AM-2), Business / Service Interruption (R-BC-1), Loss of Data / Service Availability (R-IP-4), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9).", "compensating_control_1": { "control_id": "CHG-09", "name": "Control Functionality Verification", "description": "Mechanisms exist to verify the functionality of security, compliance and resilience controls following implemented changes to ensure applicable controls operate as designed.", "justification": "Control Functionality Verification (CHG-09) provides overlapping security capability that compensates for the absence of Test, Validate & Document Changes (CHG-07) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "MON-02", "name": "Continuous Monitoring", "description": "Mechanisms exist to facilitate the implementation of enterprise-wide monitoring controls.", "justification": "Continuous Monitoring (MON-02) provides detective monitoring capability that compensates for the absence of Test, Validate & Document Changes (CHG-07) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "CHG-08", "risk_if_not_implemented": "Without Stakeholder Notification of Changes, unauthorized, untested or undocumented changes may introduce vulnerabilities, instability or loss of system integrity. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unreliable Assurance / Decision Information (R-GV-10), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9).", "compensating_control_1": { "control_id": "MON-06", "name": "Monitoring Reporting", "description": "Mechanisms exist to provide an event log report generation capability to aid in detecting and assessing anomalous activities.", "justification": "Monitoring Reporting (MON-06) provides detective monitoring capability that compensates for the absence of Stakeholder Notification of Changes (CHG-08) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "GOV-04", "name": "Publishing Security, Compliance & Resilience Documentation", "description": "Mechanisms exist to establish, maintain and disseminate policies, standards and procedures necessary for secure, compliant and resilient capabilities.", "justification": "Publishing Security, Compliance & Resilience Documentation (GOV-04) provides resilience and recovery capability that compensates for the absence of Stakeholder Notification of Changes (CHG-08) by ensuring the organization can restore operations and data when the primary control is absent. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "CHG-09", "risk_if_not_implemented": "Without Control Functionality Verification, unauthorized, untested or undocumented changes may introduce vulnerabilities, instability or loss of system integrity. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unaddressed Security / Compliance Exposure (R-GV-2), Lack of oversight of internal controls (R-GV-6), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9).", "compensating_control_1": { "control_id": "CPL-05", "name": "Conformity Monitoring", "description": "Mechanisms exist to validate that Technology Assets, Applications, Services and/or Data (TAASD) conform to the organization's security, compliance and/or resilience policies, standards and other applicable requirements.", "justification": "Conformity Monitoring (CPL-05) provides periodic assessment and assurance that compensates for the absence of Control Functionality Verification (CHG-09) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "MON-02", "name": "Continuous Monitoring", "description": "Mechanisms exist to facilitate the implementation of enterprise-wide monitoring controls.", "justification": "Continuous Monitoring (MON-02) provides detective monitoring capability that compensates for the absence of Control Functionality Verification (CHG-09) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "CHG-09.1", "risk_if_not_implemented": "Without Report Verification Results, unauthorized, untested or undocumented changes may introduce vulnerabilities, instability or loss of system integrity. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Lack of oversight of internal controls (R-GV-6), Inability to Demonstrate Due Diligence / Due Care (R-GV-9), Unreliable Assurance / Decision Information (R-GV-10), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Conflict of Interest (COI) / Undue Influence / Insider Misconduct (MT-15).", "compensating_control_1": { "control_id": "MON-02", "name": "Continuous Monitoring", "description": "Mechanisms exist to facilitate the implementation of enterprise-wide monitoring controls.", "justification": "Continuous Monitoring (MON-02) provides detective monitoring capability that compensates for the absence of Report Verification Results (CHG-09.1) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CPL-05", "name": "Conformity Monitoring", "description": "Mechanisms exist to validate that Technology Assets, Applications, Services and/or Data (TAASD) conform to the organization's security, compliance and/or resilience policies, standards and other applicable requirements.", "justification": "Conformity Monitoring (CPL-05) provides periodic assessment and assurance that compensates for the absence of Report Verification Results (CHG-09.1) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "CHG-10", "risk_if_not_implemented": "Without Emergency Changes, unauthorized, untested or undocumented changes may introduce vulnerabilities, instability or loss of system integrity. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Modification / Loss of System Integrity (R-AM-2), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9).", "compensating_control_1": { "control_id": "RSK-13", "name": "Risk Assessment", "description": "Mechanisms exist to conduct recurring assessments of risk that includes the likelihood and magnitude of harm, from unauthorized access, use, disclosure, disruption, modification or destruction of the organization's Technology Assets, Applications, Services and/or Data (TAASD).", "justification": "Risk Assessment (RSK-13) provides periodic assessment and assurance that compensates for the absence of Emergency Changes (CHG-10) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CHG-06", "name": "Security Impact Analysis for Changes", "description": "Mechanisms exist to analyze proposed changes for potential security impacts, prior to the implementation of the change.", "justification": "Security Impact Analysis for Changes (CHG-06) provides risk identification and prioritization that compensates for the absence of Emergency Changes (CHG-10) by enabling informed decisions about where to focus resources to manage residual exposure. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "CHG-10.1", "risk_if_not_implemented": "Without Documenting Emergency Changes, unauthorized, untested or undocumented changes may introduce vulnerabilities, instability or loss of system integrity. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss of Accountability / Attribution (R-AC-1), Inability to Demonstrate Due Diligence / Due Care (R-GV-9), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9).", "compensating_control_1": { "control_id": "CHG-06", "name": "Security Impact Analysis for Changes", "description": "Mechanisms exist to analyze proposed changes for potential security impacts, prior to the implementation of the change.", "justification": "Security Impact Analysis for Changes (CHG-06) provides risk identification and prioritization that compensates for the absence of Documenting Emergency Changes (CHG-10.1) by enabling informed decisions about where to focus resources to manage residual exposure. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "RSK-13", "name": "Risk Assessment", "description": "Mechanisms exist to conduct recurring assessments of risk that includes the likelihood and magnitude of harm, from unauthorized access, use, disclosure, disruption, modification or destruction of the organization's Technology Assets, Applications, Services and/or Data (TAASD).", "justification": "Risk Assessment (RSK-13) provides periodic assessment and assurance that compensates for the absence of Documenting Emergency Changes (CHG-10.1) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "CHG-11", "risk_if_not_implemented": "Without Post Configuration Change Reviews, unauthorized, untested or undocumented changes may introduce vulnerabilities, instability or loss of system integrity. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Modification / Loss of System Integrity (R-AM-2), Undetected / Delayed Detection of Adverse Activity (R-SA-1), and most likely increases susceptibility to Human Error (MT-9), Data Quality Degradation / Data Poisoning (MT-12).", "compensating_control_1": { "control_id": "HRS-14", "name": "Separation of Duties (SoD)", "description": "Mechanisms exist to implement and maintain Separation of Duties (SoD) to prevent potential inappropriate activity without collusion.", "justification": "Separation of Duties (SoD) (HRS-14) provides overlapping security capability that compensates for the absence of Automated Access Enforcement / Auditing (CHG-11) by addressing related risk objectives through an alternative control mechanism aligned with Technology applicability. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "IAC-30", "name": "Least Privilege", "description": "Mechanisms exist to utilize the concept of least privilege, allowing only authorized access to processes necessary to accomplish assigned tasks in accordance with organizational business functions.", "justification": "Least Privilege (IAC-30) provides access control enforcement that compensates for the absence of Automated Access Enforcement / Auditing (CHG-11) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "CHG-11.1", "risk_if_not_implemented": "Without Automated Security Response, unauthorized, untested or undocumented changes may introduce vulnerabilities, instability or loss of system integrity. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Modification / Loss of System Integrity (R-AM-2), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "CFG-08.2", "name": "Integrity Assurance & Enforcement (IAE)", "description": "Automated mechanisms exist to:\n(1) Identify unauthorized deviations from an approved secure baseline configuration; and\n(2) Implement automated resiliency actions to remediate the unauthorized change.", "justification": "Integrity Assurance & Enforcement (IAE) (CFG-08.2) provides configuration hardening that compensates for the absence of Automated Security Response (CHG-11.1) by eliminating unnecessary services and enforcing secure settings to reduce inherent exposure. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CHG-03", "name": "Configuration Change Control", "description": "Mechanisms exist to govern the technical configuration change control processes.", "justification": "Configuration Change Control (CHG-03) provides configuration hardening that compensates for the absence of Automated Security Response (CHG-11.1) by eliminating unnecessary services and enforcing secure settings to reduce inherent exposure. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "CHG-12", "risk_if_not_implemented": "Without Unauthorized Software Installation Alerts, Technology Assets, Applications and/or Services (TAAS) may operate with insecure, unauthorized or drifted configurations that expand the attack surface. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Modification / Loss of System Integrity (R-AM-2), Undetected / Delayed Detection of Adverse Activity (R-SA-1), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "IAC-30", "name": "Least Privilege", "description": "Mechanisms exist to utilize the concept of least privilege, allowing only authorized access to processes necessary to accomplish assigned tasks in accordance with organizational business functions.", "justification": "Least Privilege (IAC-30) provides access control enforcement that compensates for the absence of Software Installation Alerts (END-03.1) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CFG-03", "name": "Least Functionality", "description": "Mechanisms exist to configure Technology Assets, Applications and/or Services (TAAS) to provide only essential capabilities by specifically prohibiting or restricting the use of ports, protocols, and/or services.", "justification": "Least Functionality (CFG-03) provides configuration hardening that compensates for the absence of Software Installation Alerts (END-03.1) by eliminating unnecessary services and enforcing secure settings to reduce inherent exposure. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "CHG-13", "risk_if_not_implemented": "Without Signed Components, unauthorized, untested or undocumented changes may introduce vulnerabilities, instability or loss of system integrity. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Modification / Loss of System Integrity (R-AM-2), Counterfeit / Non-Conforming Component Impact (R-SC-7), Loss of Authenticity / Provenance (R-IP-5), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Counterfeit / Non-Conforming Products (MT-20), Cryptographic Compromise / Cryptanalytic Capability Advancement (MT-31).", "compensating_control_1": { "control_id": "IAC-10", "name": "Privileged Account Management (PAM)", "description": "Mechanisms exist to restrict and control privileged access rights for users and Technology Assets, Applications and/or Services (TAAS).", "justification": "Privileged Account Management (PAM) (IAC-10) provides access control enforcement that compensates for the absence of Signed Components (CHG-13) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "IAC-30", "name": "Least Privilege", "description": "Mechanisms exist to utilize the concept of least privilege, allowing only authorized access to processes necessary to accomplish assigned tasks in accordance with organizational business functions.", "justification": "Least Privilege (IAC-30) provides access control enforcement that compensates for the absence of Signed Components (CHG-13) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "CLD-03", "risk_if_not_implemented": "Without Cloud Infrastructure Onboarding, cloud-hosted Technology Assets, Applications and/or Services (TAAS) may be misconfigured, over-exposed or governed inconsistently with on-premises controls. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Access (R-AC-4), Unaddressed Security / Compliance Exposure (R-GV-2), Uncontrolled Internal Security / Privacy Exposure (R-GV-4), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11).", "compensating_control_1": { "control_id": "TPM-14", "name": "Third-Party Contract Requirements", "description": "Mechanisms exist to require contractual requirements for applicable security, compliance and resilience requirements with third-parties, reflecting the organization's needs to protect its Technology Assets, Applications, Services and/or Data (TAASD).", "justification": "Third-Party Contract Requirements (TPM-14) provides third-party oversight that compensates for the absence of Cloud Infrastructure Onboarding (CLD-03) by extending security obligations contractually and monitoring third-party risk in lieu of direct control. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "RSK-13", "name": "Risk Assessment", "description": "Mechanisms exist to conduct recurring assessments of risk that includes the likelihood and magnitude of harm, from unauthorized access, use, disclosure, disruption, modification or destruction of the organization's Technology Assets, Applications, Services and/or Data (TAASD).", "justification": "Risk Assessment (RSK-13) provides periodic assessment and assurance that compensates for the absence of Cloud Infrastructure Onboarding (CLD-03) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "CLD-03.1", "risk_if_not_implemented": "Without Customer Responsibility Matrix (CRM), security, compliance and resilience activities may lack direction, ownership and executive support, leaving required controls unperformed. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unaddressed Security / Compliance Exposure (R-GV-2), Unperformed / Unowned Control Responsibilities (R-GV-3), and most likely increases susceptibility to Human Error (MT-9).", "compensating_control_1": { "control_id": "IAC-25", "name": "Access Enforcement", "description": "Mechanisms exist to enforce Logical Access Control (LAC) permissions that conform to the principle of \"least privilege.\"", "justification": "Access Enforcement (IAC-25) provides access control enforcement that compensates for the absence of Customer Responsibility Matrix (CRM) (CLD-03.1) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "NET-06", "name": "Network Segmentation (macrosegmentation)", "description": "Mechanisms exist to implement network segmentation within network architectures to isolate Technology Assets, Applications and/or Services (TAAS) from other network resources.", "justification": "Network Segmentation (macrosegmentation) (NET-06) provides network-level access restriction that compensates for the absence of Customer Responsibility Matrix (CRM) (CLD-03.1) by limiting attacker reach and lateral movement opportunities across the environment. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "CLD-04", "risk_if_not_implemented": "Without Cloud Infrastructure Offboarding, cloud-hosted Technology Assets, Applications and/or Services (TAAS) may be misconfigured, over-exposed or governed inconsistently with on-premises controls. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Retention / Inability to Dispose of Data (R-AM-3), Data Loss / Integrity Compromise (R-BC-2), Loss of Data / Service Availability (R-IP-4), and most likely increases susceptibility to Human Error (MT-9), Supplier Financial Distress / Insolvency (MT-24).", "compensating_control_1": { "control_id": "TPM-04", "name": "Supply Chain Risk Management (SCRM)", "description": "Mechanisms exist to:\n(1) Evaluate security risks and threats associated with Technology Assets, Applications and/or Services (TAAS) supply chains; and\n(2) Take appropriate remediation actions to minimize the organization's exposure to those risks and threats, as necessary.", "justification": "Supply Chain Risk Management (SCRM) (TPM-04) provides risk identification and prioritization that compensates for the absence of Cloud Infrastructure Offboarding (CLD-04) by enabling informed decisions about where to focus resources to manage residual exposure. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "RSK-20", "name": "Supply Chain Risk Management (SCRM) Plan", "description": "Mechanisms exist to develop a plan for Supply Chain Risk Management (SCRM) associated with the development, acquisition, maintenance and disposal of Technology Assets, Applications and/or Services (TAAS), including documenting selected mitigating actions and monitoring performance against those plans.", "justification": "Supply Chain Risk Management (SCRM) Plan (RSK-20) provides risk identification and prioritization that compensates for the absence of Cloud Infrastructure Offboarding (CLD-04) by enabling informed decisions about where to focus resources to manage residual exposure. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "CLD-05", "risk_if_not_implemented": "Without Cloud Security Architecture, security may be bolted on rather than designed in, resulting in structural weaknesses that are costly to remediate and easy to exploit. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Failure to Support Business / Mission Objectives (R-GV-1), Unaddressed Security / Compliance Exposure (R-GV-2), Uncontrolled Internal Security / Privacy Exposure (R-GV-4), and most likely increases susceptibility to Human Error (MT-9).", "compensating_control_1": { "control_id": "SEA-05", "name": "Secure Engineering Principles", "description": "Mechanisms exist to facilitate the implementation of industry-recognized security, compliance and resilience practices in the specification, design, development, implementation and modification of Technology Assets, Applications and/or Services (TAAS).", "justification": "Secure Engineering Principles (SEA-05) provides overlapping security capability that compensates for the absence of Cloud Security Architecture (CLD-05) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "NET-06", "name": "Network Segmentation (macrosegmentation)", "description": "Mechanisms exist to implement network segmentation within network architectures to isolate Technology Assets, Applications and/or Services (TAAS) from other network resources.", "justification": "Network Segmentation (macrosegmentation) (NET-06) provides network-level access restriction that compensates for the absence of Cloud Security Architecture (CLD-05) by limiting attacker reach and lateral movement opportunities across the environment. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "CLD-06", "risk_if_not_implemented": "Without Cloud Infrastructure Security Subnet, adversaries may move laterally, exfiltrate data or reach systems that should have been isolated from untrusted networks. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Access (R-AC-4), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "NET-06", "name": "Network Segmentation (macrosegmentation)", "description": "Mechanisms exist to implement network segmentation within network architectures to isolate Technology Assets, Applications and/or Services (TAAS) from other network resources.", "justification": "Network Segmentation (macrosegmentation) (NET-06) provides network-level access restriction that compensates for the absence of Cloud Infrastructure Security Subnet (CLD-06) by limiting attacker reach and lateral movement opportunities across the environment. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "NET-03", "name": "Boundary Protection", "description": "Mechanisms exist to monitor and control communications at the external network boundary and at key internal boundaries within the network.", "justification": "Boundary Protection (NET-03) provides network-level access restriction that compensates for the absence of Cloud Infrastructure Security Subnet (CLD-06) by limiting attacker reach and lateral movement opportunities across the environment. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "CLD-07", "risk_if_not_implemented": "Without Multi-Tenant Environments, cloud-hosted Technology Assets, Applications and/or Services (TAAS) may be misconfigured, over-exposed or governed inconsistently with on-premises controls. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Access (R-AC-4), Loss of Confidentiality (R-IP-2), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "NET-06", "name": "Network Segmentation (macrosegmentation)", "description": "Mechanisms exist to implement network segmentation within network architectures to isolate Technology Assets, Applications and/or Services (TAAS) from other network resources.", "justification": "Network Segmentation (macrosegmentation) (NET-06) provides network-level access restriction that compensates for the absence of Multi-Tenant Environments (CLD-07) by limiting attacker reach and lateral movement opportunities across the environment. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "IAC-25", "name": "Access Enforcement", "description": "Mechanisms exist to enforce Logical Access Control (LAC) permissions that conform to the principle of \"least privilege.\"", "justification": "Access Enforcement (IAC-25) provides access control enforcement that compensates for the absence of Multi-Tenant Environments (CLD-07) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "CLD-07.1", "risk_if_not_implemented": "Without Multi-Tenant Event Logging Capabilities, malicious, anomalous or unauthorized activity may go undetected or be detected too late to prevent or limit harm. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss of Accountability / Attribution (R-AC-1), Loss of Investigative / Evidentiary Capability (R-IR-1), Undetected / Delayed Detection of Adverse Activity (R-SA-1). No threat is rated Likely for this control; threats rated Possible include Malicious Cyber Activity (MT-2), Dysfunctional Management Practices (MT-8), Human Error (MT-9).", "compensating_control_1": { "control_id": "NET-06", "name": "Network Segmentation (macrosegmentation)", "description": "Mechanisms exist to implement network segmentation within network architectures to isolate Technology Assets, Applications and/or Services (TAAS) from other network resources.", "justification": "Network Segmentation (macrosegmentation) (NET-06) provides network-level access restriction that compensates for the absence of Multi-Tenant Event Logging Capabilities (CLD-07.1) by limiting attacker reach and lateral movement opportunities across the environment. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CLD-07", "name": "Multi-Tenant Environments", "description": "Mechanisms exist to ensure multi-tenant owned or managed assets (physical and virtual) are designed and governed such that provider and customer (tenant) user access is appropriately segmented from other tenant users.", "justification": "Multi-Tenant Environments (CLD-07) provides overlapping security capability that compensates for the absence of Multi-Tenant Event Logging Capabilities (CLD-07.1) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "CLD-07.2", "risk_if_not_implemented": "Without Multi-Tenant Forensics Capabilities, required evidence, logs and chain-of-custody integrity may be unavailable or unreliable when needed for investigation or legal proceedings. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss of Investigative / Evidentiary Capability (R-IR-1), Delayed Containment / Increased Incident Impact (R-IR-2). No threat is rated Likely for this control; threats rated Possible include Malicious Cyber Activity (MT-2), Dysfunctional Management Practices (MT-8), Human Error (MT-9).", "compensating_control_1": { "control_id": "IAC-25", "name": "Access Enforcement", "description": "Mechanisms exist to enforce Logical Access Control (LAC) permissions that conform to the principle of \"least privilege.\"", "justification": "Access Enforcement (IAC-25) provides access control enforcement that compensates for the absence of Multi-Tenant Forensics Capabilities (CLD-07.2) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CLD-07", "name": "Multi-Tenant Environments", "description": "Mechanisms exist to ensure multi-tenant owned or managed assets (physical and virtual) are designed and governed such that provider and customer (tenant) user access is appropriately segmented from other tenant users.", "justification": "Multi-Tenant Environments (CLD-07) provides overlapping security capability that compensates for the absence of Multi-Tenant Forensics Capabilities (CLD-07.2) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "CLD-07.3", "risk_if_not_implemented": "Without Multi-Tenant Incident Response Capabilities, security incidents may not be detected, contained, investigated or communicated in a timely manner, increasing their scope, duration and cost. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Delayed Containment / Increased Incident Impact (R-IR-2). No threat is rated Likely for this control; threats rated Possible include Malicious Cyber Activity (MT-2), Dysfunctional Management Practices (MT-8), Human Error (MT-9).", "compensating_control_1": { "control_id": "NET-06", "name": "Network Segmentation (macrosegmentation)", "description": "Mechanisms exist to implement network segmentation within network architectures to isolate Technology Assets, Applications and/or Services (TAAS) from other network resources.", "justification": "Network Segmentation (macrosegmentation) (NET-06) provides network-level access restriction that compensates for the absence of Multi-Tenant Incident Response Capabilities (CLD-07.3) by limiting attacker reach and lateral movement opportunities across the environment. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "IAC-30", "name": "Least Privilege", "description": "Mechanisms exist to utilize the concept of least privilege, allowing only authorized access to processes necessary to accomplish assigned tasks in accordance with organizational business functions.", "justification": "Least Privilege (IAC-30) provides access control enforcement that compensates for the absence of Multi-Tenant Incident Response Capabilities (CLD-07.3) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "CLD-08", "risk_if_not_implemented": "Without Data Handling & Portability, sensitive and/or regulated data may be disclosed, altered or lost through inadequate classification, handling or protection. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss of Confidentiality (R-IP-2), Loss of Data Integrity (R-IP-3), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Harvest Now / Decrypt Later (HNDL) (MT-28), Cryptographic Compromise / Cryptanalytic Capability Advancement (MT-31).", "compensating_control_1": { "control_id": "DCH-02", "name": "Data Protection", "description": "Mechanisms exist to facilitate the implementation of data protection controls.", "justification": "Data Protection (DCH-02) provides overlapping security capability that compensates for the absence of Data Handling & Portability (CLD-08) by addressing related risk objectives through an alternative control mechanism aligned with Technology applicability. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "PRI-02", "name": "Data Privacy Program", "description": "Mechanisms exist to facilitate the implementation and operation of data protection controls throughout the data lifecycle to ensure all forms of Personal Data (PD) are processed lawfully, fairly and transparently.", "justification": "Data Privacy Program (PRI-02) provides policy-level governance that compensates for the absence of Data Handling & Portability (CLD-08) by establishing documented expectations, accountability structures, and organizational guardrails. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "CLD-09", "risk_if_not_implemented": "Without Standardized Virtualization Formats, security may be bolted on rather than designed in, resulting in structural weaknesses that are costly to remediate and easy to exploit. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Concentration / Single-Point Dependency Failure (R-OR-2). No threat is rated Likely for this control; threats rated Possible include Dysfunctional Management Practices (MT-8), Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11).", "compensating_control_1": { "control_id": "CFG-02", "name": "Configuration Management Program", "description": "Mechanisms exist to facilitate the implementation of configuration management controls.", "justification": "Configuration Management Program (CFG-02) provides policy-level governance that compensates for the absence of Standardized Virtualization Formats (CLD-09) by establishing documented expectations, accountability structures, and organizational guardrails. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "TPM-02", "name": "Third-Party Management", "description": "Mechanisms exist to facilitate the implementation of third-party management controls.", "justification": "Third-Party Management (TPM-02) provides third-party oversight that compensates for the absence of Standardized Virtualization Formats (CLD-09) by extending security obligations contractually and monitoring third-party risk in lieu of direct control. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "CLD-10", "risk_if_not_implemented": "Without Sensitive Data In Public Cloud Providers, cloud-hosted Technology Assets, Applications and/or Services (TAAS) may be misconfigured, over-exposed or governed inconsistently with on-premises controls. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss of Confidentiality (R-IP-2), Privacy Harm / Unauthorized Processing (R-IP-6), and most likely increases susceptibility to Human Error (MT-9).", "compensating_control_1": { "control_id": "CRY-07", "name": "Encrypting Data At Rest", "description": "Cryptographic mechanisms exist to prevent the unauthorized disclosure of data at rest.", "justification": "Encrypting Data At Rest (CRY-07) provides cryptographic protection that compensates for the absence of Sensitive Data In Public Cloud Providers (CLD-10) by ensuring data confidentiality and integrity through alternative technical means. Given the data-handling focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "IAC-30", "name": "Least Privilege", "description": "Mechanisms exist to utilize the concept of least privilege, allowing only authorized access to processes necessary to accomplish assigned tasks in accordance with organizational business functions.", "justification": "Least Privilege (IAC-30) provides access control enforcement that compensates for the absence of Sensitive Data In Public Cloud Providers (CLD-10) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the data-handling focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "CLD-11", "risk_if_not_implemented": "Without Cloud Access Security Broker (CASB), cloud-hosted Technology Assets, Applications and/or Services (TAAS) may be misconfigured, over-exposed or governed inconsistently with on-premises controls. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Access (R-AC-4), Undetected / Delayed Detection of Adverse Activity (R-SA-1), Harm from Unauthorized / Unintended Product or Service Use (R-SC-5), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "MON-02", "name": "Continuous Monitoring", "description": "Mechanisms exist to facilitate the implementation of enterprise-wide monitoring controls.", "justification": "Continuous Monitoring (MON-02) provides detective monitoring capability that compensates for the absence of Cloud Access Security Broker (CASB) (CLD-11) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "DCH-40", "name": "Data Loss Prevention (DLP)", "description": "Automated mechanisms exist to implement Data Loss Prevention (DLP) to protect sensitive information as it is stored, transmitted and processed.", "justification": "Data Loss Prevention (DLP) (DCH-40) provides detective monitoring capability that compensates for the absence of Cloud Access Security Broker (CASB) (CLD-11) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "CLD-12", "risk_if_not_implemented": "Without Hosted Technology Assets, Applications and/or Services (TAAS), cloud-hosted Technology Assets, Applications and/or Services (TAAS) may be misconfigured, over-exposed or governed inconsistently with on-premises controls. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Uncontrolled Third-Party Security / Privacy Exposure (R-GV-5), and most likely increases susceptibility to Human Error (MT-9).", "compensating_control_1": { "control_id": "TPM-02", "name": "Third-Party Management", "description": "Mechanisms exist to facilitate the implementation of third-party management controls.", "justification": "Third-Party Management (TPM-02) provides third-party oversight that compensates for the absence of Hosted Assets, Applications & Services (CLD-12) by extending security obligations contractually and monitoring third-party risk in lieu of direct control. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CPL-14", "name": "Control Reciprocity", "description": "Mechanisms exist to define instances of control reciprocity within assessment boundaries.", "justification": "Control Reciprocity (CPL-14) provides overlapping security capability that compensates for the absence of Hosted Assets, Applications & Services (CLD-12) by addressing related risk objectives through an alternative control mechanism aligned with Technology applicability. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "CLD-12.1", "risk_if_not_implemented": "Without Authorized Individuals For Hosted Technology Assets, Applications and/or Services (TAAS), cloud-hosted Technology Assets, Applications and/or Services (TAAS) may be misconfigured, over-exposed or governed inconsistently with on-premises controls. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Excessive or Unauthorized Privilege (R-AC-2), Unauthorized Access (R-AC-4), and most likely increases susceptibility to Human Error (MT-9).", "compensating_control_1": { "control_id": "CPL-14", "name": "Control Reciprocity", "description": "Mechanisms exist to define instances of control reciprocity within assessment boundaries.", "justification": "Control Reciprocity (CPL-14) provides overlapping security capability that compensates for the absence of Authorized Individuals For Hosted Assets, Applications & Services (CLD-12.1) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "TPM-02", "name": "Third-Party Management", "description": "Mechanisms exist to facilitate the implementation of third-party management controls.", "justification": "Third-Party Management (TPM-02) provides third-party oversight that compensates for the absence of Authorized Individuals For Hosted Assets, Applications & Services (CLD-12.1) by extending security obligations contractually and monitoring third-party risk in lieu of direct control. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "CLD-12.2", "risk_if_not_implemented": "Without Sensitive / Regulated Data On Hosted Technology Assets, Applications and/or Services (TAAS), cloud-hosted Technology Assets, Applications and/or Services (TAAS) may be misconfigured, over-exposed or governed inconsistently with on-premises controls. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Regulatory / Legal / Contractual Financial Liability (R-EX-5), Uncontrolled Third-Party Security / Privacy Exposure (R-GV-5), Loss of Confidentiality (R-IP-2), Privacy Harm / Unauthorized Processing (R-IP-6), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11).", "compensating_control_1": { "control_id": "TPM-02", "name": "Third-Party Management", "description": "Mechanisms exist to facilitate the implementation of third-party management controls.", "justification": "Third-Party Management (TPM-02) provides third-party oversight that compensates for the absence of Sensitive / Regulated Data On Hosted Assets, Applications & Services (CLD-12.2) by extending security obligations contractually and monitoring third-party risk in lieu of direct control. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CLD-12", "name": "Hosted Technology Assets, Applications and/or Services (TAAS)", "description": "Mechanisms exist to specify applicable security, compliance and resilience that must be implemented on external Technology Assets, Applications and/or Services (TAAS), consistent with the contractual obligations established with the External Service Providers (ESP) owning, operating and/or maintaining external TAAS.", "justification": "Hosted Technology Assets, Applications and/or Services (TAAS) (CLD-12) provides overlapping security capability that compensates for the absence of Sensitive / Regulated Data On Hosted Assets, Applications & Services (CLD-12.2) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "CLD-13", "risk_if_not_implemented": "Without Prohibition On Unverified Hosted Technology Assets, Applications and/or Services (TAAS), cloud-hosted Technology Assets, Applications and/or Services (TAAS) may be misconfigured, over-exposed or governed inconsistently with on-premises controls. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Uncontrolled Third-Party Security / Privacy Exposure (R-GV-5), Lack of oversight of third-party controls (R-GV-7), Harm from Unauthorized / Unintended Product or Service Use (R-SC-5), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9).", "compensating_control_1": { "control_id": "CFG-11", "name": "Software Usage Restrictions", "description": "Mechanisms exist to enforce software usage restrictions to comply with applicable contract agreements and copyright laws.", "justification": "Software Usage Restrictions (CFG-11) provides overlapping security capability that compensates for the absence of Prohibition On Unverified Hosted Assets, Applications & Services (CLD-13) by addressing related risk objectives through an alternative control mechanism aligned with Technology applicability. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "TPM-02", "name": "Third-Party Management", "description": "Mechanisms exist to facilitate the implementation of third-party management controls.", "justification": "Third-Party Management (TPM-02) provides third-party oversight that compensates for the absence of Prohibition On Unverified Hosted Assets, Applications & Services (CLD-13) by extending security obligations contractually and monitoring third-party risk in lieu of direct control. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "CPL-04", "risk_if_not_implemented": "Without Ability To Demonstrate Conformity, the organization may fail to meet statutory, regulatory or contractual obligations, or be unable to demonstrate conformity when required. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Regulatory / Legal / Contractual Financial Liability (R-EX-5), Loss of Authorization / Certification / License (R-EX-11), Inability to Demonstrate Due Diligence / Due Care (R-GV-9), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11).", "compensating_control_1": { "control_id": "GOV-04", "name": "Publishing Security, Compliance & Resilience Documentation", "description": "Mechanisms exist to establish, maintain and disseminate policies, standards and procedures necessary for secure, compliant and resilient capabilities.", "justification": "Publishing Security, Compliance & Resilience Documentation (GOV-04) provides resilience and recovery capability that compensates for the absence of Ability To Demonstrate Conformity (CPL-04) by ensuring the organization can restore operations and data when the primary control is absent. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CPL-02", "name": "Statutory, Regulatory & Contractual Compliance", "description": "Mechanisms exist to facilitate the identification and implementation of relevant statutory, regulatory and contractual controls.", "justification": "Statutory, Regulatory & Contractual Compliance (CPL-02) provides overlapping security capability that compensates for the absence of Ability To Demonstrate Conformity (CPL-04) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "CPL-04.1", "risk_if_not_implemented": "Without Conformity Assessment, the organization may fail to meet statutory, regulatory or contractual obligations, or be unable to demonstrate conformity when required. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Regulatory / Legal / Contractual Financial Liability (R-EX-5), Loss of Authorization / Certification / License (R-EX-11), Lack of oversight of internal controls (R-GV-6), Inability to Demonstrate Due Diligence / Due Care (R-GV-9), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11).", "compensating_control_1": { "control_id": "TPM-14", "name": "Third-Party Contract Requirements", "description": "Mechanisms exist to require contractual requirements for applicable security, compliance and resilience requirements with third-parties, reflecting the organization's needs to protect its Technology Assets, Applications, Services and/or Data (TAASD).", "justification": "Third-Party Contract Requirements (TPM-14) provides third-party oversight that compensates for the absence of Conformity Assessment (CPL-04.1) by extending security obligations contractually and monitoring third-party risk in lieu of direct control. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CPL-02", "name": "Statutory, Regulatory & Contractual Compliance", "description": "Mechanisms exist to facilitate the identification and implementation of relevant statutory, regulatory and contractual controls.", "justification": "Statutory, Regulatory & Contractual Compliance (CPL-02) provides overlapping security capability that compensates for the absence of Conformity Assessment (CPL-04.1) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "CPL-04.2", "risk_if_not_implemented": "Without Designated Certifying Official, the organization may fail to meet statutory, regulatory or contractual obligations, or be unable to demonstrate conformity when required. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Regulatory / Legal / Contractual Financial Liability (R-EX-5), Loss of Authorization / Certification / License (R-EX-11), Unperformed / Unowned Control Responsibilities (R-GV-3), Inability to Demonstrate Due Diligence / Due Care (R-GV-9), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11), Workforce Shortage / Loss of Critical Skills / Labor Disruption (MT-25).", "compensating_control_1": { "control_id": "GOV-02", "name": "Security, Compliance & Resilience Program (SCRP)", "description": "Mechanisms exist to facilitate the design, implementation, and monitoring of security, compliance and resilience governance controls.", "justification": "Security, Compliance & Resilience Program (SCRP) (GOV-02) provides resilience and recovery capability that compensates for the absence of Designated Certifying Official (CPL-04.2) by ensuring the organization can restore operations and data when the primary control is absent. Given the people-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CPL-02", "name": "Statutory, Regulatory & Contractual Compliance", "description": "Mechanisms exist to facilitate the identification and implementation of relevant statutory, regulatory and contractual controls.", "justification": "Statutory, Regulatory & Contractual Compliance (CPL-02) provides overlapping security capability that compensates for the absence of Designated Certifying Official (CPL-04.2) by addressing related risk objectives through an alternative control mechanism aligned with People applicability. Given the people-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "CPL-04.3", "risk_if_not_implemented": "Without Conformity Attestations, the organization may fail to meet statutory, regulatory or contractual obligations, or be unable to demonstrate conformity when required. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Regulatory / Legal / Contractual Financial Liability (R-EX-5), Loss of Authorization / Certification / License (R-EX-11), Inability to Demonstrate Due Diligence / Due Care (R-GV-9), Unreliable Assurance / Decision Information (R-GV-10), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11), Fraud, Corruption and/or Intentional Criminal Conduct (MT-14), Conflict of Interest (COI) / Undue Influence / Insider Misconduct (MT-15).", "compensating_control_1": { "control_id": "CPL-05", "name": "Conformity Monitoring", "description": "Mechanisms exist to validate that Technology Assets, Applications, Services and/or Data (TAASD) conform to the organization's security, compliance and/or resilience policies, standards and other applicable requirements.", "justification": "Conformity Monitoring (CPL-05) provides periodic assessment and assurance that compensates for the absence of Conformity Attestations (CPL-04.3) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the people-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "RSK-02", "name": "Risk Management Program", "description": "Mechanisms exist to facilitate the implementation of strategic, operational and tactical risk management controls that are aligned with:\n(1) The organization's Enterprise Risk Management (ERM); and\n(2) Industry-recognized cybersecurity risk management practices.", "justification": "Risk Management Program (RSK-02) provides policy-level governance that compensates for the absence of Conformity Attestations (CPL-04.3) by establishing documented expectations, accountability structures, and organizational guardrails. Given the people-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "CPL-04.4", "risk_if_not_implemented": "Without Declaration of Conformity, the organization may fail to meet statutory, regulatory or contractual obligations, or be unable to demonstrate conformity when required. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Regulatory / Legal / Contractual Financial Liability (R-EX-5), Loss of Authorization / Certification / License (R-EX-11), Inability to Demonstrate Due Diligence / Due Care (R-GV-9), Unreliable Assurance / Decision Information (R-GV-10), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11).", "compensating_control_1": { "control_id": "GOV-15", "name": "Contacts With Authorities", "description": "Mechanisms exist to identify and document appropriate contacts with relevant law enforcement and regulatory bodies.", "justification": "Contacts With Authorities (GOV-15) provides overlapping security capability that compensates for the absence of Declaration of Conformity (CPL-04.4) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CPL-02", "name": "Statutory, Regulatory & Contractual Compliance", "description": "Mechanisms exist to facilitate the identification and implementation of relevant statutory, regulatory and contractual controls.", "justification": "Statutory, Regulatory & Contractual Compliance (CPL-02) provides overlapping security capability that compensates for the absence of Declaration of Conformity (CPL-04.4) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "CPL-05.1", "risk_if_not_implemented": "Without Functional Review Of Security, Compliance & Resilience Controls, the organization may fail to meet statutory, regulatory or contractual obligations, or be unable to demonstrate conformity when required. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Regulatory / Legal / Contractual Financial Liability (R-EX-5), Unaddressed Security / Compliance Exposure (R-GV-2), Lack of oversight of internal controls (R-GV-6), Inability to Demonstrate Due Diligence / Due Care (R-GV-9), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11).", "compensating_control_1": { "control_id": "CPL-05", "name": "Conformity Monitoring", "description": "Mechanisms exist to validate that Technology Assets, Applications, Services and/or Data (TAASD) conform to the organization's security, compliance and/or resilience policies, standards and other applicable requirements.", "justification": "Conformity Monitoring (CPL-05) provides periodic assessment and assurance that compensates for the absence of Functional Review Of Security, Compliance & Resilience Controls (CPL-05.1) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "MON-02", "name": "Continuous Monitoring", "description": "Mechanisms exist to facilitate the implementation of enterprise-wide monitoring controls.", "justification": "Continuous Monitoring (MON-02) provides detective monitoring capability that compensates for the absence of Functional Review Of Security, Compliance & Resilience Controls (CPL-05.1) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "CPL-06", "risk_if_not_implemented": "Without Non-Conformity Oversight, the organization may fail to meet statutory, regulatory or contractual obligations, or be unable to demonstrate conformity when required. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Lack of oversight of internal controls (R-GV-6), Inability to Demonstrate Due Diligence / Due Care (R-GV-9), Unreliable Assurance / Decision Information (R-GV-10), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11).", "compensating_control_1": { "control_id": "CPL-05", "name": "Conformity Monitoring", "description": "Mechanisms exist to validate that Technology Assets, Applications, Services and/or Data (TAASD) conform to the organization's security, compliance and/or resilience policies, standards and other applicable requirements.", "justification": "Conformity Monitoring (CPL-05) provides periodic assessment and assurance that compensates for the absence of Non-Compliance Oversight (CPL-06) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CPL-02", "name": "Statutory, Regulatory & Contractual Compliance", "description": "Mechanisms exist to facilitate the identification and implementation of relevant statutory, regulatory and contractual controls.", "justification": "Statutory, Regulatory & Contractual Compliance (CPL-02) provides overlapping security capability that compensates for the absence of Non-Compliance Oversight (CPL-06) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "CPL-06.1", "risk_if_not_implemented": "Without Non-Conformity Corrective Action, the organization may fail to meet statutory, regulatory or contractual obligations, or be unable to demonstrate conformity when required. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Lack of oversight of internal controls (R-GV-6), Inability to Demonstrate Due Diligence / Due Care (R-GV-9), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11).", "compensating_control_1": { "control_id": "CPL-05", "name": "Conformity Monitoring", "description": "Mechanisms exist to validate that Technology Assets, Applications, Services and/or Data (TAASD) conform to the organization's security, compliance and/or resilience policies, standards and other applicable requirements.", "justification": "Conformity Monitoring (CPL-05) provides periodic assessment and assurance that compensates for the absence of Corrective Action (CPL-06.1) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CPL-07", "name": "Executive Leadership Oversight of Security, Compliance & Resilience Controls", "description": "Mechanisms exist to provide a security, compliance and resilience controls oversight function that reports to the organization's executive leadership.", "justification": "Executive Leadership Oversight of Security, Compliance & Resilience Controls (CPL-07) provides resilience and recovery capability that compensates for the absence of Corrective Action (CPL-06.1) by ensuring the organization can restore operations and data when the primary control is absent. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "CPL-07.1", "risk_if_not_implemented": "Without Internal Audit Function, the organization may fail to meet statutory, regulatory or contractual obligations, or be unable to demonstrate conformity when required. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Lack of oversight of internal controls (R-GV-6), Inability to Demonstrate Due Diligence / Due Care (R-GV-9), Unreliable Assurance / Decision Information (R-GV-10), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Conflict of Interest (COI) / Undue Influence / Insider Misconduct (MT-15), Workforce Shortage / Loss of Critical Skills / Labor Disruption (MT-25).", "compensating_control_1": { "control_id": "MON-02", "name": "Continuous Monitoring", "description": "Mechanisms exist to facilitate the implementation of enterprise-wide monitoring controls.", "justification": "Continuous Monitoring (MON-02) provides detective monitoring capability that compensates for the absence of Internal Audit Function (CPL-07.1) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CPL-05", "name": "Conformity Monitoring", "description": "Mechanisms exist to validate that Technology Assets, Applications, Services and/or Data (TAASD) conform to the organization's security, compliance and/or resilience policies, standards and other applicable requirements.", "justification": "Conformity Monitoring (CPL-05) provides periodic assessment and assurance that compensates for the absence of Internal Audit Function (CPL-07.1) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "CPL-07.2", "risk_if_not_implemented": "Without Periodic Audits, the organization may fail to meet statutory, regulatory or contractual obligations, or be unable to demonstrate conformity when required. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Lack of oversight of internal controls (R-GV-6), Inability to Demonstrate Due Diligence / Due Care (R-GV-9), Unreliable Assurance / Decision Information (R-GV-10), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9).", "compensating_control_1": { "control_id": "CPL-07.3", "name": "Audit Planning Activities", "description": "Mechanisms exist to thoughtfully plan audits by including input from operational risk and compliance partners to minimize the impact of audit-related activities on business operations.", "justification": "Audit Planning Activities (CPL-07.3) provides detective monitoring capability that compensates for the absence of Periodic Audits (CPL-07.2) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "MON-02", "name": "Continuous Monitoring", "description": "Mechanisms exist to facilitate the implementation of enterprise-wide monitoring controls.", "justification": "Continuous Monitoring (MON-02) provides detective monitoring capability that compensates for the absence of Periodic Audits (CPL-07.2) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "CPL-07.3", "risk_if_not_implemented": "Without Audit Planning Activities, the organization may fail to meet statutory, regulatory or contractual obligations, or be unable to demonstrate conformity when required. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Reduced Operational Productivity (R-BC-3), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9).", "compensating_control_1": { "control_id": "CPL-05", "name": "Conformity Monitoring", "description": "Mechanisms exist to validate that Technology Assets, Applications, Services and/or Data (TAASD) conform to the organization's security, compliance and/or resilience policies, standards and other applicable requirements.", "justification": "Conformity Monitoring (CPL-05) provides periodic assessment and assurance that compensates for the absence of Audit Activities (CPL-07.3) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "MON-02", "name": "Continuous Monitoring", "description": "Mechanisms exist to facilitate the implementation of enterprise-wide monitoring controls.", "justification": "Continuous Monitoring (MON-02) provides detective monitoring capability that compensates for the absence of Audit Activities (CPL-07.3) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "CPL-08", "risk_if_not_implemented": "Without Independent Assessors, the organization may fail to meet statutory, regulatory or contractual obligations, or be unable to demonstrate conformity when required. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Lack of oversight of internal controls (R-GV-6), Inability to Demonstrate Due Diligence / Due Care (R-GV-9), Unreliable Assurance / Decision Information (R-GV-10), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Conflict of Interest (COI) / Undue Influence / Insider Misconduct (MT-15).", "compensating_control_1": { "control_id": "IAO-04", "name": "Control Validation Testing (CVT)", "description": "Mechanisms exist to formally assess the security, compliance and resilience controls in Technology Assets, Applications and/or Services (TAAS) through Information Assurance Program (IAP) activities to determine the extent to which the controls are implemented correctly, operating as intended and producing the desired outcome with respect to meeting expected requirements.", "justification": "Control Validation Testing (CVT) (IAO-04) provides periodic assessment and assurance that compensates for the absence of Independent Assessors (CPL-08) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "VPM-18", "name": "Penetration Testing", "description": "Mechanisms exist to conduct penetration testing on Technology Assets, Applications and/or Services (TAAS).", "justification": "Penetration Testing (VPM-18) provides periodic assessment and assurance that compensates for the absence of Independent Assessors (CPL-08) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "CPL-09", "risk_if_not_implemented": "Without Assessment Team Subject Matter Expertise, the organization may fail to meet statutory, regulatory or contractual obligations, or be unable to demonstrate conformity when required. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Lack of oversight of internal controls (R-GV-6), Inability to Demonstrate Due Diligence / Due Care (R-GV-9), Unreliable Assurance / Decision Information (R-GV-10), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Workforce Shortage / Loss of Critical Skills / Labor Disruption (MT-25).", "compensating_control_1": { "control_id": "RSK-02", "name": "Risk Management Program", "description": "Mechanisms exist to facilitate the implementation of strategic, operational and tactical risk management controls that are aligned with:\n(1) The organization's Enterprise Risk Management (ERM); and\n(2) Industry-recognized cybersecurity risk management practices.", "justification": "Risk Management Program (RSK-02) provides policy-level governance that compensates for the absence of Assessment Team Subject Matter Expertise (CPL-09) by establishing documented expectations, accountability structures, and organizational guardrails. Given the people-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CPL-02", "name": "Statutory, Regulatory & Contractual Compliance", "description": "Mechanisms exist to facilitate the identification and implementation of relevant statutory, regulatory and contractual controls.", "justification": "Statutory, Regulatory & Contractual Compliance (CPL-02) provides overlapping security capability that compensates for the absence of Assessment Team Subject Matter Expertise (CPL-09) by addressing related risk objectives through an alternative control mechanism aligned with People applicability. Given the people-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "CPL-10", "risk_if_not_implemented": "Without Assessor Access, the organization may fail to meet statutory, regulatory or contractual obligations, or be unable to demonstrate conformity when required. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Excessive or Unauthorized Privilege (R-AC-2), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9).", "compensating_control_1": { "control_id": "CPL-05", "name": "Conformity Monitoring", "description": "Mechanisms exist to validate that Technology Assets, Applications, Services and/or Data (TAASD) conform to the organization's security, compliance and/or resilience policies, standards and other applicable requirements.", "justification": "Conformity Monitoring (CPL-05) provides periodic assessment and assurance that compensates for the absence of Assessor Access (CPL-10) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "RSK-13.2", "name": "Risk Assessment Update", "description": "Mechanisms exist to routinely update risk assessments and react accordingly upon identifying new security vulnerabilities, including using outside sources for security vulnerability information.", "justification": "Risk Assessment Update (RSK-13.2) provides periodic assessment and assurance that compensates for the absence of Assessor Access (CPL-10) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "CPL-11", "risk_if_not_implemented": "Without Assessment Methods, the organization may fail to meet statutory, regulatory or contractual obligations, or be unable to demonstrate conformity when required. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Inability to Demonstrate Due Diligence / Due Care (R-GV-9), Unreliable Assurance / Decision Information (R-GV-10), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11).", "compensating_control_1": { "control_id": "IAO-04", "name": "Control Validation Testing (CVT)", "description": "Mechanisms exist to formally assess the security, compliance and resilience controls in Technology Assets, Applications and/or Services (TAAS) through Information Assurance Program (IAP) activities to determine the extent to which the controls are implemented correctly, operating as intended and producing the desired outcome with respect to meeting expected requirements.", "justification": "Control Validation Testing (CVT) (IAO-04) provides periodic assessment and assurance that compensates for the absence of Assessment Methods (CPL-11) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CPL-05", "name": "Conformity Monitoring", "description": "Mechanisms exist to validate that Technology Assets, Applications, Services and/or Data (TAASD) conform to the organization's security, compliance and/or resilience policies, standards and other applicable requirements.", "justification": "Conformity Monitoring (CPL-05) provides periodic assessment and assurance that compensates for the absence of Assessment Methods (CPL-11) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "CPL-12", "risk_if_not_implemented": "Without Assessment Rigor, the organization may fail to meet statutory, regulatory or contractual obligations, or be unable to demonstrate conformity when required. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Inability to Demonstrate Due Diligence / Due Care (R-GV-9), Unreliable Assurance / Decision Information (R-GV-10), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11).", "compensating_control_1": { "control_id": "VPM-18", "name": "Penetration Testing", "description": "Mechanisms exist to conduct penetration testing on Technology Assets, Applications and/or Services (TAAS).", "justification": "Penetration Testing (VPM-18) provides periodic assessment and assurance that compensates for the absence of Assessment Rigor (CPL-12) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CPL-05", "name": "Conformity Monitoring", "description": "Mechanisms exist to validate that Technology Assets, Applications, Services and/or Data (TAASD) conform to the organization's security, compliance and/or resilience policies, standards and other applicable requirements.", "justification": "Conformity Monitoring (CPL-05) provides periodic assessment and assurance that compensates for the absence of Assessment Rigor (CPL-12) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "CPL-13", "risk_if_not_implemented": "Without Assurance Levels (AL), executive management, the Board of Directors (BoD) and assessors may rely on inaccurate, incomplete or unverifiable control and risk information. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Inability to Demonstrate Due Diligence / Due Care (R-GV-9), Unreliable Assurance / Decision Information (R-GV-10), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11).", "compensating_control_1": { "control_id": "CPL-05", "name": "Conformity Monitoring", "description": "Mechanisms exist to validate that Technology Assets, Applications, Services and/or Data (TAASD) conform to the organization's security, compliance and/or resilience policies, standards and other applicable requirements.", "justification": "Conformity Monitoring (CPL-05) provides periodic assessment and assurance that compensates for the absence of Assurance Levels (AL) (CPL-13) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "IAO-04", "name": "Control Validation Testing (CVT)", "description": "Mechanisms exist to formally assess the security, compliance and resilience controls in Technology Assets, Applications and/or Services (TAAS) through Information Assurance Program (IAP) activities to determine the extent to which the controls are implemented correctly, operating as intended and producing the desired outcome with respect to meeting expected requirements.", "justification": "Control Validation Testing (CVT) (IAO-04) provides periodic assessment and assurance that compensates for the absence of Assurance Levels (AL) (CPL-13) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "CPL-14", "risk_if_not_implemented": "Without Control Reciprocity, executive management, the Board of Directors (BoD) and assessors may rely on inaccurate, incomplete or unverifiable control and risk information. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unaddressed Security / Compliance Exposure (R-GV-2), Lack of oversight of internal controls (R-GV-6), Inability to Demonstrate Due Diligence / Due Care (R-GV-9), Unreliable Assurance / Decision Information (R-GV-10), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11).", "compensating_control_1": { "control_id": "CPL-15", "name": "Control Inheritance", "description": "Mechanisms exist to define instances of control inheritance within assessment boundaries.", "justification": "Control Inheritance (CPL-15) provides overlapping security capability that compensates for the absence of Control Reciprocity (CPL-14) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CPL-02", "name": "Statutory, Regulatory & Contractual Compliance", "description": "Mechanisms exist to facilitate the identification and implementation of relevant statutory, regulatory and contractual controls.", "justification": "Statutory, Regulatory & Contractual Compliance (CPL-02) provides overlapping security capability that compensates for the absence of Control Reciprocity (CPL-14) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "CPL-15", "risk_if_not_implemented": "Without Control Inheritance, executive management, the Board of Directors (BoD) and assessors may rely on inaccurate, incomplete or unverifiable control and risk information. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to R-GV-2, R-GV-3, R-GV-5, R-GV-6, R-GV-7, R-GV-9, R-GV-10, and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11).", "compensating_control_1": { "control_id": "CPL-14", "name": "Control Reciprocity", "description": "Mechanisms exist to define instances of control reciprocity within assessment boundaries.", "justification": "Control Reciprocity (CPL-14) provides overlapping security capability that compensates for the absence of Control Inheritance (CPL-15) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CPL-02", "name": "Statutory, Regulatory & Contractual Compliance", "description": "Mechanisms exist to facilitate the identification and implementation of relevant statutory, regulatory and contractual controls.", "justification": "Statutory, Regulatory & Contractual Compliance (CPL-02) provides overlapping security capability that compensates for the absence of Control Inheritance (CPL-15) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "CPL-16", "risk_if_not_implemented": "Without Evidence Request List (ERL), required evidence, logs and chain-of-custody integrity may be unavailable or unreliable when needed for investigation or legal proceedings. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Lack of oversight of internal controls (R-GV-6), Inability to Demonstrate Due Diligence / Due Care (R-GV-9), Unreliable Assurance / Decision Information (R-GV-10), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11).", "compensating_control_1": { "control_id": "CPL-07.3", "name": "Audit Planning Activities", "description": "Mechanisms exist to thoughtfully plan audits by including input from operational risk and compliance partners to minimize the impact of audit-related activities on business operations.", "justification": "Audit Planning Activities (CPL-07.3) provides detective monitoring capability that compensates for the absence of Evidence Request List (ERL) (CPL-16) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CPL-05", "name": "Conformity Monitoring", "description": "Mechanisms exist to validate that Technology Assets, Applications, Services and/or Data (TAASD) conform to the organization's security, compliance and/or resilience policies, standards and other applicable requirements.", "justification": "Conformity Monitoring (CPL-05) provides periodic assessment and assurance that compensates for the absence of Evidence Request List (ERL) (CPL-16) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "CPL-17", "risk_if_not_implemented": "Without Evidence Sampling, required evidence, logs and chain-of-custody integrity may be unavailable or unreliable when needed for investigation or legal proceedings. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Lack of oversight of internal controls (R-GV-6), Inability to Demonstrate Due Diligence / Due Care (R-GV-9), Unreliable Assurance / Decision Information (R-GV-10), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11).", "compensating_control_1": { "control_id": "MON-02", "name": "Continuous Monitoring", "description": "Mechanisms exist to facilitate the implementation of enterprise-wide monitoring controls.", "justification": "Continuous Monitoring (MON-02) provides detective monitoring capability that compensates for the absence of Evidence Sampling (CPL-17) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CPL-05", "name": "Conformity Monitoring", "description": "Mechanisms exist to validate that Technology Assets, Applications, Services and/or Data (TAASD) conform to the organization's security, compliance and/or resilience policies, standards and other applicable requirements.", "justification": "Conformity Monitoring (CPL-05) provides periodic assessment and assurance that compensates for the absence of Evidence Sampling (CPL-17) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "CPL-18", "risk_if_not_implemented": "Without Continuous Control Monitoring (CCM), malicious, anomalous or unauthorized activity may go undetected or be detected too late to prevent or limit harm. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Lack of oversight of internal controls (R-GV-6), Inability to Demonstrate Due Diligence / Due Care (R-GV-9), Unreliable Assurance / Decision Information (R-GV-10), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Technical / Mechanical Failure (MT-10), Statutory / Regulatory / Contractual Change (MT-11), Data Quality Degradation / Data Poisoning (MT-12).", "compensating_control_1": { "control_id": "CPL-05", "name": "Conformity Monitoring", "description": "Mechanisms exist to validate that Technology Assets, Applications, Services and/or Data (TAASD) conform to the organization's security, compliance and/or resilience policies, standards and other applicable requirements.", "justification": "Conformity Monitoring (CPL-05) provides detective monitoring capability that compensates for the absence of Continuous Control Monitoring (CCM) (CPL-18) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "MON-02", "name": "Continuous Monitoring", "description": "Mechanisms exist to facilitate the implementation of enterprise-wide monitoring controls.", "justification": "Continuous Monitoring (MON-02) provides detective monitoring capability that compensates for the absence of Continuous Control Monitoring (CCM) (CPL-18) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "CPL-19", "risk_if_not_implemented": "Without Legal Assessment of Investigative Inquires, the organization may fail to meet statutory, regulatory or contractual obligations, or be unable to demonstrate conformity when required. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Access (R-AC-4), Regulatory / Legal / Contractual Financial Liability (R-EX-5), Loss of Confidentiality (R-IP-2), Privacy Harm / Unauthorized Processing (R-IP-6), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11), Geopolitical Conflict / Government Intervention (MT-18).", "compensating_control_1": { "control_id": "CPL-02", "name": "Statutory, Regulatory & Contractual Compliance", "description": "Mechanisms exist to facilitate the identification and implementation of relevant statutory, regulatory and contractual controls.", "justification": "Statutory, Regulatory & Contractual Compliance (CPL-02) provides overlapping security capability that compensates for the absence of Legal Assessment of Investigative Inquires (CPL-19) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "GOV-15", "name": "Contacts With Authorities", "description": "Mechanisms exist to identify and document appropriate contacts with relevant law enforcement and regulatory bodies.", "justification": "Contacts With Authorities (GOV-15) provides overlapping security capability that compensates for the absence of Legal Assessment of Investigative Inquires (CPL-19) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "CPL-19.1", "risk_if_not_implemented": "Without Investigation Request Notifications, the organization may fail to meet statutory, regulatory or contractual obligations, or be unable to demonstrate conformity when required. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Contractual Default / Termination (R-EX-2), Regulatory / Legal / Contractual Financial Liability (R-EX-5), Privacy Harm / Unauthorized Processing (R-IP-6), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11), Geopolitical Conflict / Government Intervention (MT-18).", "compensating_control_1": { "control_id": "GOV-15", "name": "Contacts With Authorities", "description": "Mechanisms exist to identify and document appropriate contacts with relevant law enforcement and regulatory bodies.", "justification": "Contacts With Authorities (GOV-15) provides overlapping security capability that compensates for the absence of Investigation Request Notifications (CPL-19.1) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CPL-02", "name": "Statutory, Regulatory & Contractual Compliance", "description": "Mechanisms exist to facilitate the identification and implementation of relevant statutory, regulatory and contractual controls.", "justification": "Statutory, Regulatory & Contractual Compliance (CPL-02) provides overlapping security capability that compensates for the absence of Investigation Request Notifications (CPL-19.1) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "CPL-19.2", "risk_if_not_implemented": "Without Investigation Access Restrictions, the organization may fail to meet statutory, regulatory or contractual obligations, or be unable to demonstrate conformity when required. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Excessive or Unauthorized Privilege (R-AC-2), Unauthorized Access (R-AC-4), Loss of Confidentiality (R-IP-2), Privacy Harm / Unauthorized Processing (R-IP-6), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11), Geopolitical Conflict / Government Intervention (MT-18).", "compensating_control_1": { "control_id": "CPL-02", "name": "Statutory, Regulatory & Contractual Compliance", "description": "Mechanisms exist to facilitate the identification and implementation of relevant statutory, regulatory and contractual controls.", "justification": "Statutory, Regulatory & Contractual Compliance (CPL-02) provides overlapping security capability that compensates for the absence of Investigation Access Restrictions (CPL-19.2) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CPL-19", "name": "Legal Assessment of Investigative Inquires", "description": "Mechanisms exist to determine whether a government agency has an applicable and valid legal basis to request data from the organization and what further steps need to be taken, if necessary.", "justification": "Legal Assessment of Investigative Inquires (CPL-19) provides periodic assessment and assurance that compensates for the absence of Investigation Access Restrictions (CPL-19.2) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "CPL-22", "risk_if_not_implemented": "Without Grievances, the organization may fail to meet statutory, regulatory or contractual obligations, or be unable to demonstrate conformity when required. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Inability to Demonstrate Due Diligence / Due Care (R-GV-9), Unreliable Assurance / Decision Information (R-GV-10), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11).", "compensating_control_1": { "control_id": "PRI-39.1", "name": "Data Subject Empowerment", "description": "Mechanisms exist to provide authenticated data subjects the ability to:\n(1) Access their Personal Data (PD) that is being processed, stored and shared, except where the burden, risk or expense of providing access would be disproportionate to the benefit offered to the data subject through granting access;\n(2) Obtain answers on the specifics of how their PD is collected, received, processed, stored, transmitted, shared, updated and/or disposed; \n(3) Obtain the source(s) of their PD; \n(4) Obtain the categories of their PD being collected, received, processed, stored and shared; \n(5) Request correction to their PD due to inaccuracies;\n(6) Request erasure of their PD; and\n(7) Restrict the further collecting, receiving, processing, storing, transmitting, updated and/or sharing of their PD.", "justification": "Data Subject Empowerment (PRI-39.1) provides privacy protection that compensates for the absence of Grievances (CPL-22) by applying alternative privacy safeguards to protect personal data and honor data subject rights. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CPL-02", "name": "Statutory, Regulatory & Contractual Compliance", "description": "Mechanisms exist to facilitate the identification and implementation of relevant statutory, regulatory and contractual controls.", "justification": "Statutory, Regulatory & Contractual Compliance (CPL-02) provides overlapping security capability that compensates for the absence of Grievances (CPL-22) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "CPL-22.1", "risk_if_not_implemented": "Without Grievance Response, the organization may fail to meet statutory, regulatory or contractual obligations, or be unable to demonstrate conformity when required. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Reputational Harm / Loss of Stakeholder Trust (R-EX-4), Regulatory / Legal / Contractual Financial Liability (R-EX-5), Inability to Demonstrate Due Diligence / Due Care (R-GV-9), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11).", "compensating_control_1": { "control_id": "CPL-02", "name": "Statutory, Regulatory & Contractual Compliance", "description": "Mechanisms exist to facilitate the identification and implementation of relevant statutory, regulatory and contractual controls.", "justification": "Statutory, Regulatory & Contractual Compliance (CPL-02) provides overlapping security capability that compensates for the absence of Grievance Response (CPL-22.1) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "PRI-39.1", "name": "Data Subject Empowerment", "description": "Mechanisms exist to provide authenticated data subjects the ability to:\n(1) Access their Personal Data (PD) that is being processed, stored and shared, except where the burden, risk or expense of providing access would be disproportionate to the benefit offered to the data subject through granting access;\n(2) Obtain answers on the specifics of how their PD is collected, received, processed, stored, transmitted, shared, updated and/or disposed; \n(3) Obtain the source(s) of their PD; \n(4) Obtain the categories of their PD being collected, received, processed, stored and shared; \n(5) Request correction to their PD due to inaccuracies;\n(6) Request erasure of their PD; and\n(7) Restrict the further collecting, receiving, processing, storing, transmitting, updated and/or sharing of their PD.", "justification": "Data Subject Empowerment (PRI-39.1) provides privacy protection that compensates for the absence of Grievance Response (CPL-22.1) by applying alternative privacy safeguards to protect personal data and honor data subject rights. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "CPL-23", "risk_if_not_implemented": "Without Localized Representation, the organization may fail to meet statutory, regulatory or contractual obligations, or be unable to demonstrate conformity when required. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Regulatory / Legal / Contractual Financial Liability (R-EX-5), Loss of Authorization / Certification / License (R-EX-11), Unperformed / Unowned Control Responsibilities (R-GV-3), and most likely increases susceptibility to Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11), Geopolitical Conflict / Government Intervention (MT-18), Sanctions / Trade Restriction Disruption (MT-19), Workforce Shortage / Loss of Critical Skills / Labor Disruption (MT-25).", "compensating_control_1": { "control_id": "CPL-02", "name": "Statutory, Regulatory & Contractual Compliance", "description": "Mechanisms exist to facilitate the identification and implementation of relevant statutory, regulatory and contractual controls.", "justification": "Statutory, Regulatory & Contractual Compliance (CPL-02) provides overlapping security capability that compensates for the absence of Localized Representation (CPL-23) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "GOV-05", "name": "Assigned Security, Compliance & Resilience Responsibilities", "description": "Mechanisms exist to assign one or more qualified individuals with the mission and resources to centrally-manage, coordinate, develop, implement and maintain an enterprise-wide Security, Compliance & Resilience Program (SCRP).", "justification": "Assigned Security, Compliance & Resilience Responsibilities (GOV-05) provides resilience and recovery capability that compensates for the absence of Localized Representation (CPL-23) by ensuring the organization can restore operations and data when the primary control is absent. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "CPL-23.1", "risk_if_not_implemented": "Without Representative Powers, unauthorized individuals may gain physical access to facilities and equipment, enabling theft, tampering, damage or safety incidents. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Regulatory / Legal / Contractual Financial Liability (R-EX-5), Loss of Authorization / Certification / License (R-EX-11), Unperformed / Unowned Control Responsibilities (R-GV-3), and most likely increases susceptibility to Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11), Geopolitical Conflict / Government Intervention (MT-18), Sanctions / Trade Restriction Disruption (MT-19), Workforce Shortage / Loss of Critical Skills / Labor Disruption (MT-25).", "compensating_control_1": { "control_id": "GOV-05", "name": "Assigned Security, Compliance & Resilience Responsibilities", "description": "Mechanisms exist to assign one or more qualified individuals with the mission and resources to centrally-manage, coordinate, develop, implement and maintain an enterprise-wide Security, Compliance & Resilience Program (SCRP).", "justification": "Assigned Security, Compliance & Resilience Responsibilities (GOV-05) provides resilience and recovery capability that compensates for the absence of Representative Powers (CPL-23.1) by ensuring the organization can restore operations and data when the primary control is absent. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CPL-02", "name": "Statutory, Regulatory & Contractual Compliance", "description": "Mechanisms exist to facilitate the identification and implementation of relevant statutory, regulatory and contractual controls.", "justification": "Statutory, Regulatory & Contractual Compliance (CPL-02) provides overlapping security capability that compensates for the absence of Representative Powers (CPL-23.1) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "CPL-24", "risk_if_not_implemented": "Without Dual Use Technology, the organization may fail to meet statutory, regulatory or contractual obligations, or be unable to demonstrate conformity when required. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Regulatory / Legal / Contractual Financial Liability (R-EX-5), Loss of Authorization / Certification / License (R-EX-11), Unaddressed Security / Compliance Exposure (R-GV-2), Harm from Unauthorized / Unintended Product or Service Use (R-SC-5), and most likely increases susceptibility to Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11), Foreign Ownership, Control, or Influence (FOCI) (MT-17), Geopolitical Conflict / Government Intervention (MT-18), Sanctions / Trade Restriction Disruption (MT-19).", "compensating_control_1": { "control_id": "CPL-02", "name": "Statutory, Regulatory & Contractual Compliance", "description": "Mechanisms exist to facilitate the identification and implementation of relevant statutory, regulatory and contractual controls.", "justification": "Statutory, Regulatory & Contractual Compliance (CPL-02) provides overlapping security capability that compensates for the absence of Dual Use Technology (CPL-24) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "TPM-20", "name": "Foreign Ownership, Control or Influence (FOCI)", "description": "Mechanisms exist to minimize risk associated with Foreign Ownership, Control or Influence (FOCI) through Supply Chain Risk Management (SCRM) practices.", "justification": "Foreign Ownership, Control or Influence (FOCI) (TPM-20) provides overlapping security capability that compensates for the absence of Dual Use Technology (CPL-24) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "CPL-24.1", "risk_if_not_implemented": "Without USML or CCL Identification, the organization may fail to meet statutory, regulatory or contractual obligations, or be unable to demonstrate conformity when required. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Regulatory / Legal / Contractual Financial Liability (R-EX-5), Loss of Authorization / Certification / License (R-EX-11), Unaddressed Security / Compliance Exposure (R-GV-2), and most likely increases susceptibility to Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11), Sanctions / Trade Restriction Disruption (MT-19).", "compensating_control_1": { "control_id": "TPM-20", "name": "Foreign Ownership, Control or Influence (FOCI)", "description": "Mechanisms exist to minimize risk associated with Foreign Ownership, Control or Influence (FOCI) through Supply Chain Risk Management (SCRM) practices.", "justification": "Foreign Ownership, Control or Influence (FOCI) (TPM-20) provides overlapping security capability that compensates for the absence of USML or CCL Identification (CPL-24.1) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CPL-02", "name": "Statutory, Regulatory & Contractual Compliance", "description": "Mechanisms exist to facilitate the identification and implementation of relevant statutory, regulatory and contractual controls.", "justification": "Statutory, Regulatory & Contractual Compliance (CPL-02) provides overlapping security capability that compensates for the absence of USML or CCL Identification (CPL-24.1) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "CPL-24.2", "risk_if_not_implemented": "Without Export-Controlled Access Restrictions, the organization may fail to meet statutory, regulatory or contractual obligations, or be unable to demonstrate conformity when required. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Excessive or Unauthorized Privilege (R-AC-2), Unauthorized Access (R-AC-4), Regulatory / Legal / Contractual Financial Liability (R-EX-5), Loss of Confidentiality (R-IP-2), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Physical Crime (MT-5), Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11), Foreign Ownership, Control, or Influence (FOCI) (MT-17).", "compensating_control_1": { "control_id": "CPL-02", "name": "Statutory, Regulatory & Contractual Compliance", "description": "Mechanisms exist to facilitate the identification and implementation of relevant statutory, regulatory and contractual controls.", "justification": "Statutory, Regulatory & Contractual Compliance (CPL-02) provides overlapping security capability that compensates for the absence of Export-Controlled Access Restrictions (CPL-24.2) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CPL-24", "name": "Dual Use Technology", "description": "Mechanisms exist to govern technologies and/or data that have potential:\n(1) \"Dual-use” capabilities for civil and military;\n(2) Use by terrorists; and/or \n(3) Weapons of Mass Destruction (WMD) applications.", "justification": "Dual Use Technology (CPL-24) provides detective monitoring capability that compensates for the absence of Export-Controlled Access Restrictions (CPL-24.2) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "CPL-24.3", "risk_if_not_implemented": "Without Export Activities Documentation, the organization may fail to meet statutory, regulatory or contractual obligations, or be unable to demonstrate conformity when required. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss of Accountability / Attribution (R-AC-1), Regulatory / Legal / Contractual Financial Liability (R-EX-5), Inability to Demonstrate Due Diligence / Due Care (R-GV-9), Loss of Investigative / Evidentiary Capability (R-IR-1), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9), Technical / Mechanical Failure (MT-10), Statutory / Regulatory / Contractual Change (MT-11).", "compensating_control_1": { "control_id": "TPM-20", "name": "Foreign Ownership, Control or Influence (FOCI)", "description": "Mechanisms exist to minimize risk associated with Foreign Ownership, Control or Influence (FOCI) through Supply Chain Risk Management (SCRM) practices.", "justification": "Foreign Ownership, Control or Influence (FOCI) (TPM-20) provides overlapping security capability that compensates for the absence of Export Activities Documentation (CPL-24.3) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CPL-24", "name": "Dual Use Technology", "description": "Mechanisms exist to govern technologies and/or data that have potential:\n(1) \"Dual-use” capabilities for civil and military;\n(2) Use by terrorists; and/or \n(3) Weapons of Mass Destruction (WMD) applications.", "justification": "Dual Use Technology (CPL-24) provides detective monitoring capability that compensates for the absence of Export Activities Documentation (CPL-24.3) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "CPL-25", "risk_if_not_implemented": "Without Statement of Applicability (SOA), the organization may fail to meet statutory, regulatory or contractual obligations, or be unable to demonstrate conformity when required. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss of Authorization / Certification / License (R-EX-11), Unaddressed Security / Compliance Exposure (R-GV-2), Inability to Demonstrate Due Diligence / Due Care (R-GV-9), Unreliable Assurance / Decision Information (R-GV-10), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11).", "compensating_control_1": { "control_id": "RSK-02", "name": "Risk Management Program", "description": "Mechanisms exist to facilitate the implementation of strategic, operational and tactical risk management controls that are aligned with:\n(1) The organization's Enterprise Risk Management (ERM); and\n(2) Industry-recognized cybersecurity risk management practices.", "justification": "Risk Management Program (RSK-02) provides policy-level governance that compensates for the absence of Statement of Applicability (SOA) (CPL-25) by establishing documented expectations, accountability structures, and organizational guardrails. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CPL-07", "name": "Executive Leadership Oversight of Security, Compliance & Resilience Controls", "description": "Mechanisms exist to provide a security, compliance and resilience controls oversight function that reports to the organization's executive leadership.", "justification": "Executive Leadership Oversight of Security, Compliance & Resilience Controls (CPL-07) provides resilience and recovery capability that compensates for the absence of Statement of Applicability (SOA) (CPL-25) by ensuring the organization can restore operations and data when the primary control is absent. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "CPL-26", "risk_if_not_implemented": "Without Work Products, the organization may fail to meet statutory, regulatory or contractual obligations, or be unable to demonstrate conformity when required. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss of Authorization / Certification / License (R-EX-11), Inability to Demonstrate Due Diligence / Due Care (R-GV-9), Unreliable Assurance / Decision Information (R-GV-10), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11).", "compensating_control_1": { "control_id": "CPL-05", "name": "Conformity Monitoring", "description": "Mechanisms exist to validate that Technology Assets, Applications, Services and/or Data (TAASD) conform to the organization's security, compliance and/or resilience policies, standards and other applicable requirements.", "justification": "Conformity Monitoring (CPL-05) provides periodic assessment and assurance that compensates for the absence of Work Products (CPL-26) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "IAO-09", "name": "Applied Security, Compliance and Resilience Controls Documentation", "description": "Mechanisms exist to generate authoritative documentation (e.g., System Security Plan (SSP)) that:\n(1) Identifies key architectural and implementation information on in-scope Technology Assets, Applications and/or Services (TAAS);\n(2) Reflects the current state of applied security, compliance and resilience controls on applicable People, Processes, Technologies, Data and/or Facilities (PPTDF) that are contained within the system boundary; and\n(3) Provides a historical record of applied security controls, including changes.", "justification": "Applied Security, Compliance and Resilience Controls Documentation (IAO-09) provides resilience and recovery capability that compensates for the absence of Work Products (CPL-26) by ensuring the organization can restore operations and data when the primary control is absent. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "CPL-26.1", "risk_if_not_implemented": "Without Defensible Evidence of Due Diligence, required evidence, logs and chain-of-custody integrity may be unavailable or unreliable when needed for investigation or legal proceedings. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Regulatory / Legal / Contractual Financial Liability (R-EX-5), Loss of Authorization / Certification / License (R-EX-11), Inability to Demonstrate Due Diligence / Due Care (R-GV-9), Unreliable Assurance / Decision Information (R-GV-10), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11).", "compensating_control_1": { "control_id": "IAO-09", "name": "Applied Security, Compliance and Resilience Controls Documentation", "description": "Mechanisms exist to generate authoritative documentation (e.g., System Security Plan (SSP)) that:\n(1) Identifies key architectural and implementation information on in-scope Technology Assets, Applications and/or Services (TAAS);\n(2) Reflects the current state of applied security, compliance and resilience controls on applicable People, Processes, Technologies, Data and/or Facilities (PPTDF) that are contained within the system boundary; and\n(3) Provides a historical record of applied security controls, including changes.", "justification": "Applied Security, Compliance and Resilience Controls Documentation (IAO-09) provides resilience and recovery capability that compensates for the absence of Defensible Evidence of Due Diligence (CPL-26.1) by ensuring the organization can restore operations and data when the primary control is absent. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CPL-05", "name": "Conformity Monitoring", "description": "Mechanisms exist to validate that Technology Assets, Applications, Services and/or Data (TAASD) conform to the organization's security, compliance and/or resilience policies, standards and other applicable requirements.", "justification": "Conformity Monitoring (CPL-05) provides periodic assessment and assurance that compensates for the absence of Defensible Evidence of Due Diligence (CPL-26.1) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "CPL-26.2", "risk_if_not_implemented": "Without Defensible Evidence of Due Care, required evidence, logs and chain-of-custody integrity may be unavailable or unreliable when needed for investigation or legal proceedings. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Regulatory / Legal / Contractual Financial Liability (R-EX-5), Loss of Authorization / Certification / License (R-EX-11), Inability to Demonstrate Due Diligence / Due Care (R-GV-9), Unreliable Assurance / Decision Information (R-GV-10), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11).", "compensating_control_1": { "control_id": "CPL-05", "name": "Conformity Monitoring", "description": "Mechanisms exist to validate that Technology Assets, Applications, Services and/or Data (TAASD) conform to the organization's security, compliance and/or resilience policies, standards and other applicable requirements.", "justification": "Conformity Monitoring (CPL-05) provides periodic assessment and assurance that compensates for the absence of Defensible Evidence of Due Care (CPL-26.2) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CPL-26", "name": "Work Products", "description": "Mechanisms exist to produce work products (e.g., process artifacts) that demonstrate the ability to comply with applicable requirements.", "justification": "Work Products (CPL-26) provides overlapping security capability that compensates for the absence of Defensible Evidence of Due Care (CPL-26.2) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "CPL-27", "risk_if_not_implemented": "Without Security, Compliance & Resilience Status Reporting, the organization may fail to meet statutory, regulatory or contractual obligations, or be unable to demonstrate conformity when required. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Regulatory / Legal / Contractual Financial Liability (R-EX-5), Loss of Authorization / Certification / License (R-EX-11), Inability to Demonstrate Due Diligence / Due Care (R-GV-9), Unreliable Assurance / Decision Information (R-GV-10), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11).", "compensating_control_1": { "control_id": "CPL-07", "name": "Executive Leadership Oversight of Security, Compliance & Resilience Controls", "description": "Mechanisms exist to provide a security, compliance and resilience controls oversight function that reports to the organization's executive leadership.", "justification": "Executive Leadership Oversight of Security, Compliance & Resilience Controls (CPL-07) provides resilience and recovery capability that compensates for the absence of Security, Compliance & Resilience Status Reporting (CPL-27) by ensuring the organization can restore operations and data when the primary control is absent. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "MON-06", "name": "Monitoring Reporting", "description": "Mechanisms exist to provide an event log report generation capability to aid in detecting and assessing anomalous activities.", "justification": "Monitoring Reporting (MON-06) provides detective monitoring capability that compensates for the absence of Security, Compliance & Resilience Status Reporting (CPL-27) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "CPL-28", "risk_if_not_implemented": "Without AI & Autonomous Technologies Registration, AI and autonomous systems may produce unreliable, biased or unsafe outputs, act outside authorized scope, or expose sensitive data. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Regulatory / Legal / Contractual Financial Liability (R-EX-5), Loss of Authorization / Certification / License (R-EX-11), Sensitive Data / Compliance Exposure from Unsanctioned AI Use (R-AI-4), and most likely increases susceptibility to Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11).", "compensating_control_1": { "control_id": "DCH-03", "name": "Sensitive / Regulated Data Governance", "description": "Mechanisms exist to facilitate data governance so that sensitive and/or regulated data is effectively managed and maintained in accordance with applicable statutory, regulatory and contractual obligations.", "justification": "Sensitive / Regulated Data Governance (DCH-03) provides policy-level governance that compensates for the absence of AI & Autonomous Technologies Registration (CPL-28) by establishing documented expectations, accountability structures, and organizational guardrails. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CPL-02", "name": "Statutory, Regulatory & Contractual Compliance", "description": "Mechanisms exist to facilitate the identification and implementation of relevant statutory, regulatory and contractual controls.", "justification": "Statutory, Regulatory & Contractual Compliance (CPL-02) provides overlapping security capability that compensates for the absence of AI & Autonomous Technologies Registration (CPL-28) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "CPL-29", "risk_if_not_implemented": "Without Control Assurance Automation (CAA) Oversight, automated control assurance results may be manipulated, misattributed or lose integrity, causing misplaced confidence in control effectiveness. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unperformed / Unowned Control Responsibilities (R-GV-3), Lack of oversight of internal controls (R-GV-6), Inability to Demonstrate Due Diligence / Due Care (R-GV-9), Unreliable Assurance / Decision Information (R-GV-10), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11), Conflict of Interest (COI) / Undue Influence / Insider Misconduct (MT-15).", "compensating_control_1": { "control_id": "CPL-18", "name": "Continuous Control Monitoring (CCM)", "description": "Automated mechanisms exist to perform Continuous Control Monitoring (CCM) to assess and report the conformity status of the organization's Technology Assets, Applications, Services and Data (TAASD) against applicable security, compliance and resilience controls.", "justification": "Continuous Control Monitoring (CCM) (CPL-18) provides detective monitoring capability that compensates for the absence of Control Assurance Automation (CAA) Oversight (CPL-29) by identifying unauthorized, anomalous or non-compliant activity that the primary control would have prevented. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CPL-05", "name": "Conformity Monitoring", "description": "Mechanisms exist to validate that Technology Assets, Applications, Services and/or Data (TAASD) conform to the organization's security, compliance and/or resilience policies, standards and other applicable requirements.", "justification": "Conformity Monitoring (CPL-05) provides detective monitoring capability that compensates for the absence of Control Assurance Automation (CAA) Oversight (CPL-29) by identifying unauthorized, anomalous or non-compliant activity that the primary control would have prevented. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "CPL-30", "risk_if_not_implemented": "Without Control Assurance Automation (CAA) Evidence Integrity & Provenance, automated control assurance results may be manipulated, misattributed or lose integrity, causing misplaced confidence in control effectiveness. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Inability to Demonstrate Due Diligence / Due Care (R-GV-9), Unreliable Assurance / Decision Information (R-GV-10), Loss of Investigative / Evidentiary Capability (R-IR-1), Loss of Data Integrity (R-IP-3), Loss of Authenticity / Provenance (R-IP-5), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Technical / Mechanical Failure (MT-10), Fraud, Corruption and/or Intentional Criminal Conduct (MT-14).", "compensating_control_1": { "control_id": "MON-12", "name": "Protection of Event Logs & Security-Relevant Telemetry", "description": "Mechanisms exist to protect event logs, security-relevant telemetry and audit tools from unauthorized access, modification and deletion.", "justification": "Protection of Event Logs & Security-Relevant Telemetry (MON-12) provides detective monitoring capability that compensates for the absence of Control Assurance Automation (CAA) Evidence Integrity & Provenance (CPL-30) by identifying unauthorized, anomalous or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CPL-16", "name": "Evidence Request List (ERL)", "description": "Mechanisms exist to define an Evidence Request List (ERL) prior to the start of a cybersecurity and/or data protection assessment.", "justification": "Evidence Request List (ERL) (CPL-16) provides overlapping security capability that compensates for the absence of Control Assurance Automation (CAA) Evidence Integrity & Provenance (CPL-30) by addressing related risk objectives through an alternative control mechanism. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "CFG-02", "risk_if_not_implemented": "Without Configuration Management Program, Technology Assets, Applications and/or Services (TAAS) may operate with insecure, unauthorized or drifted configurations that expand the attack surface. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unaddressed Security / Compliance Exposure (R-GV-2), Unperformed / Unowned Control Responsibilities (R-GV-3), Inability to Demonstrate Due Diligence / Due Care (R-GV-9), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9).", "compensating_control_1": { "control_id": "CHG-02", "name": "Change Management Program", "description": "Mechanisms exist to facilitate the implementation of a change management program.", "justification": "Change Management Program (CHG-02) provides policy-level governance that compensates for the absence of Configuration Management Program (CFG-02) by establishing documented expectations, accountability structures, and organizational guardrails. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "VPM-02", "name": "Vulnerability & Patch Management Program (VPMP)", "description": "Mechanisms exist to facilitate the implementation and monitoring of risk-based vulnerability management capabilities.", "justification": "Vulnerability & Patch Management Program (VPMP) (VPM-02) provides policy-level governance that compensates for the absence of Configuration Management Program (CFG-02) by establishing documented expectations, accountability structures, and organizational guardrails. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "CFG-03.1", "risk_if_not_implemented": "Without Baseline Tailoring, Technology Assets, Applications and/or Services (TAAS) may operate with insecure, unauthorized or drifted configurations that expand the attack surface. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unaddressed Security / Compliance Exposure (R-GV-2), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9).", "compensating_control_1": { "control_id": "CFG-16", "name": "Zero-Touch Provisioning (ZTP)", "description": "Mechanisms exist to implement Zero-Touch Provisioning (ZTP), or similar technology, to automatically and securely configure devices upon being added to a network.", "justification": "Zero-Touch Provisioning (ZTP) (CFG-16) provides access control enforcement that compensates for the absence of Baseline Tailoring (CFG-03.1) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "VPM-02", "name": "Vulnerability & Patch Management Program (VPMP)", "description": "Mechanisms exist to facilitate the implementation and monitoring of risk-based vulnerability management capabilities.", "justification": "Vulnerability & Patch Management Program (VPMP) (VPM-02) provides policy-level governance that compensates for the absence of Baseline Tailoring (CFG-03.1) by establishing documented expectations, accountability structures, and organizational guardrails. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "CFG-03.2", "risk_if_not_implemented": "Without Development & Test Environment Configurations, Technology Assets, Applications and/or Services (TAAS) may operate with insecure, unauthorized or drifted configurations that expand the attack surface. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Modification / Loss of System Integrity (R-AM-2), and most likely increases susceptibility to Human Error (MT-9).", "compensating_control_1": { "control_id": "CFG-08.2", "name": "Integrity Assurance & Enforcement (IAE)", "description": "Automated mechanisms exist to:\n(1) Identify unauthorized deviations from an approved secure baseline configuration; and\n(2) Implement automated resiliency actions to remediate the unauthorized change.", "justification": "Integrity Assurance & Enforcement (IAE) (CFG-08.2) provides configuration hardening that compensates for the absence of Development & Test Environment Configurations (CFG-03.2) by eliminating unnecessary services and enforcing secure settings to reduce inherent exposure. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CFG-04", "name": "Secure Baseline Configurations", "description": "Mechanisms exist to develop, document and maintain secure baseline configurations for Technology Assets, Applications and/or Services (TAAS) that are consistent with industry-accepted hardening standards.", "justification": "Secure Baseline Configurations (CFG-04) provides configuration hardening that compensates for the absence of Development & Test Environment Configurations (CFG-03.2) by eliminating unnecessary services and enforcing secure settings to reduce inherent exposure. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "CFG-04.1", "risk_if_not_implemented": "Without Account Lockout, unauthorized individuals, devices or services may gain access to Technology Assets, Applications, Services, Data and/or Facilities (TAASDF). Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Access (R-AC-4), Identity Compromise / Impersonation (R-AC-5), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "IAC-41", "name": "Adaptive Identification & Authentication", "description": "Mechanisms exist to allow individuals to utilize alternative methods of authentication under specific circumstances or situations.", "justification": "Adaptive Identification & Authentication (IAC-41) provides access control enforcement that compensates for the absence of Account Lockout (CFG-04.1) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "MON-02", "name": "Continuous Monitoring", "description": "Mechanisms exist to facilitate the implementation of enterprise-wide monitoring controls.", "justification": "Continuous Monitoring (MON-02) provides detective monitoring capability that compensates for the absence of Account Lockout (CFG-04.1) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "CFG-04.2", "risk_if_not_implemented": "Without Concurrent Session Control, Technology Assets, Applications and/or Services (TAAS) may operate with insecure, unauthorized or drifted configurations that expand the attack surface. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss of Accountability / Attribution (R-AC-1), and most likely increases susceptibility to Human Error (MT-9), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "CFG-04.5", "name": "Session Termination", "description": "Automated mechanisms exist to log out users, both locally on the network and for remote sessions, at the end of the session or after an organization-defined period of inactivity.", "justification": "Session Termination (CFG-04.5) provides overlapping security capability that compensates for the absence of Concurrent Session Control (CFG-04.2) by addressing related risk objectives through an alternative control mechanism aligned with Technology applicability. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CFG-04.1", "name": "Account Lockout", "description": "Mechanisms exist to enforce a limit for consecutive invalid login attempts by a user during an organization-defined time period and automatically locks the account when the maximum number of unsuccessful attempts is exceeded.", "justification": "Account Lockout (CFG-04.1) provides access control enforcement that compensates for the absence of Concurrent Session Control (CFG-04.2) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "CFG-04.3", "risk_if_not_implemented": "Without Session Lock, Technology Assets, Applications and/or Services (TAAS) may operate with insecure, unauthorized or drifted configurations that expand the attack surface. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Access (R-AC-4), and most likely increases susceptibility to Human Error (MT-9), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "CFG-04.5", "name": "Session Termination", "description": "Automated mechanisms exist to log out users, both locally on the network and for remote sessions, at the end of the session or after an organization-defined period of inactivity.", "justification": "Session Termination (CFG-04.5) provides overlapping security capability that compensates for the absence of Session Lock (CFG-04.3) by addressing related risk objectives through an alternative control mechanism aligned with Technology applicability. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "IAC-43", "name": "Re-Authentication", "description": "Mechanisms exist to force users and devices to re-authenticate according to organization-defined circumstances that necessitate re-authentication.", "justification": "Re-Authentication (IAC-43) provides access control enforcement that compensates for the absence of Session Lock (CFG-04.3) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "CFG-04.4", "risk_if_not_implemented": "Without Pattern-Hiding Displays, Technology Assets, Applications and/or Services (TAAS) may operate with insecure, unauthorized or drifted configurations that expand the attack surface. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss of Confidentiality (R-IP-2), and most likely increases susceptibility to Human Error (MT-9), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "IAC-43", "name": "Re-Authentication", "description": "Mechanisms exist to force users and devices to re-authenticate according to organization-defined circumstances that necessitate re-authentication.", "justification": "Re-Authentication (IAC-43) provides access control enforcement that compensates for the absence of Pattern-Hiding Displays (CFG-04.4) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CFG-04.5", "name": "Session Termination", "description": "Automated mechanisms exist to log out users, both locally on the network and for remote sessions, at the end of the session or after an organization-defined period of inactivity.", "justification": "Session Termination (CFG-04.5) provides overlapping security capability that compensates for the absence of Pattern-Hiding Displays (CFG-04.4) by addressing related risk objectives through an alternative control mechanism aligned with Technology applicability. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "CFG-04.5", "risk_if_not_implemented": "Without Session Termination, Technology Assets, Applications and/or Services (TAAS) may operate with insecure, unauthorized or drifted configurations that expand the attack surface. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Access (R-AC-4), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "CFG-04.3", "name": "Session Lock", "description": "Mechanisms exist to initiate a session lock after an organization-defined time period of inactivity, or upon receiving a request from a user and retain the session lock until the user reestablishes access using established identification and authentication methods.", "justification": "Session Lock (CFG-04.3) provides overlapping security capability that compensates for the absence of Session Termination (CFG-04.5) by addressing related risk objectives through an alternative control mechanism aligned with Technology applicability. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "IAC-43", "name": "Re-Authentication", "description": "Mechanisms exist to force users and devices to re-authenticate according to organization-defined circumstances that necessitate re-authentication.", "justification": "Re-Authentication (IAC-43) provides access control enforcement that compensates for the absence of Session Termination (CFG-04.5) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "CFG-04.6", "risk_if_not_implemented": "Without User-Initiated Logouts / Message Displays, Technology Assets, Applications and/or Services (TAAS) may operate with insecure, unauthorized or drifted configurations that expand the attack surface. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Access (R-AC-4), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "IAC-43", "name": "Re-Authentication", "description": "Mechanisms exist to force users and devices to re-authenticate according to organization-defined circumstances that necessitate re-authentication.", "justification": "Re-Authentication (IAC-43) provides access control enforcement that compensates for the absence of User-Initiated Logouts / Message Displays (CFG-04.6) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CFG-04.3", "name": "Session Lock", "description": "Mechanisms exist to initiate a session lock after an organization-defined time period of inactivity, or upon receiving a request from a user and retain the session lock until the user reestablishes access using established identification and authentication methods.", "justification": "Session Lock (CFG-04.3) provides overlapping security capability that compensates for the absence of User-Initiated Logouts / Message Displays (CFG-04.6) by addressing related risk objectives through an alternative control mechanism aligned with Technology applicability. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "CFG-04.7", "risk_if_not_implemented": "Without Non-Console Administrative Access, users, services and processes may obtain or retain access beyond authorized need, enabling misuse or escalation. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss of Confidentiality (R-IP-2), Loss of Data Integrity (R-IP-3), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9), Technical / Mechanical Failure (MT-10), Cryptographic Compromise / Cryptanalytic Capability Advancement (MT-31).", "compensating_control_1": { "control_id": "NET-03", "name": "Boundary Protection", "description": "Mechanisms exist to monitor and control communications at the external network boundary and at key internal boundaries within the network.", "justification": "Boundary Protection (NET-03) provides network-level access restriction that compensates for the absence of Non-Console Administrative Access (CFG-04.7) by limiting attacker reach and lateral movement opportunities across the environment. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "IAC-37", "name": "Multi-Factor Authentication (MFA)", "description": "Automated mechanisms exist to enforce Multi-Factor Authentication (MFA) for:\n(1) Remote network access; \n(2) Third-party Technology Assets, Applications and/or Services (TAAS); and/ or\n(3) Non-console access to critical TAAS that store, transmit and/or process sensitive and/or regulated data.", "justification": "Multi-Factor Authentication (MFA) (IAC-37) provides access control enforcement that compensates for the absence of Non-Console Administrative Access (CFG-04.7) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "CFG-04.8", "risk_if_not_implemented": "Without Wireless Access Authentication & Encryption, data in transit and at rest may be exposed through weak, misconfigured or compromised cryptographic protections. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Access (R-AC-4), Identity Compromise / Impersonation (R-AC-5), Loss of Confidentiality (R-IP-2), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9), Technical / Mechanical Failure (MT-10), Cryptographic Compromise / Cryptanalytic Capability Advancement (MT-31).", "compensating_control_1": { "control_id": "NET-24", "name": "Wireless Networking", "description": "Mechanisms exist to control authorized wireless usage and monitor for unauthorized wireless access.", "justification": "Wireless Networking (NET-24) provides network-level access restriction that compensates for the absence of Wireless Access Authentication & Encryption (CFG-04.8) by limiting attacker reach and lateral movement opportunities across the environment. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "IAC-37", "name": "Multi-Factor Authentication (MFA)", "description": "Automated mechanisms exist to enforce Multi-Factor Authentication (MFA) for:\n(1) Remote network access; \n(2) Third-party Technology Assets, Applications and/or Services (TAAS); and/ or\n(3) Non-console access to critical TAAS that store, transmit and/or process sensitive and/or regulated data.", "justification": "Multi-Factor Authentication (MFA) (IAC-37) provides access control enforcement that compensates for the absence of Wireless Access Authentication & Encryption (CFG-04.8) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "CFG-04.9", "risk_if_not_implemented": "Without Bluetooth & Wireless Devices, adversaries may move laterally, exfiltrate data or reach systems that should have been isolated from untrusted networks. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss of Confidentiality (R-IP-2), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "IAC-25", "name": "Access Enforcement", "description": "Mechanisms exist to enforce Logical Access Control (LAC) permissions that conform to the principle of \"least privilege.\"", "justification": "Access Enforcement (IAC-25) provides access control enforcement that compensates for the absence of Bluetooth & Wireless Devices (CFG-04.9) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CFG-03", "name": "Least Functionality", "description": "Mechanisms exist to configure Technology Assets, Applications and/or Services (TAAS) to provide only essential capabilities by specifically prohibiting or restricting the use of ports, protocols, and/or services.", "justification": "Least Functionality (CFG-03) provides configuration hardening that compensates for the absence of Bluetooth & Wireless Devices (CFG-04.9) by eliminating unnecessary services and enforcing secure settings to reduce inherent exposure. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "CFG-04.10", "risk_if_not_implemented": "Without Infrared Communications, Technology Assets, Applications and/or Services (TAAS) may operate with insecure, unauthorized or drifted configurations that expand the attack surface. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss of Confidentiality (R-IP-2), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "CFG-03", "name": "Least Functionality", "description": "Mechanisms exist to configure Technology Assets, Applications and/or Services (TAAS) to provide only essential capabilities by specifically prohibiting or restricting the use of ports, protocols, and/or services.", "justification": "Least Functionality (CFG-03) provides configuration hardening that compensates for the absence of Infrared Communications (CFG-04.10) by eliminating unnecessary services and enforcing secure settings to reduce inherent exposure. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "IAC-30", "name": "Least Privilege", "description": "Mechanisms exist to utilize the concept of least privilege, allowing only authorized access to processes necessary to accomplish assigned tasks in accordance with organizational business functions.", "justification": "Least Privilege (IAC-30) provides access control enforcement that compensates for the absence of Infrared Communications (CFG-04.10) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "CFG-04.11", "risk_if_not_implemented": "Without Microphones & Web Cameras, Technology Assets, Applications and/or Services (TAAS) may operate with insecure, unauthorized or drifted configurations that expand the attack surface. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss of Confidentiality (R-IP-2), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "PES-10", "name": "Physical Security of Offices, Rooms & Facilities", "description": "Mechanisms exist to identify systems, equipment and respective operating environments that require limited physical access so that appropriate physical access controls are designed and implemented for offices, rooms and facilities.", "justification": "Physical Security of Offices, Rooms & Facilities (PES-10) provides physical access control that compensates for the absence of Microphones & Web Cameras (CFG-04.11) by preventing unauthorized physical interaction with systems and infrastructure. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "AST-28", "name": "Usage Parameters", "description": "Mechanisms exist to monitor and enforce usage parameters that limit the potential damage caused from the unauthorized or unintentional alteration of system settings.", "justification": "Usage Parameters (AST-28) provides overlapping security capability that compensates for the absence of Microphones & Web Cameras (CFG-04.11) by addressing related risk objectives through an alternative control mechanism aligned with Technology applicability. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "CFG-04.12", "risk_if_not_implemented": "Without Multi-Function Devices (MFD), Technology Assets, Applications and/or Services (TAAS) may operate with insecure, unauthorized or drifted configurations that expand the attack surface. Based on the risk and threat mapping for this control, no risk is rated Likely; risks rated Possible include Unauthorized Access (R-AC-4), Unauthorized Modification / Loss of System Integrity (R-AM-2), Unauthorized Retention / Inability to Dispose of Data (R-AM-3), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "CFG-04", "name": "Secure Baseline Configurations", "description": "Mechanisms exist to develop, document and maintain secure baseline configurations for Technology Assets, Applications and/or Services (TAAS) that are consistent with industry-accepted hardening standards.", "justification": "Secure Baseline Configurations (CFG-04) provides configuration hardening that compensates for the absence of Multi-Function Devices (MFD) (CFG-04.12) by eliminating unnecessary services and enforcing secure settings to reduce inherent exposure. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "IAC-30", "name": "Least Privilege", "description": "Mechanisms exist to utilize the concept of least privilege, allowing only authorized access to processes necessary to accomplish assigned tasks in accordance with organizational business functions.", "justification": "Least Privilege (IAC-30) provides access control enforcement that compensates for the absence of Multi-Function Devices (MFD) (CFG-04.12) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "CFG-04.13", "risk_if_not_implemented": "Without Radio Frequency Identification (RFID) Security, Technology Assets, Applications and/or Services (TAAS) may operate with insecure, unauthorized or drifted configurations that expand the attack surface. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Access (R-AC-4), Loss of Confidentiality (R-IP-2), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "NET-24", "name": "Wireless Networking", "description": "Mechanisms exist to control authorized wireless usage and monitor for unauthorized wireless access.", "justification": "Wireless Networking (NET-24) provides network-level access restriction that compensates for the absence of Radio Frequency Identification (RFID) Security (CFG-04.13) by limiting attacker reach and lateral movement opportunities across the environment. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "PES-08", "name": "Physical Access Control", "description": "Physical access control mechanisms exist to enforce physical access authorizations for all physical access points (including designated entry/exit points) to facilities (excluding those areas within the facility officially designated as publicly accessible).", "justification": "Physical Access Control (PES-08) provides access control enforcement that compensates for the absence of Radio Frequency Identification (RFID) Security (CFG-04.13) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "CFG-04.14", "risk_if_not_implemented": "Without Contactless Access Control Systems, unauthorized individuals, devices or services may gain access to Technology Assets, Applications, Services, Data and/or Facilities (TAASDF). Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Access (R-AC-4), Loss of Confidentiality (R-IP-2), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Physical Crime (MT-5), Human Error (MT-9), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "PES-08", "name": "Physical Access Control", "description": "Physical access control mechanisms exist to enforce physical access authorizations for all physical access points (including designated entry/exit points) to facilities (excluding those areas within the facility officially designated as publicly accessible).", "justification": "Physical Access Control (PES-08) provides access control enforcement that compensates for the absence of Contactless Access Control Systems (CFG-04.14) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "NET-24", "name": "Wireless Networking", "description": "Mechanisms exist to control authorized wireless usage and monitor for unauthorized wireless access.", "justification": "Wireless Networking (NET-24) provides network-level access restriction that compensates for the absence of Contactless Access Control Systems (CFG-04.14) by limiting attacker reach and lateral movement opportunities across the environment. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "CFG-04.15", "risk_if_not_implemented": "Without Thin Nodes, Technology Assets, Applications and/or Services (TAAS) may operate with insecure, unauthorized or drifted configurations that expand the attack surface. Based on the risk and threat mapping for this control, no risk is rated Likely; risks rated Possible include Unauthorized Access (R-AC-4), Unauthorized Modification / Loss of System Integrity (R-AM-2), Unauthorized Retention / Inability to Dispose of Data (R-AM-3), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "NET-06", "name": "Network Segmentation (macrosegmentation)", "description": "Mechanisms exist to implement network segmentation within network architectures to isolate Technology Assets, Applications and/or Services (TAAS) from other network resources.", "justification": "Network Segmentation (macrosegmentation) (NET-06) provides network-level access restriction that compensates for the absence of Thin Nodes (CFG-04.15) by limiting attacker reach and lateral movement opportunities across the environment. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CFG-03", "name": "Least Functionality", "description": "Mechanisms exist to configure Technology Assets, Applications and/or Services (TAAS) to provide only essential capabilities by specifically prohibiting or restricting the use of ports, protocols, and/or services.", "justification": "Least Functionality (CFG-03) provides configuration hardening that compensates for the absence of Thin Nodes (CFG-04.15) by eliminating unnecessary services and enforcing secure settings to reduce inherent exposure. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "CFG-04.16", "risk_if_not_implemented": "Without Video Teleconference (VTC) Security, Technology Assets, Applications and/or Services (TAAS) may operate with insecure, unauthorized or drifted configurations that expand the attack surface. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss of Confidentiality (R-IP-2), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "NET-24", "name": "Wireless Networking", "description": "Mechanisms exist to control authorized wireless usage and monitor for unauthorized wireless access.", "justification": "Wireless Networking (NET-24) provides network-level access restriction that compensates for the absence of Video Teleconference (VTC) Security (CFG-04.16) by limiting attacker reach and lateral movement opportunities across the environment. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CRY-05", "name": "Encrypting Data In Transit", "description": "Cryptographic mechanisms exist to prevent the unauthorized disclosure of data in transit.", "justification": "Encrypting Data In Transit (CRY-05) provides cryptographic protection that compensates for the absence of Video Teleconference (VTC) Security (CFG-04.16) by ensuring data confidentiality and integrity through alternative technical means. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "CFG-04.17", "risk_if_not_implemented": "Without Voice Over Internet Protocol (VoIP) Security, Technology Assets, Applications and/or Services (TAAS) may operate with insecure, unauthorized or drifted configurations that expand the attack surface. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Access (R-AC-4), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "NET-24", "name": "Wireless Networking", "description": "Mechanisms exist to control authorized wireless usage and monitor for unauthorized wireless access.", "justification": "Wireless Networking (NET-24) provides network-level access restriction that compensates for the absence of Voice Over Internet Protocol (VoIP) Security (CFG-04.17) by limiting attacker reach and lateral movement opportunities across the environment. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CRY-05", "name": "Encrypting Data In Transit", "description": "Cryptographic mechanisms exist to prevent the unauthorized disclosure of data in transit.", "justification": "Encrypting Data In Transit (CRY-05) provides cryptographic protection that compensates for the absence of Voice Over Internet Protocol (VoIP) Security (CFG-04.17) by ensuring data confidentiality and integrity through alternative technical means. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "CFG-04.18", "risk_if_not_implemented": "Without Disable Wireless Networking, adversaries may move laterally, exfiltrate data or reach systems that should have been isolated from untrusted networks. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Access (R-AC-4), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9).", "compensating_control_1": { "control_id": "IAC-37", "name": "Multi-Factor Authentication (MFA)", "description": "Automated mechanisms exist to enforce Multi-Factor Authentication (MFA) for:\n(1) Remote network access; \n(2) Third-party Technology Assets, Applications and/or Services (TAAS); and/ or\n(3) Non-console access to critical TAAS that store, transmit and/or process sensitive and/or regulated data.", "justification": "Multi-Factor Authentication (MFA) (IAC-37) provides access control enforcement that compensates for the absence of Disable Wireless Networking (CFG-04.18) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "NET-24", "name": "Wireless Networking", "description": "Mechanisms exist to control authorized wireless usage and monitor for unauthorized wireless access.", "justification": "Wireless Networking (NET-24) provides network-level access restriction that compensates for the absence of Disable Wireless Networking (CFG-04.18) by limiting attacker reach and lateral movement opportunities across the environment. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "CFG-05", "risk_if_not_implemented": "Without Configure Technology Assets, Applications and/or Services (TAAS) for High-Risk Areas, Technology Assets, Applications and/or Services (TAAS) may operate with insecure, unauthorized or drifted configurations that expand the attack surface. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Access (R-AC-4), System / Data Compromise (Technical Vector) (R-BC-4), System / Service Compromise (R-EX-7), Loss of Confidentiality (R-IP-2), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9).", "compensating_control_1": { "control_id": "VPM-02", "name": "Vulnerability & Patch Management Program (VPMP)", "description": "Mechanisms exist to facilitate the implementation and monitoring of risk-based vulnerability management capabilities.", "justification": "Vulnerability & Patch Management Program (VPMP) (VPM-02) provides policy-level governance that compensates for the absence of Configure Technology Assets, Applications and/or Services (TAAS) for High-Risk Areas (CFG-05) by establishing documented expectations, accountability structures, and organizational guardrails. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CFG-08.2", "name": "Integrity Assurance & Enforcement (IAE)", "description": "Automated mechanisms exist to:\n(1) Identify unauthorized deviations from an approved secure baseline configuration; and\n(2) Implement automated resiliency actions to remediate the unauthorized change.", "justification": "Integrity Assurance & Enforcement (IAE) (CFG-08.2) provides configuration hardening that compensates for the absence of Configure Technology Assets, Applications and/or Services (TAAS) for High-Risk Areas (CFG-05) by eliminating unnecessary services and enforcing secure settings to reduce inherent exposure. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "CFG-05.1", "risk_if_not_implemented": "Without Physically Disable or Remove Capabilities, unauthorized individuals may gain physical access to facilities and equipment, enabling theft, tampering, damage or safety incidents. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Access (R-AC-4), Unauthorized Modification / Loss of System Integrity (R-AM-2), System / Data Compromise (Non-Technical Vector) (R-BC-5), and most likely increases susceptibility to Physical Crime (MT-5), Human Error (MT-9).", "compensating_control_1": { "control_id": "CFG-03", "name": "Least Functionality", "description": "Mechanisms exist to configure Technology Assets, Applications and/or Services (TAAS) to provide only essential capabilities by specifically prohibiting or restricting the use of ports, protocols, and/or services.", "justification": "Least Functionality (CFG-03) provides configuration hardening that compensates for the absence of Port & Input / Output (I/O) Device Access (CFG-05.1) by eliminating unnecessary services and enforcing secure settings to reduce inherent exposure. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "IAC-30", "name": "Least Privilege", "description": "Mechanisms exist to utilize the concept of least privilege, allowing only authorized access to processes necessary to accomplish assigned tasks in accordance with organizational business functions.", "justification": "Least Privilege (IAC-30) provides access control enforcement that compensates for the absence of Port & Input / Output (I/O) Device Access (CFG-05.1) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "CFG-06", "risk_if_not_implemented": "Without Approved Configuration Deviations, Technology Assets, Applications and/or Services (TAAS) may operate with insecure, unauthorized or drifted configurations that expand the attack surface. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unaddressed Security / Compliance Exposure (R-GV-2), Lack of oversight of internal controls (R-GV-6), Inability to Demonstrate Due Diligence / Due Care (R-GV-9), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Conflict of Interest (COI) / Undue Influence / Insider Misconduct (MT-15).", "compensating_control_1": { "control_id": "CFG-08.2", "name": "Integrity Assurance & Enforcement (IAE)", "description": "Automated mechanisms exist to:\n(1) Identify unauthorized deviations from an approved secure baseline configuration; and\n(2) Implement automated resiliency actions to remediate the unauthorized change.", "justification": "Integrity Assurance & Enforcement (IAE) (CFG-08.2) provides configuration hardening that compensates for the absence of Approved Configuration Deviations (CFG-02.7) by eliminating unnecessary services and enforcing secure settings to reduce inherent exposure. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "VPM-08", "name": "Software & Firmware Patching", "description": "Mechanisms exist to conduct software patching for all deployed Technology Assets, Applications and/or Services (TAAS), including firmware.", "justification": "Software & Firmware Patching (VPM-08) provides vulnerability management that compensates for the absence of Approved Configuration Deviations (CFG-02.7) by reducing the exploitable attack surface by addressing known weaknesses before they are leveraged. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "CFG-07", "risk_if_not_implemented": "Without Baseline Configuration Reviews & Updates, Technology Assets, Applications and/or Services (TAAS) may operate with insecure, unauthorized or drifted configurations that expand the attack surface. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unaddressed Security / Compliance Exposure (R-GV-2), Lack of oversight of internal controls (R-GV-6), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9).", "compensating_control_1": { "control_id": "VPM-08", "name": "Software & Firmware Patching", "description": "Mechanisms exist to conduct software patching for all deployed Technology Assets, Applications and/or Services (TAAS), including firmware.", "justification": "Software & Firmware Patching (VPM-08) provides vulnerability management that compensates for the absence of Reviews & Updates (CFG-07) by reducing the exploitable attack surface by addressing known weaknesses before they are leveraged. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "END-03", "name": "Endpoint Protection Mechanisms", "description": "Mechanisms exist to protect the confidentiality, integrity, availability and safety of endpoint devices.", "justification": "Endpoint Protection Mechanisms (END-03) provides overlapping security capability that compensates for the absence of Reviews & Updates (CFG-07) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "CFG-07.1", "risk_if_not_implemented": "Without Automated Baseline Configuration Management & Verification, Technology Assets, Applications and/or Services (TAAS) may operate with insecure, unauthorized or drifted configurations that expand the attack surface. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Modification / Loss of System Integrity (R-AM-2), Lack of oversight of internal controls (R-GV-6), Unreliable Assurance / Decision Information (R-GV-10), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9), Technical / Mechanical Failure (MT-10), Data Quality Degradation / Data Poisoning (MT-12).", "compensating_control_1": { "control_id": "CFG-08.2", "name": "Integrity Assurance & Enforcement (IAE)", "description": "Automated mechanisms exist to:\n(1) Identify unauthorized deviations from an approved secure baseline configuration; and\n(2) Implement automated resiliency actions to remediate the unauthorized change.", "justification": "Integrity Assurance & Enforcement (IAE) (CFG-08.2) provides configuration hardening that compensates for the absence of Automated Central Management & Verification (CFG-07.1) by eliminating unnecessary services and enforcing secure settings to reduce inherent exposure. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "MON-02", "name": "Continuous Monitoring", "description": "Mechanisms exist to facilitate the implementation of enterprise-wide monitoring controls.", "justification": "Continuous Monitoring (MON-02) provides detective monitoring capability that compensates for the absence of Automated Central Management & Verification (CFG-07.1) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "CFG-08", "risk_if_not_implemented": "Without Periodic Configuration Reviews, Technology Assets, Applications and/or Services (TAAS) may operate with insecure, unauthorized or drifted configurations that expand the attack surface. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unaddressed Security / Compliance Exposure (R-GV-2), Lack of oversight of internal controls (R-GV-6), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9).", "compensating_control_1": { "control_id": "CFG-04", "name": "Secure Baseline Configurations", "description": "Mechanisms exist to develop, document and maintain secure baseline configurations for Technology Assets, Applications and/or Services (TAAS) that are consistent with industry-accepted hardening standards.", "justification": "Secure Baseline Configurations (CFG-04) provides configuration hardening that compensates for the absence of Periodic Review (CFG-08) by eliminating unnecessary services and enforcing secure settings to reduce inherent exposure. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CFG-12", "name": "Restrict Roles Permitted To Install Software", "description": "Automated mechanisms exist to prevent the installation of software, unless the action is performed by a privileged user or service.", "justification": "Restrict Roles Permitted To Install Software (CFG-12) provides access control enforcement that compensates for the absence of Periodic Review (CFG-08) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "CFG-08.1", "risk_if_not_implemented": "Without Respond To Unauthorized Changes, Technology Assets, Applications and/or Services (TAAS) may operate with insecure, unauthorized or drifted configurations that expand the attack surface. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Delayed Containment / Increased Incident Impact (R-IR-2), Incident Persistence / Recurrence (R-IR-3), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9).", "compensating_control_1": { "control_id": "VPM-08", "name": "Software & Firmware Patching", "description": "Mechanisms exist to conduct software patching for all deployed Technology Assets, Applications and/or Services (TAAS), including firmware.", "justification": "Software & Firmware Patching (VPM-08) provides vulnerability management that compensates for the absence of Respond To Unauthorized Changes (CFG-08.1) by reducing the exploitable attack surface by addressing known weaknesses before they are leveraged. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CFG-08.2", "name": "Integrity Assurance & Enforcement (IAE)", "description": "Automated mechanisms exist to:\n(1) Identify unauthorized deviations from an approved secure baseline configuration; and\n(2) Implement automated resiliency actions to remediate the unauthorized change.", "justification": "Integrity Assurance & Enforcement (IAE) (CFG-08.2) provides configuration hardening that compensates for the absence of Respond To Unauthorized Changes (CFG-08.1) by eliminating unnecessary services and enforcing secure settings to reduce inherent exposure. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "CFG-08.2", "risk_if_not_implemented": "Without Integrity Assurance & Enforcement (IAE), executive management, the Board of Directors (BoD) and assessors may rely on inaccurate, incomplete or unverifiable control and risk information. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Modification / Loss of System Integrity (R-AM-2), Lack of oversight of internal controls (R-GV-6), Undetected / Delayed Detection of Adverse Activity (R-SA-1), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9), Technical / Mechanical Failure (MT-10), Data Quality Degradation / Data Poisoning (MT-12).", "compensating_control_1": { "control_id": "CHG-09", "name": "Control Functionality Verification", "description": "Mechanisms exist to verify the functionality of security, compliance and resilience controls following implemented changes to ensure applicable controls operate as designed.", "justification": "Control Functionality Verification (CHG-09) provides overlapping security capability that compensates for the absence of Integrity Assurance & Enforcement (IAE) (CFG-06.1) by addressing related risk objectives through an alternative control mechanism aligned with Technology applicability. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "MON-02", "name": "Continuous Monitoring", "description": "Mechanisms exist to facilitate the implementation of enterprise-wide monitoring controls.", "justification": "Continuous Monitoring (MON-02) provides detective monitoring capability that compensates for the absence of Integrity Assurance & Enforcement (IAE) (CFG-06.1) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "CFG-09", "risk_if_not_implemented": "Without Retention Of Previous Configurations, data may be retained longer than authorized or necessary, or may be unrecoverable when legally or operationally required. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Recovery Failure / Unacceptable Recovery Delay (R-OR-1), and most likely increases susceptibility to Human Error (MT-9), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "CFG-16", "name": "Zero-Touch Provisioning (ZTP)", "description": "Mechanisms exist to implement Zero-Touch Provisioning (ZTP), or similar technology, to automatically and securely configure devices upon being added to a network.", "justification": "Zero-Touch Provisioning (ZTP) (CFG-16) provides access control enforcement that compensates for the absence of Retention Of Previous Configurations (CFG-09) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CFG-08.2", "name": "Integrity Assurance & Enforcement (IAE)", "description": "Automated mechanisms exist to:\n(1) Identify unauthorized deviations from an approved secure baseline configuration; and\n(2) Implement automated resiliency actions to remediate the unauthorized change.", "justification": "Integrity Assurance & Enforcement (IAE) (CFG-08.2) provides configuration hardening that compensates for the absence of Retention Of Previous Configurations (CFG-09) by eliminating unnecessary services and enforcing secure settings to reduce inherent exposure. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "CFG-10", "risk_if_not_implemented": "Without Network Device Configuration File Synchronization, Technology Assets, Applications and/or Services (TAAS) may operate with insecure, unauthorized or drifted configurations that expand the attack surface. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Modification / Loss of System Integrity (R-AM-2), and most likely increases susceptibility to Human Error (MT-9), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "MON-02", "name": "Continuous Monitoring", "description": "Mechanisms exist to facilitate the implementation of enterprise-wide monitoring controls.", "justification": "Continuous Monitoring (MON-02) provides detective monitoring capability that compensates for the absence of Network Device Configuration File Synchronization (CFG-10) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CFG-08.2", "name": "Integrity Assurance & Enforcement (IAE)", "description": "Automated mechanisms exist to:\n(1) Identify unauthorized deviations from an approved secure baseline configuration; and\n(2) Implement automated resiliency actions to remediate the unauthorized change.", "justification": "Integrity Assurance & Enforcement (IAE) (CFG-08.2) provides configuration hardening that compensates for the absence of Network Device Configuration File Synchronization (CFG-10) by eliminating unnecessary services and enforcing secure settings to reduce inherent exposure. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "CFG-11", "risk_if_not_implemented": "Without Software Usage Restrictions, Technology Assets, Applications and/or Services (TAAS) may operate with insecure, unauthorized or drifted configurations that expand the attack surface. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Contractual Default / Termination (R-EX-2), Regulatory / Legal / Contractual Financial Liability (R-EX-5), Harm from Unauthorized / Unintended Product or Service Use (R-SC-5), and most likely increases susceptibility to Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11).", "compensating_control_1": { "control_id": "CFG-03", "name": "Least Functionality", "description": "Mechanisms exist to configure Technology Assets, Applications and/or Services (TAAS) to provide only essential capabilities by specifically prohibiting or restricting the use of ports, protocols, and/or services.", "justification": "Least Functionality (CFG-03) provides configuration hardening that compensates for the absence of Software Usage Restrictions (CFG-11) by eliminating unnecessary services and enforcing secure settings to reduce inherent exposure. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CFG-08.2", "name": "Integrity Assurance & Enforcement (IAE)", "description": "Automated mechanisms exist to:\n(1) Identify unauthorized deviations from an approved secure baseline configuration; and\n(2) Implement automated resiliency actions to remediate the unauthorized change.", "justification": "Integrity Assurance & Enforcement (IAE) (CFG-08.2) provides configuration hardening that compensates for the absence of Software Usage Restrictions (CFG-11) by eliminating unnecessary services and enforcing secure settings to reduce inherent exposure. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "CFG-12", "risk_if_not_implemented": "Without Restrict Roles Permitted To Install Software, Technology Assets, Applications and/or Services (TAAS) may operate with insecure, unauthorized or drifted configurations that expand the attack surface. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Excessive or Unauthorized Privilege (R-AC-2), Unauthorized Modification / Loss of System Integrity (R-AM-2), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "CFG-11", "name": "Software Usage Restrictions", "description": "Mechanisms exist to enforce software usage restrictions to comply with applicable contract agreements and copyright laws.", "justification": "Software Usage Restrictions (CFG-11) provides overlapping security capability that compensates for the absence of Restrict Roles Permitted To Install Software (CFG-05.2) by addressing related risk objectives through an alternative control mechanism aligned with Technology applicability. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CFG-12", "name": "Restrict Roles Permitted To Install Software", "description": "Automated mechanisms exist to prevent the installation of software, unless the action is performed by a privileged user or service.", "justification": "Restrict Roles Permitted To Install Software (CFG-12) provides overlapping security capability that compensates for the absence of Restrict Roles Permitted To Install Software (CFG-05.2) by addressing related risk objectives through an alternative control mechanism aligned with Technology applicability. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "CFG-12.1", "risk_if_not_implemented": "Without Configuration Management Role Assignment, Technology Assets, Applications and/or Services (TAAS) may operate with insecure, unauthorized or drifted configurations that expand the attack surface. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Excessive or Unauthorized Privilege (R-AC-2), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Fraud, Corruption and/or Intentional Criminal Conduct (MT-14), Conflict of Interest (COI) / Undue Influence / Insider Misconduct (MT-15).", "compensating_control_1": { "control_id": "CFG-04", "name": "Secure Baseline Configurations", "description": "Mechanisms exist to develop, document and maintain secure baseline configurations for Technology Assets, Applications and/or Services (TAAS) that are consistent with industry-accepted hardening standards.", "justification": "Secure Baseline Configurations (CFG-04) provides configuration hardening that compensates for the absence of Assignment of Responsibility (CFG-12.1) by eliminating unnecessary services and enforcing secure settings to reduce inherent exposure. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CHG-03", "name": "Configuration Change Control", "description": "Mechanisms exist to govern the technical configuration change control processes.", "justification": "Configuration Change Control (CHG-03) provides configuration hardening that compensates for the absence of Assignment of Responsibility (CFG-12.1) by eliminating unnecessary services and enforcing secure settings to reduce inherent exposure. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "CFG-13", "risk_if_not_implemented": "Without Open Source Software, Technology Assets, Applications and/or Services (TAAS) may operate with insecure, unauthorized or drifted configurations that expand the attack surface. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Exposure from Unaddressed Vulnerabilities (R-EX-6), and most likely increases susceptibility to Human Error (MT-9), Counterfeit / Non-Conforming Products (MT-20).", "compensating_control_1": { "control_id": "IAC-30", "name": "Least Privilege", "description": "Mechanisms exist to utilize the concept of least privilege, allowing only authorized access to processes necessary to accomplish assigned tasks in accordance with organizational business functions.", "justification": "Least Privilege (IAC-30) provides access control enforcement that compensates for the absence of Open Source Software (CFG-13) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CFG-03", "name": "Least Functionality", "description": "Mechanisms exist to configure Technology Assets, Applications and/or Services (TAAS) to provide only essential capabilities by specifically prohibiting or restricting the use of ports, protocols, and/or services.", "justification": "Least Functionality (CFG-03) provides configuration hardening that compensates for the absence of Open Source Software (CFG-13) by eliminating unnecessary services and enforcing secure settings to reduce inherent exposure. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "CFG-14", "risk_if_not_implemented": "Without Prevent Unauthorized Software Execution, Technology Assets, Applications and/or Services (TAAS) may operate with insecure, unauthorized or drifted configurations that expand the attack surface. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Access (R-AC-4), System / Data Compromise (Technical Vector) (R-BC-4), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "NET-03", "name": "Boundary Protection", "description": "Mechanisms exist to monitor and control communications at the external network boundary and at key internal boundaries within the network.", "justification": "Boundary Protection (NET-03) provides network-level access restriction that compensates for the absence of Prevent Unauthorized Software Execution (CFG-03.2) by limiting attacker reach and lateral movement opportunities across the environment. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CFG-03", "name": "Least Functionality", "description": "Mechanisms exist to configure Technology Assets, Applications and/or Services (TAAS) to provide only essential capabilities by specifically prohibiting or restricting the use of ports, protocols, and/or services.", "justification": "Least Functionality (CFG-03) provides configuration hardening that compensates for the absence of Prevent Unauthorized Software Execution (CFG-03.2) by eliminating unnecessary services and enforcing secure settings to reduce inherent exposure. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "CFG-14.1", "risk_if_not_implemented": "Without Explicitly Allow / Deny Applications, Technology Assets, Applications and/or Services (TAAS) may operate with insecure, unauthorized or drifted configurations that expand the attack surface. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Access (R-AC-4), System / Data Compromise (Technical Vector) (R-BC-4), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "CFG-12", "name": "Restrict Roles Permitted To Install Software", "description": "Automated mechanisms exist to prevent the installation of software, unless the action is performed by a privileged user or service.", "justification": "Restrict Roles Permitted To Install Software (CFG-12) provides access control enforcement that compensates for the absence of Explicitly Allow / Deny Applications (CFG-14.1) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CFG-03", "name": "Least Functionality", "description": "Mechanisms exist to configure Technology Assets, Applications and/or Services (TAAS) to provide only essential capabilities by specifically prohibiting or restricting the use of ports, protocols, and/or services.", "justification": "Least Functionality (CFG-03) provides configuration hardening that compensates for the absence of Explicitly Allow / Deny Applications (CFG-14.1) by eliminating unnecessary services and enforcing secure settings to reduce inherent exposure. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "CFG-15", "risk_if_not_implemented": "Without Unsupported Internet Browsers & Email Clients, Technology Assets, Applications and/or Services (TAAS) may be unknown, untracked, lost, stolen or left unprotected because they are not inventoried. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Exposure from Unaddressed Vulnerabilities (R-EX-6), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "CFG-03", "name": "Least Functionality", "description": "Mechanisms exist to configure Technology Assets, Applications and/or Services (TAAS) to provide only essential capabilities by specifically prohibiting or restricting the use of ports, protocols, and/or services.", "justification": "Least Functionality (CFG-03) provides configuration hardening that compensates for the absence of Unsupported Internet Browsers & Email Clients (CFG-15) by eliminating unnecessary services and enforcing secure settings to reduce inherent exposure. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "IAC-30", "name": "Least Privilege", "description": "Mechanisms exist to utilize the concept of least privilege, allowing only authorized access to processes necessary to accomplish assigned tasks in accordance with organizational business functions.", "justification": "Least Privilege (IAC-30) provides access control enforcement that compensates for the absence of Unsupported Internet Browsers & Email Clients (CFG-15) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "CFG-16", "risk_if_not_implemented": "Without Zero-Touch Provisioning (ZTP), unauthorized individuals, devices or services may gain access to Technology Assets, Applications, Services, Data and/or Facilities (TAASDF). Based on the risk and threat mapping for this control, no risk is rated Likely; risks rated Possible include Unauthorized Access (R-AC-4), Unauthorized Modification / Loss of System Integrity (R-AM-2), System / Data Compromise (Technical Vector) (R-BC-4), and most likely increases susceptibility to Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "CFG-04", "name": "Secure Baseline Configurations", "description": "Mechanisms exist to develop, document and maintain secure baseline configurations for Technology Assets, Applications and/or Services (TAAS) that are consistent with industry-accepted hardening standards.", "justification": "Secure Baseline Configurations (CFG-04) provides configuration hardening that compensates for the absence of Zero-Touch Provisioning (ZTP) (CFG-16) by eliminating unnecessary services and enforcing secure settings to reduce inherent exposure. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CHG-03", "name": "Configuration Change Control", "description": "Mechanisms exist to govern the technical configuration change control processes.", "justification": "Configuration Change Control (CHG-03) provides configuration hardening that compensates for the absence of Zero-Touch Provisioning (ZTP) (CFG-16) by eliminating unnecessary services and enforcing secure settings to reduce inherent exposure. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "CFG-17", "risk_if_not_implemented": "Without Production Software Repository, applications may be built and deployed with exploitable design and coding weaknesses that adversaries can leverage. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Modification / Loss of System Integrity (R-AM-2), Loss of Authenticity / Provenance (R-IP-5), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "CHG-03", "name": "Configuration Change Control", "description": "Mechanisms exist to govern the technical configuration change control processes.", "justification": "Configuration Change Control (CHG-03) provides configuration and supply-chain hardening that compensates for the absence of Production Software Repository (CFG-17) by enforcing secure settings and trusted software sources to reduce inherent exposure. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "VPM-08", "name": "Software & Firmware Patching", "description": "Mechanisms exist to conduct software patching for all deployed Technology Assets, Applications and/or Services (TAAS), including firmware.", "justification": "Software & Firmware Patching (VPM-08) provides vulnerability management that compensates for the absence of Production Software Repository (CFG-17) by reducing the exploitable attack surface by addressing known weaknesses and prioritizing critical remediations. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "CFG-17.1", "risk_if_not_implemented": "Without Third-Party Libraries, supplier and External Service Provider (ESP) weaknesses, incidents or failures may propagate into the organization's environment unmanaged. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Third-Party Cybersecurity Compromise / Exposure (R-SC-1), Counterfeit / Non-Conforming Component Impact (R-SC-7), Loss of Authenticity / Provenance (R-IP-5), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9), Counterfeit / Non-Conforming Products (MT-20).", "compensating_control_1": { "control_id": "TPM-04", "name": "Supply Chain Risk Management (SCRM)", "description": "Mechanisms exist to:\n(1) Evaluate security risks and threats associated with Technology Assets, Applications and/or Services (TAAS) supply chains; and\n(2) Take appropriate remediation actions to minimize the organization's exposure to those risks and threats, as necessary.", "justification": "Supply Chain Risk Management (SCRM) (TPM-04) provides risk identification and prioritization that compensates for the absence of Third-Party Libraries (CFG-17.1) by enabling informed decisions about where to focus resources to manage residual exposure. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "VPM-12", "name": "Vulnerability Scanning", "description": "Mechanisms exist to detect vulnerabilities and configuration errors by routine vulnerability scanning of systems and applications.", "justification": "Vulnerability Scanning (VPM-12) provides vulnerability management that compensates for the absence of Third-Party Libraries (CFG-17.1) by reducing the exploitable attack surface by addressing known weaknesses and prioritizing critical remediations. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "CFG-17.2", "risk_if_not_implemented": "Without Software Repository Protections, applications may be built and deployed with exploitable design and coding weaknesses that adversaries can leverage. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Modification / Loss of System Integrity (R-AM-2), Loss of Confidentiality (R-IP-2), Loss of Authenticity / Provenance (R-IP-5), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9), Technical / Mechanical Failure (MT-10), Counterfeit / Non-Conforming Products (MT-20).", "compensating_control_1": { "control_id": "CFG-04", "name": "Secure Baseline Configurations", "description": "Mechanisms exist to develop, document and maintain secure baseline configurations for Technology Assets, Applications and/or Services (TAAS) that are consistent with industry-accepted hardening standards.", "justification": "Secure Baseline Configurations (CFG-04) provides configuration and supply-chain hardening that compensates for the absence of Software Repository Protections (CFG-17.2) by enforcing secure settings and trusted software sources to reduce inherent exposure. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "END-04", "name": "Malicious Code Protection (Antimalware)", "description": "Mechanisms exist to utilize antimalware, or similar technologies, to detect and eradicate malicious code.", "justification": "Malicious Code Protection (Antimalware) (END-04) provides overlapping security capability that compensates for the absence of Software Repository Protections (CFG-17.2) by addressing related risk objectives through an alternative control mechanism. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "CFG-17.3", "risk_if_not_implemented": "Without Software Development Repository, applications may be built and deployed with exploitable design and coding weaknesses that adversaries can leverage. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Modification / Loss of System Integrity (R-AM-2), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "TDA-15.1", "name": "Separation of Development, Testing and Operational Environments", "description": "Mechanisms exist to manage separate development, testing and operational environments to reduce the risks of unauthorized access or changes to the operational environment and to ensure no impact to production Technology Assets, Applications and/or Services (TAAS).", "justification": "Separation of Development, Testing and Operational Environments (TDA-15.1) provides periodic assessment and verification that compensates for the absence of Software Development Repository (CFG-17.3) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CHG-04", "name": "Prohibition Of Changes", "description": "Mechanisms exist to prohibit unauthorized changes, unless approved through the organization's defined change management processes.", "justification": "Prohibition Of Changes (CHG-04) provides access control enforcement that compensates for the absence of Software Development Repository (CFG-17.3) by restricting system and data access through alternative identity and access management mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "CFG-18", "risk_if_not_implemented": "Without Embedded Sensor Capability, embedded and IoT technologies may operate with unknown, insecure or unmonitored configurations, creating exploitable footholds. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Access (R-AC-4), Loss of Confidentiality (R-IP-2), Privacy Harm / Unauthorized Processing (R-IP-6), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "PES-02", "name": "Physical & Environmental Protections", "description": "Mechanisms exist to facilitate the operation of physical and environmental protection controls.", "justification": "Physical & Environmental Protections (PES-02) provides physical access control that compensates for the absence of Sensor Capability (CFG-18) by preventing unauthorized physical interaction with systems and infrastructure. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CFG-03", "name": "Least Functionality", "description": "Mechanisms exist to configure Technology Assets, Applications and/or Services (TAAS) to provide only essential capabilities by specifically prohibiting or restricting the use of ports, protocols, and/or services.", "justification": "Least Functionality (CFG-03) provides configuration hardening that compensates for the absence of Sensor Capability (CFG-18) by eliminating unnecessary services and enforcing secure settings to reduce inherent exposure. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "CFG-18.1", "risk_if_not_implemented": "Without Embedded Sensor Data Use Restrictions, embedded and IoT technologies may operate with unknown, insecure or unmonitored configurations, creating exploitable footholds. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Privacy Harm / Unauthorized Processing (R-IP-6), and most likely increases susceptibility to Human Error (MT-9).", "compensating_control_1": { "control_id": "CFG-03", "name": "Least Functionality", "description": "Mechanisms exist to configure Technology Assets, Applications and/or Services (TAAS) to provide only essential capabilities by specifically prohibiting or restricting the use of ports, protocols, and/or services.", "justification": "Least Functionality (CFG-03) provides configuration hardening that compensates for the absence of Authorized Use (CFG-18.1) by eliminating unnecessary services and enforcing secure settings to reduce inherent exposure. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "PES-02", "name": "Physical & Environmental Protections", "description": "Mechanisms exist to facilitate the operation of physical and environmental protection controls.", "justification": "Physical & Environmental Protections (PES-02) provides physical access control that compensates for the absence of Authorized Use (CFG-18.1) by preventing unauthorized physical interaction with systems and infrastructure. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "CFG-18.2", "risk_if_not_implemented": "Without Notice of Embedded Sensor Data Collection, embedded and IoT technologies may operate with unknown, insecure or unmonitored configurations, creating exploitable footholds. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Privacy Harm / Unauthorized Processing (R-IP-6), and most likely increases susceptibility to Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11).", "compensating_control_1": { "control_id": "PES-02", "name": "Physical & Environmental Protections", "description": "Mechanisms exist to facilitate the operation of physical and environmental protection controls.", "justification": "Physical & Environmental Protections (PES-02) provides physical access control that compensates for the absence of Notice of Collection (CFG-18.2) by preventing unauthorized physical interaction with systems and infrastructure. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CFG-18", "name": "Embedded Sensor Capability", "description": "Mechanisms exist to configure embedded sensors on systems to: \n(1) Prohibit the remote activation of sensing capabilities; and\n(2) Provide an explicit indication of sensor use to users.", "justification": "Embedded Sensor Capability (CFG-18) provides overlapping security capability that compensates for the absence of Notice of Collection (CFG-18.2) by addressing related risk objectives through an alternative control mechanism aligned with Technology applicability. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "CFG-18.3", "risk_if_not_implemented": "Without Embedded Sensor Data Collection Minimization, embedded and IoT technologies may operate with unknown, insecure or unmonitored configurations, creating exploitable footholds. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Privacy Harm / Unauthorized Processing (R-IP-6), and most likely increases susceptibility to Human Error (MT-9).", "compensating_control_1": { "control_id": "CFG-03", "name": "Least Functionality", "description": "Mechanisms exist to configure Technology Assets, Applications and/or Services (TAAS) to provide only essential capabilities by specifically prohibiting or restricting the use of ports, protocols, and/or services.", "justification": "Least Functionality (CFG-03) provides configuration hardening that compensates for the absence of Collection Minimization (CFG-18.3) by eliminating unnecessary services and enforcing secure settings to reduce inherent exposure. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CFG-18", "name": "Embedded Sensor Capability", "description": "Mechanisms exist to configure embedded sensors on systems to: \n(1) Prohibit the remote activation of sensing capabilities; and\n(2) Provide an explicit indication of sensor use to users.", "justification": "Embedded Sensor Capability (CFG-18) provides overlapping security capability that compensates for the absence of Collection Minimization (CFG-18.3) by addressing related risk objectives through an alternative control mechanism aligned with Technology applicability. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "CFG-18.4", "risk_if_not_implemented": "Without Embedded Sensor Configuration Verification, embedded and IoT technologies may operate with unknown, insecure or unmonitored configurations, creating exploitable footholds. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Access (R-AC-4), Loss of Confidentiality (R-IP-2), Privacy Harm / Unauthorized Processing (R-IP-6), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9).", "compensating_control_1": { "control_id": "PES-02", "name": "Physical & Environmental Protections", "description": "Mechanisms exist to facilitate the operation of physical and environmental protection controls.", "justification": "Physical & Environmental Protections (PES-02) provides physical access control that compensates for the absence of Sensor Delivery Verification (CFG-18.4) by preventing unauthorized physical interaction with systems and infrastructure. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CFG-03", "name": "Least Functionality", "description": "Mechanisms exist to configure Technology Assets, Applications and/or Services (TAAS) to provide only essential capabilities by specifically prohibiting or restricting the use of ports, protocols, and/or services.", "justification": "Least Functionality (CFG-03) provides configuration hardening that compensates for the absence of Sensor Delivery Verification (CFG-18.4) by eliminating unnecessary services and enforcing secure settings to reduce inherent exposure. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "CFG-19", "risk_if_not_implemented": "Without Refresh from Trusted Sources, Technology Assets, Applications and/or Services (TAAS) may operate with insecure, unauthorized or drifted configurations that expand the attack surface. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Counterfeit / Non-Conforming Component Impact (R-SC-7), Loss of Authenticity / Provenance (R-IP-5), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9), Counterfeit / Non-Conforming Products (MT-20).", "compensating_control_1": { "control_id": "BCD-24", "name": "Data Backups", "description": "Mechanisms exist to create recurring backups of data, software and/or system images, as well as verify the integrity of these backups, to ensure the availability of the data to satisfy Recovery Time Objectives (RTOs) and Recovery Point Objectives (RPOs).", "justification": "Data Backups (BCD-24) provides resilience and recovery capability that compensates for the absence of Refresh from Trusted Sources (CFG-19) by ensuring the organization can restore operations and data when the primary control is absent. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CFG-03", "name": "Least Functionality", "description": "Mechanisms exist to configure Technology Assets, Applications and/or Services (TAAS) to provide only essential capabilities by specifically prohibiting or restricting the use of ports, protocols, and/or services.", "justification": "Least Functionality (CFG-03) provides configuration hardening that compensates for the absence of Refresh from Trusted Sources (CFG-19) by eliminating unnecessary services and enforcing secure settings to reduce inherent exposure. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "CFG-20", "risk_if_not_implemented": "Without Hypervisor Access, Technology Assets, Applications and/or Services (TAAS) may operate with insecure, unauthorized or drifted configurations that expand the attack surface. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Access (R-AC-4), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9).", "compensating_control_1": { "control_id": "IAC-30", "name": "Least Privilege", "description": "Mechanisms exist to utilize the concept of least privilege, allowing only authorized access to processes necessary to accomplish assigned tasks in accordance with organizational business functions.", "justification": "Least Privilege (IAC-30) provides access control enforcement that compensates for the absence of Hypervisor Access (CFG-20) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CFG-04", "name": "Secure Baseline Configurations", "description": "Mechanisms exist to develop, document and maintain secure baseline configurations for Technology Assets, Applications and/or Services (TAAS) that are consistent with industry-accepted hardening standards.", "justification": "Secure Baseline Configurations (CFG-04) provides configuration hardening that compensates for the absence of Hypervisor Access (CFG-20) by eliminating unnecessary services and enforcing secure settings to reduce inherent exposure. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "CFG-21", "risk_if_not_implemented": "Without Restrict Access To Security Functions, Technology Assets, Applications and/or Services (TAAS) may operate with insecure, unauthorized or drifted configurations that expand the attack surface. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Excessive or Unauthorized Privilege (R-AC-2), Unauthorized Access (R-AC-4), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9).", "compensating_control_1": { "control_id": "IAC-30", "name": "Least Privilege", "description": "Mechanisms exist to utilize the concept of least privilege, allowing only authorized access to processes necessary to accomplish assigned tasks in accordance with organizational business functions.", "justification": "Least Privilege (IAC-30) provides access control enforcement that compensates for the absence of Restrict Access To Security Functions (CFG-21) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CFG-03", "name": "Least Functionality", "description": "Mechanisms exist to configure Technology Assets, Applications and/or Services (TAAS) to provide only essential capabilities by specifically prohibiting or restricting the use of ports, protocols, and/or services.", "justification": "Least Functionality (CFG-03) provides configuration hardening that compensates for the absence of Restrict Access To Security Functions (CFG-21) by eliminating unnecessary services and enforcing secure settings to reduce inherent exposure. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "CFG-22", "risk_if_not_implemented": "Without Host-Based Security Function Isolation, security may be bolted on rather than designed in, resulting in structural weaknesses that are costly to remediate and easy to exploit. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Privilege Elevation (R-AC-3), Unauthorized Modification / Loss of System Integrity (R-AM-2), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "CFG-03", "name": "Least Functionality", "description": "Mechanisms exist to configure Technology Assets, Applications and/or Services (TAAS) to provide only essential capabilities by specifically prohibiting or restricting the use of ports, protocols, and/or services.", "justification": "Least Functionality (CFG-03) provides configuration hardening that compensates for the absence of Host-Based Security Function Isolation (CFG-22) by eliminating unnecessary services and enforcing secure settings to reduce inherent exposure. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "IAC-30", "name": "Least Privilege", "description": "Mechanisms exist to utilize the concept of least privilege, allowing only authorized access to processes necessary to accomplish assigned tasks in accordance with organizational business functions.", "justification": "Least Privilege (IAC-30) provides access control enforcement that compensates for the absence of Host-Based Security Function Isolation (CFG-22) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "CFG-23", "risk_if_not_implemented": "Without Control Assurance Automation (CAA) Change Control, automated control assurance results may be manipulated, misattributed or lose integrity, causing misplaced confidence in control effectiveness. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Modification / Loss of System Integrity (R-AM-2), Inability to Demonstrate Due Diligence / Due Care (R-GV-9), Unreliable Assurance / Decision Information (R-GV-10), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "CHG-03", "name": "Configuration Change Control", "description": "Mechanisms exist to govern the technical configuration change control processes.", "justification": "Configuration Change Control (CHG-03) provides configuration hardening and change discipline that compensates for the absence of Control Assurance Automation (CAA) Change Control (CFG-23) by enforcing secure settings and trusted software sources to reduce inherent exposure. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CHG-06", "name": "Security Impact Analysis for Changes", "description": "Mechanisms exist to analyze proposed changes for potential security impacts, prior to the implementation of the change.", "justification": "Security Impact Analysis for Changes (CHG-06) provides risk identification and prioritization that compensates for the absence of Control Assurance Automation (CAA) Change Control (CFG-23) by enabling informed decisions about where to focus resources to manage residual exposure. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "CFG-24", "risk_if_not_implemented": "Without Control Assurance Automation (CAA) Unauthorized Change Detection, automated control assurance results may be manipulated, misattributed or lose integrity, causing misplaced confidence in control effectiveness. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Modification / Loss of System Integrity (R-AM-2), Unreliable Assurance / Decision Information (R-GV-10), Undetected / Delayed Detection of Adverse Activity (R-SA-1), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9), Technical / Mechanical Failure (MT-10), Fraud, Corruption and/or Intentional Criminal Conduct (MT-14).", "compensating_control_1": { "control_id": "MON-27", "name": "File Integrity Monitoring (FIM)", "description": "Mechanisms exist to utilize a File Integrity Monitor (FIM), or similar change-detection technology, on critical Technology Assets, Applications and/or Services (TAAS) to generate alerts for unauthorized modifications.", "justification": "File Integrity Monitoring (FIM) (MON-27) provides detective monitoring capability that compensates for the absence of Control Assurance Automation (CAA) Unauthorized Change Detection (CFG-24) by identifying unauthorized, anomalous or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CHG-11", "name": "Post Configuration Change Reviews", "description": "Mechanisms exist to perform after-the-fact reviews of configuration change logs to discover any unauthorized changes.", "justification": "Post Configuration Change Reviews (CHG-11) provides periodic assessment and verification that compensates for the absence of Control Assurance Automation (CAA) Unauthorized Change Detection (CFG-24) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "CFG-25", "risk_if_not_implemented": "Without Control Assurance Automation (CAA) Separation of Duties, automated control assurance results may be manipulated, misattributed or lose integrity, causing misplaced confidence in control effectiveness. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Excessive or Unauthorized Privilege (R-AC-2), Unauthorized Modification / Loss of System Integrity (R-AM-2), Inability to Demonstrate Due Diligence / Due Care (R-GV-9), Unreliable Assurance / Decision Information (R-GV-10), and most likely increases susceptibility to man-made threats MT-2, MT-8, MT-9, MT-10, MT-14, MT-15, MT-25.", "compensating_control_1": { "control_id": "HRS-14", "name": "Separation of Duties (SoD)", "description": "Mechanisms exist to implement and maintain Separation of Duties (SoD) to prevent potential inappropriate activity without collusion.", "justification": "Separation of Duties (SoD) (HRS-14) provides overlapping security capability that compensates for the absence of Control Assurance Automation (CAA) Separation of Duties (CFG-25) by addressing related risk objectives through an alternative control mechanism. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "IAC-28", "name": "Dual Authorization for Privileged Commands", "description": "Automated mechanisms exist to enforce dual authorization for privileged commands.", "justification": "Dual Authorization for Privileged Commands (IAC-28) provides access control enforcement that compensates for the absence of Control Assurance Automation (CAA) Separation of Duties (CFG-25) by restricting system and data access through alternative identity and access management mechanisms. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "MON-03.1", "risk_if_not_implemented": "Without Centralized Management of Event Log & Security-Relevant Telemetry Content, malicious, anomalous or unauthorized activity may go undetected or be detected too late to prevent or limit harm. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss of Accountability / Attribution (R-AC-1), Loss of Investigative / Evidentiary Capability (R-IR-1), Undetected / Delayed Detection of Adverse Activity (R-SA-1), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "MON-10", "name": "Event Log & Security-Relevant Telemetry Storage Capacity", "description": "Mechanisms exist to allocate and proactively manage sufficient event log and security-relevant telemetry storage capacity to reduce the likelihood of such capacity being exceeded.", "justification": "Event Log & Security-Relevant Telemetry Storage Capacity (MON-10) provides detective monitoring capability that compensates for the absence of Centralized Management of Event Log Content (MON-03.1) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "MON-05", "name": "Centralized Collection of Event Logs & Security-Relevant Telemetry", "description": "Mechanisms exist to utilize a Security Incident Event Manager (SIEM), or similar automated tool, to support the centralized collection of event logs and security-relevant telemetry.", "justification": "Centralized Collection of Event Logs & Security-Relevant Telemetry (MON-05) provides detective monitoring capability that compensates for the absence of Centralized Management of Event Log Content (MON-03.1) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "MON-03.2", "risk_if_not_implemented": "Without Analyze and Prioritize Monitoring Requirements, malicious, anomalous or unauthorized activity may go undetected or be detected too late to prevent or limit harm. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unaddressed Security / Compliance Exposure (R-GV-2), Undetected / Delayed Detection of Adverse Activity (R-SA-1), and most likely increases susceptibility to Human Error (MT-9), Data Quality Degradation / Data Poisoning (MT-12).", "compensating_control_1": { "control_id": "MON-05.2", "name": "Event Log & Security-Relevant Telemetry Analysis & Triage", "description": "Mechanisms exist to ensure event log and security-relevant telemetry reviews include analysis and triage practices that integrate with the organization's established incident response processes.", "justification": "Event Log & Security-Relevant Telemetry Analysis & Triage (MON-05.2) provides detective monitoring capability that compensates for the absence of Analyze and Prioritize Monitoring Requirements (MON-03.2) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "MON-02", "name": "Continuous Monitoring", "description": "Mechanisms exist to facilitate the implementation of enterprise-wide monitoring controls.", "justification": "Continuous Monitoring (MON-02) provides detective monitoring capability that compensates for the absence of Analyze and Prioritize Monitoring Requirements (MON-03.2) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "MON-03.3", "risk_if_not_implemented": "Without Audit Level Adjustments, the organization may fail to meet statutory, regulatory or contractual obligations, or be unable to demonstrate conformity when required. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Undetected / Delayed Detection of Adverse Activity (R-SA-1), and most likely increases susceptibility to Human Error (MT-9), Data Quality Degradation / Data Poisoning (MT-12).", "compensating_control_1": { "control_id": "MON-12", "name": "Protection of Event Logs & Security-Relevant Telemetry", "description": "Mechanisms exist to protect event logs, security-relevant telemetry and audit tools from unauthorized access, modification and deletion.", "justification": "Protection of Event Logs & Security-Relevant Telemetry (MON-12) provides detective monitoring capability that compensates for the absence of Audit Level Adjustments (MON-03.3) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "MON-05", "name": "Centralized Collection of Event Logs & Security-Relevant Telemetry", "description": "Mechanisms exist to utilize a Security Incident Event Manager (SIEM), or similar automated tool, to support the centralized collection of event logs and security-relevant telemetry.", "justification": "Centralized Collection of Event Logs & Security-Relevant Telemetry (MON-05) provides detective monitoring capability that compensates for the absence of Audit Level Adjustments (MON-03.3) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "MON-04", "risk_if_not_implemented": "Without System Generated Event Logs & Security-Relevant Telemetry, malicious, anomalous or unauthorized activity may go undetected or be detected too late to prevent or limit harm. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Lack of oversight of internal controls (R-GV-6), Unreliable Assurance / Decision Information (R-GV-10), Loss of Investigative / Evidentiary Capability (R-IR-1), Delayed Containment / Increased Incident Impact (R-IR-2), Undetected / Delayed Detection of Adverse Activity (R-SA-1), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "MON-06", "name": "Monitoring Reporting", "description": "Mechanisms exist to provide an event log report generation capability to aid in detecting and assessing anomalous activities.", "justification": "Monitoring Reporting (MON-06) provides detective monitoring capability that compensates for the absence of System Generated Alerts (MON-04) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "MON-05.2", "name": "Event Log & Security-Relevant Telemetry Analysis & Triage", "description": "Mechanisms exist to ensure event log and security-relevant telemetry reviews include analysis and triage practices that integrate with the organization's established incident response processes.", "justification": "Event Log & Security-Relevant Telemetry Analysis & Triage (MON-05.2) provides detective monitoring capability that compensates for the absence of System Generated Alerts (MON-04) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "MON-04.1", "risk_if_not_implemented": "Without System-Wide / Time-Correlated Audit Trail, the organization may fail to meet statutory, regulatory or contractual obligations, or be unable to demonstrate conformity when required. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss of Accountability / Attribution (R-AC-1), Loss of Investigative / Evidentiary Capability (R-IR-1), Undetected / Delayed Detection of Adverse Activity (R-SA-1), and most likely increases susceptibility to Space Weather (NT-9); Malicious Cyber Activity (MT-2), Technical / Mechanical Failure (MT-10), Data Quality Degradation / Data Poisoning (MT-12).", "compensating_control_1": { "control_id": "MON-05", "name": "Centralized Collection of Event Logs & Security-Relevant Telemetry", "description": "Mechanisms exist to utilize a Security Incident Event Manager (SIEM), or similar automated tool, to support the centralized collection of event logs and security-relevant telemetry.", "justification": "Centralized Collection of Event Logs & Security-Relevant Telemetry (MON-05) provides detective monitoring capability that compensates for the absence of System-Wide / Time-Correlated Audit Trail (MON-04.1) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "MON-09", "name": "Content of Event Logs", "description": "Mechanisms exist to configure Technology Assets, Applications and/or Services (TAAS) to produce event logs that contain sufficient information to, at a minimum:\n(1) Establish what type of event occurred;\n(2) When (date and time) the event occurred;\n(3) Where the event occurred;\n(4) The source of the event;\n(5) The outcome (success or failure) of the event; and \n(6) The identity of any user/subject associated with the event.", "justification": "Content of Event Logs (MON-09) provides detective monitoring capability that compensates for the absence of System-Wide / Time-Correlated Audit Trail (MON-04.1) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "MON-05.1", "risk_if_not_implemented": "Without Centralized Event Log & Security-Relevant Telemetry Review & Analysis, malicious, anomalous or unauthorized activity may go undetected or be detected too late to prevent or limit harm. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss of Investigative / Evidentiary Capability (R-IR-1), Undetected / Delayed Detection of Adverse Activity (R-SA-1), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9), Technical / Mechanical Failure (MT-10), Data Quality Degradation / Data Poisoning (MT-12).", "compensating_control_1": { "control_id": "MON-09", "name": "Content of Event Logs", "description": "Mechanisms exist to configure Technology Assets, Applications and/or Services (TAAS) to produce event logs that contain sufficient information to, at a minimum:\n(1) Establish what type of event occurred;\n(2) When (date and time) the event occurred;\n(3) Where the event occurred;\n(4) The source of the event;\n(5) The outcome (success or failure) of the event; and \n(6) The identity of any user/subject associated with the event.", "justification": "Content of Event Logs (MON-09) provides detective monitoring capability that compensates for the absence of Central Review & Analysis (MON-05.1) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "MON-05", "name": "Centralized Collection of Event Logs & Security-Relevant Telemetry", "description": "Mechanisms exist to utilize a Security Incident Event Manager (SIEM), or similar automated tool, to support the centralized collection of event logs and security-relevant telemetry.", "justification": "Centralized Collection of Event Logs & Security-Relevant Telemetry (MON-05) provides detective monitoring capability that compensates for the absence of Central Review & Analysis (MON-05.1) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "MON-05.2", "risk_if_not_implemented": "Without Event Log & Security-Relevant Telemetry Analysis & Triage, malicious, anomalous or unauthorized activity may go undetected or be detected too late to prevent or limit harm. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Delayed Containment / Increased Incident Impact (R-IR-2), Undetected / Delayed Detection of Adverse Activity (R-SA-1), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9), Workforce Shortage / Loss of Critical Skills / Labor Disruption (MT-25).", "compensating_control_1": { "control_id": "MON-05", "name": "Centralized Collection of Event Logs & Security-Relevant Telemetry", "description": "Mechanisms exist to utilize a Security Incident Event Manager (SIEM), or similar automated tool, to support the centralized collection of event logs and security-relevant telemetry.", "justification": "Centralized Collection of Event Logs & Security-Relevant Telemetry (MON-05) provides detective monitoring capability that compensates for the absence of Event Log Analysis & Triage (MON-05.2) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "MON-02", "name": "Continuous Monitoring", "description": "Mechanisms exist to facilitate the implementation of enterprise-wide monitoring controls.", "justification": "Continuous Monitoring (MON-02) provides detective monitoring capability that compensates for the absence of Event Log Analysis & Triage (MON-05.2) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "MON-05.3", "risk_if_not_implemented": "Without Event Log & Security-Relevant Telemetry Review Escalation Matrix, malicious, anomalous or unauthorized activity may go undetected or be detected too late to prevent or limit harm. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unperformed / Unowned Control Responsibilities (R-GV-3), Delayed Containment / Increased Incident Impact (R-IR-2), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9).", "compensating_control_1": { "control_id": "MON-02", "name": "Continuous Monitoring", "description": "Mechanisms exist to facilitate the implementation of enterprise-wide monitoring controls.", "justification": "Continuous Monitoring (MON-02) provides detective monitoring capability that compensates for the absence of Event Log Review Escalation Matrix (MON-05.3) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "MON-05", "name": "Centralized Collection of Event Logs & Security-Relevant Telemetry", "description": "Mechanisms exist to utilize a Security Incident Event Manager (SIEM), or similar automated tool, to support the centralized collection of event logs and security-relevant telemetry.", "justification": "Centralized Collection of Event Logs & Security-Relevant Telemetry (MON-05) provides detective monitoring capability that compensates for the absence of Event Log Review Escalation Matrix (MON-05.3) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "MON-05.4", "risk_if_not_implemented": "Without Automated Tools for Real-Time Event Log & Security-Relevant Telemetry Analysis, malicious, anomalous or unauthorized activity may go undetected or be detected too late to prevent or limit harm. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Delayed Containment / Increased Incident Impact (R-IR-2), Undetected / Delayed Detection of Adverse Activity (R-SA-1), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9), Technical / Mechanical Failure (MT-10), Data Quality Degradation / Data Poisoning (MT-12).", "compensating_control_1": { "control_id": "CPL-07.3", "name": "Audit Planning Activities", "description": "Mechanisms exist to thoughtfully plan audits by including input from operational risk and compliance partners to minimize the impact of audit-related activities on business operations.", "justification": "Audit Planning Activities (CPL-07.3) provides detective monitoring capability that compensates for the absence of Automated Tools for Real-Time Analysis (MON-05.4) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "MON-05", "name": "Centralized Collection of Event Logs & Security-Relevant Telemetry", "description": "Mechanisms exist to utilize a Security Incident Event Manager (SIEM), or similar automated tool, to support the centralized collection of event logs and security-relevant telemetry.", "justification": "Centralized Collection of Event Logs & Security-Relevant Telemetry (MON-05) provides detective monitoring capability that compensates for the absence of Automated Tools for Real-Time Analysis (MON-05.4) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "MON-05.5", "risk_if_not_implemented": "Without Automated Incident Responder Alerting, security incidents may not be detected, contained, investigated or communicated in a timely manner, increasing their scope, duration and cost. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Delayed Containment / Increased Incident Impact (R-IR-2), Undetected / Delayed Detection of Adverse Activity (R-SA-1), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "MON-06", "name": "Monitoring Reporting", "description": "Mechanisms exist to provide an event log report generation capability to aid in detecting and assessing anomalous activities.", "justification": "Monitoring Reporting (MON-06) provides detective monitoring capability that compensates for the absence of Automated Alerts (MON-05.5) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CPL-05", "name": "Conformity Monitoring", "description": "Mechanisms exist to validate that Technology Assets, Applications, Services and/or Data (TAASD) conform to the organization's security, compliance and/or resilience policies, standards and other applicable requirements.", "justification": "Conformity Monitoring (CPL-05) provides periodic assessment and assurance that compensates for the absence of Automated Alerts (MON-05.5) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "MON-06", "risk_if_not_implemented": "Without Monitoring Reporting, malicious, anomalous or unauthorized activity may go undetected or be detected too late to prevent or limit harm. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unreliable Assurance / Decision Information (R-GV-10), Undetected / Delayed Detection of Adverse Activity (R-SA-1), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "CPL-07", "name": "Executive Leadership Oversight of Security, Compliance & Resilience Controls", "description": "Mechanisms exist to provide a security, compliance and resilience controls oversight function that reports to the organization's executive leadership.", "justification": "Executive Leadership Oversight of Security, Compliance & Resilience Controls (CPL-07) provides resilience and recovery capability that compensates for the absence of Monitoring Reporting (MON-06) by ensuring the organization can restore operations and data when the primary control is absent. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "MON-02", "name": "Continuous Monitoring", "description": "Mechanisms exist to facilitate the implementation of enterprise-wide monitoring controls.", "justification": "Continuous Monitoring (MON-02) provides detective monitoring capability that compensates for the absence of Monitoring Reporting (MON-06) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "MON-06.1", "risk_if_not_implemented": "Without Trend Analysis Reporting, malicious, anomalous or unauthorized activity may go undetected or be detected too late to prevent or limit harm. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Lack of oversight of internal controls (R-GV-6), Unreliable Assurance / Decision Information (R-GV-10), and most likely increases susceptibility to Human Error (MT-9), Data Quality Degradation / Data Poisoning (MT-12).", "compensating_control_1": { "control_id": "CPL-07", "name": "Executive Leadership Oversight of Security, Compliance & Resilience Controls", "description": "Mechanisms exist to provide a security, compliance and resilience controls oversight function that reports to the organization's executive leadership.", "justification": "Executive Leadership Oversight of Security, Compliance & Resilience Controls (CPL-07) provides resilience and recovery capability that compensates for the absence of Trend Analysis Reporting (MON-06.1) by ensuring the organization can restore operations and data when the primary control is absent. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "MON-06", "name": "Monitoring Reporting", "description": "Mechanisms exist to provide an event log report generation capability to aid in detecting and assessing anomalous activities.", "justification": "Monitoring Reporting (MON-06) provides detective monitoring capability that compensates for the absence of Trend Analysis Reporting (MON-06.1) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "MON-07", "risk_if_not_implemented": "Without Alert Threshold Tuning, malicious, anomalous or unauthorized activity may go undetected or be detected too late to prevent or limit harm. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Undetected / Delayed Detection of Adverse Activity (R-SA-1), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9), Technical / Mechanical Failure (MT-10), Data Quality Degradation / Data Poisoning (MT-12).", "compensating_control_1": { "control_id": "CPL-07.3", "name": "Audit Planning Activities", "description": "Mechanisms exist to thoughtfully plan audits by including input from operational risk and compliance partners to minimize the impact of audit-related activities on business operations.", "justification": "Audit Planning Activities (CPL-07.3) provides detective monitoring capability that compensates for the absence of Alert Threshold Tuning (MON-07) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "MON-05.2", "name": "Event Log & Security-Relevant Telemetry Analysis & Triage", "description": "Mechanisms exist to ensure event log and security-relevant telemetry reviews include analysis and triage practices that integrate with the organization's established incident response processes.", "justification": "Event Log & Security-Relevant Telemetry Analysis & Triage (MON-05.2) provides detective monitoring capability that compensates for the absence of Alert Threshold Tuning (MON-07) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "MON-08", "risk_if_not_implemented": "Without Correlate Monitoring Information, malicious, anomalous or unauthorized activity may go undetected or be detected too late to prevent or limit harm. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Undetected / Delayed Detection of Adverse Activity (R-SA-1), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9), Technical / Mechanical Failure (MT-10), Data Quality Degradation / Data Poisoning (MT-12).", "compensating_control_1": { "control_id": "MON-12", "name": "Protection of Event Logs & Security-Relevant Telemetry", "description": "Mechanisms exist to protect event logs, security-relevant telemetry and audit tools from unauthorized access, modification and deletion.", "justification": "Protection of Event Logs & Security-Relevant Telemetry (MON-12) provides detective monitoring capability that compensates for the absence of Correlate Monitoring Information (MON-08) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "MON-05", "name": "Centralized Collection of Event Logs & Security-Relevant Telemetry", "description": "Mechanisms exist to utilize a Security Incident Event Manager (SIEM), or similar automated tool, to support the centralized collection of event logs and security-relevant telemetry.", "justification": "Centralized Collection of Event Logs & Security-Relevant Telemetry (MON-05) provides detective monitoring capability that compensates for the absence of Correlate Monitoring Information (MON-08) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "MON-08.1", "risk_if_not_implemented": "Without Integration of Scanning & Other Monitoring Information, malicious, anomalous or unauthorized activity may go undetected or be detected too late to prevent or limit harm. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Undetected / Delayed Detection of Adverse Activity (R-SA-1), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9), Technical / Mechanical Failure (MT-10), Data Quality Degradation / Data Poisoning (MT-12).", "compensating_control_1": { "control_id": "MON-12", "name": "Protection of Event Logs & Security-Relevant Telemetry", "description": "Mechanisms exist to protect event logs, security-relevant telemetry and audit tools from unauthorized access, modification and deletion.", "justification": "Protection of Event Logs & Security-Relevant Telemetry (MON-12) provides detective monitoring capability that compensates for the absence of Integration of Scanning & Other Monitoring Information (MON-08.1) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "MON-09", "name": "Content of Event Logs", "description": "Mechanisms exist to configure Technology Assets, Applications and/or Services (TAAS) to produce event logs that contain sufficient information to, at a minimum:\n(1) Establish what type of event occurred;\n(2) When (date and time) the event occurred;\n(3) Where the event occurred;\n(4) The source of the event;\n(5) The outcome (success or failure) of the event; and \n(6) The identity of any user/subject associated with the event.", "justification": "Content of Event Logs (MON-09) provides detective monitoring capability that compensates for the absence of Integration of Scanning & Other Monitoring Information (MON-08.1) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "MON-08.2", "risk_if_not_implemented": "Without Correlation with Physical Monitoring, malicious, anomalous or unauthorized activity may go undetected or be detected too late to prevent or limit harm. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Undetected / Delayed Detection of Adverse Activity (R-SA-1), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9), Technical / Mechanical Failure (MT-10), Data Quality Degradation / Data Poisoning (MT-12).", "compensating_control_1": { "control_id": "MON-05", "name": "Centralized Collection of Event Logs & Security-Relevant Telemetry", "description": "Mechanisms exist to utilize a Security Incident Event Manager (SIEM), or similar automated tool, to support the centralized collection of event logs and security-relevant telemetry.", "justification": "Centralized Collection of Event Logs & Security-Relevant Telemetry (MON-05) provides detective monitoring capability that compensates for the absence of Correlation with Physical Monitoring (MON-08.2) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "MON-12", "name": "Protection of Event Logs & Security-Relevant Telemetry", "description": "Mechanisms exist to protect event logs, security-relevant telemetry and audit tools from unauthorized access, modification and deletion.", "justification": "Protection of Event Logs & Security-Relevant Telemetry (MON-12) provides detective monitoring capability that compensates for the absence of Correlation with Physical Monitoring (MON-08.2) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "MON-10", "risk_if_not_implemented": "Without Event Log & Security-Relevant Telemetry Storage Capacity, Technology Assets, Applications and/or Services (TAAS) may become unavailable, degraded or unable to meet demand when required. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss of Investigative / Evidentiary Capability (R-IR-1), Undetected / Delayed Detection of Adverse Activity (R-SA-1), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "MON-35", "name": "Alternate Event Logging Capability", "description": "Mechanisms exist to provide an alternate event logging capability in the event of a failure in primary audit capability.", "justification": "Alternate Event Logging Capability (MON-35) provides detective monitoring capability that compensates for the absence of Event Log Storage Capacity (MON-10) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "MON-05", "name": "Centralized Collection of Event Logs & Security-Relevant Telemetry", "description": "Mechanisms exist to utilize a Security Incident Event Manager (SIEM), or similar automated tool, to support the centralized collection of event logs and security-relevant telemetry.", "justification": "Centralized Collection of Event Logs & Security-Relevant Telemetry (MON-05) provides detective monitoring capability that compensates for the absence of Event Log Storage Capacity (MON-10) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "MON-10.1", "risk_if_not_implemented": "Without Event Log & Security-Relevant Telemetry Storage Capacity Alerting, Technology Assets, Applications and/or Services (TAAS) may become unavailable, degraded or unable to meet demand when required. Based on the risk and threat mapping for this control, no risk is rated Likely; risks rated Possible include Loss of Accountability / Attribution (R-AC-1), Unauthorized Privilege Elevation (R-AC-3), Unauthorized Access (R-AC-4), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "MON-35", "name": "Alternate Event Logging Capability", "description": "Mechanisms exist to provide an alternate event logging capability in the event of a failure in primary audit capability.", "justification": "Alternate Event Logging Capability (MON-35) provides detective monitoring capability that compensates for the absence of Event Log Storage Capacity Alerting (MON-10.1) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "MON-33", "name": "Response To Event Log Processing Failures", "description": "Mechanisms exist to alert appropriate personnel in the event of a log processing failure and take actions to remedy the disruption.", "justification": "Response To Event Log Processing Failures (MON-33) provides detective monitoring capability that compensates for the absence of Event Log Storage Capacity Alerting (MON-10.1) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "MON-11.1", "risk_if_not_implemented": "Without Synchronization With Authoritative Time Source, malicious, anomalous or unauthorized activity may go undetected or be detected too late to prevent or limit harm. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss of Investigative / Evidentiary Capability (R-IR-1), Undetected / Delayed Detection of Adverse Activity (R-SA-1), and most likely increases susceptibility to Space Weather (NT-9); Malicious Cyber Activity (MT-2), Human Error (MT-9), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "MON-05", "name": "Centralized Collection of Event Logs & Security-Relevant Telemetry", "description": "Mechanisms exist to utilize a Security Incident Event Manager (SIEM), or similar automated tool, to support the centralized collection of event logs and security-relevant telemetry.", "justification": "Centralized Collection of Event Logs & Security-Relevant Telemetry (MON-05) provides detective monitoring capability that compensates for the absence of Synchronization With Authoritative Time Source (MON-11.1) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "SEA-30", "name": "Clock Synchronization", "description": "Mechanisms exist to utilize time-synchronization technology to synchronize all critical system clocks.", "justification": "Clock Synchronization (SEA-30) provides overlapping security capability that compensates for the absence of Synchronization With Authoritative Time Source (MON-11.1) by addressing related risk objectives through an alternative control mechanism aligned with Technology applicability. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "MON-12.1", "risk_if_not_implemented": "Without Event Log & Security-Relevant Telemetry Backup on Separate Physical Systems / Components, data, software and system images cannot be reliably restored within required recovery objectives following a disruption. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Data Loss / Integrity Compromise (R-BC-2), Loss of Investigative / Evidentiary Capability (R-IR-1), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "CRY-14", "name": "Cryptographic Hash", "description": "Mechanisms exist to utilize hash algorithms to generate a hash value that can be used to validate the integrity of data and/or software.", "justification": "Cryptographic Hash (CRY-14) provides cryptographic protection that compensates for the absence of Event Log Backup on Separate Physical Systems / Components (MON-12.1) by ensuring data confidentiality and integrity through alternative technical means. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "MON-13", "name": "Event Log & Security-Relevant Telemetry Retention", "description": "Mechanisms exist to retain event logs and security-relevant telemetry for a time period consistent with records retention requirements to provide support for after-the-fact investigations of security incidents and to meet statutory, regulatory and contractual retention requirements.", "justification": "Event Log & Security-Relevant Telemetry Retention (MON-13) provides detective monitoring capability that compensates for the absence of Event Log Backup on Separate Physical Systems / Components (MON-12.1) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "MON-12.2", "risk_if_not_implemented": "Without Event Log & Security-Relevant Telemetry Access by Subset of Privileged Users, users, services and processes may obtain or retain access beyond authorized need, enabling misuse or escalation. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Excessive or Unauthorized Privilege (R-AC-2), Unauthorized Access (R-AC-4), Loss of Investigative / Evidentiary Capability (R-IR-1), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Technical / Mechanical Failure (MT-10), Fraud, Corruption and/or Intentional Criminal Conduct (MT-14), Conflict of Interest (COI) / Undue Influence / Insider Misconduct (MT-15).", "compensating_control_1": { "control_id": "MON-13", "name": "Event Log & Security-Relevant Telemetry Retention", "description": "Mechanisms exist to retain event logs and security-relevant telemetry for a time period consistent with records retention requirements to provide support for after-the-fact investigations of security incidents and to meet statutory, regulatory and contractual retention requirements.", "justification": "Event Log & Security-Relevant Telemetry Retention (MON-13) provides detective monitoring capability that compensates for the absence of Access by Subset of Privileged Users (MON-12.2) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "MON-12", "name": "Protection of Event Logs & Security-Relevant Telemetry", "description": "Mechanisms exist to protect event logs, security-relevant telemetry and audit tools from unauthorized access, modification and deletion.", "justification": "Protection of Event Logs & Security-Relevant Telemetry (MON-12) provides detective monitoring capability that compensates for the absence of Access by Subset of Privileged Users (MON-12.2) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "MON-12.3", "risk_if_not_implemented": "Without Cryptographic Protection of Event Logs & Security-Relevant Telemetry, data in transit and at rest may be exposed through weak, misconfigured or compromised cryptographic protections. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss of Investigative / Evidentiary Capability (R-IR-1), Loss of Data Integrity (R-IP-3), Loss of Authenticity / Provenance (R-IP-5), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Technical / Mechanical Failure (MT-10), Fraud, Corruption and/or Intentional Criminal Conduct (MT-14), Cryptographic Compromise / Cryptanalytic Capability Advancement (MT-31).", "compensating_control_1": { "control_id": "CRY-14", "name": "Cryptographic Hash", "description": "Mechanisms exist to utilize hash algorithms to generate a hash value that can be used to validate the integrity of data and/or software.", "justification": "Cryptographic Hash (CRY-14) provides cryptographic protection that compensates for the absence of Cryptographic Protection of Event Log Information (MON-12.3) by ensuring data confidentiality and integrity through alternative technical means. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "MON-12", "name": "Protection of Event Logs & Security-Relevant Telemetry", "description": "Mechanisms exist to protect event logs, security-relevant telemetry and audit tools from unauthorized access, modification and deletion.", "justification": "Protection of Event Logs & Security-Relevant Telemetry (MON-12) provides detective monitoring capability that compensates for the absence of Cryptographic Protection of Event Log Information (MON-12.3) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "MON-12.4", "risk_if_not_implemented": "Without Dual Authorization for Event Log & Security-Relevant Telemetry Movement, users, services and processes may obtain or retain access beyond authorized need, enabling misuse or escalation. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss of Investigative / Evidentiary Capability (R-IR-1), Loss of Data Integrity (R-IP-3), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Technical / Mechanical Failure (MT-10), Fraud, Corruption and/or Intentional Criminal Conduct (MT-14), Conflict of Interest (COI) / Undue Influence / Insider Misconduct (MT-15).", "compensating_control_1": { "control_id": "MON-12", "name": "Protection of Event Logs & Security-Relevant Telemetry", "description": "Mechanisms exist to protect event logs, security-relevant telemetry and audit tools from unauthorized access, modification and deletion.", "justification": "Protection of Event Logs & Security-Relevant Telemetry (MON-12) provides detective monitoring capability that compensates for the absence of Dual Authorization for Event Log Movement (MON-12.4) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CRY-14", "name": "Cryptographic Hash", "description": "Mechanisms exist to utilize hash algorithms to generate a hash value that can be used to validate the integrity of data and/or software.", "justification": "Cryptographic Hash (CRY-14) provides cryptographic protection that compensates for the absence of Dual Authorization for Event Log Movement (MON-12.4) by ensuring data confidentiality and integrity through alternative technical means. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "MON-12.5", "risk_if_not_implemented": "Without Write Once Read Many (WORM) Event Log Generation, malicious, anomalous or unauthorized activity may go undetected or be detected too late to prevent or limit harm. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss of Investigative / Evidentiary Capability (R-IR-1), Loss of Data Integrity (R-IP-3), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Technical / Mechanical Failure (MT-10), Fraud, Corruption and/or Intentional Criminal Conduct (MT-14).", "compensating_control_1": { "control_id": "MON-12", "name": "Protection of Event Logs & Security-Relevant Telemetry", "description": "Mechanisms exist to protect event logs, security-relevant telemetry and audit tools from unauthorized access, modification and deletion.", "justification": "Protection of Event Logs & Security-Relevant Telemetry (MON-12) provides detective monitoring capability that compensates for the absence of Write Once Read Many (WORM) Event Log Generation (MON-12.5) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CRY-14", "name": "Cryptographic Hash", "description": "Mechanisms exist to utilize hash algorithms to generate a hash value that can be used to validate the integrity of data and/or software.", "justification": "Cryptographic Hash (CRY-14) provides cryptographic protection that compensates for the absence of Write Once Read Many (WORM) Event Log Generation (MON-12.5) by ensuring data confidentiality and integrity through alternative technical means. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "MON-14", "risk_if_not_implemented": "Without Privileged Functions Logging, users, services and processes may obtain or retain access beyond authorized need, enabling misuse or escalation. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss of Accountability / Attribution (R-AC-1), Loss of Investigative / Evidentiary Capability (R-IR-1), Undetected / Delayed Detection of Adverse Activity (R-SA-1), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Dysfunctional Management Practices (MT-8), Human Error (MT-9), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "MON-09", "name": "Content of Event Logs", "description": "Mechanisms exist to configure Technology Assets, Applications and/or Services (TAAS) to produce event logs that contain sufficient information to, at a minimum:\n(1) Establish what type of event occurred;\n(2) When (date and time) the event occurred;\n(3) Where the event occurred;\n(4) The source of the event;\n(5) The outcome (success or failure) of the event; and \n(6) The identity of any user/subject associated with the event.", "justification": "Content of Event Logs (MON-09) provides detective monitoring capability that compensates for the absence of Privileged Functions Logging (MON-14) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "MON-10", "name": "Event Log & Security-Relevant Telemetry Storage Capacity", "description": "Mechanisms exist to allocate and proactively manage sufficient event log and security-relevant telemetry storage capacity to reduce the likelihood of such capacity being exceeded.", "justification": "Event Log & Security-Relevant Telemetry Storage Capacity (MON-10) provides detective monitoring capability that compensates for the absence of Privileged Functions Logging (MON-14) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "MON-14.1", "risk_if_not_implemented": "Without Account Creation and Modification Logging, unauthorized individuals, devices or services may gain access to Technology Assets, Applications, Services, Data and/or Facilities (TAASDF). Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss of Accountability / Attribution (R-AC-1), Loss of Investigative / Evidentiary Capability (R-IR-1), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "MON-02", "name": "Continuous Monitoring", "description": "Mechanisms exist to facilitate the implementation of enterprise-wide monitoring controls.", "justification": "Continuous Monitoring (MON-02) provides detective monitoring capability that compensates for the absence of Account Creation and Modification Logging (MON-14.1) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "MON-16", "name": "Anomalous Behavior", "description": "Mechanisms exist to utilize User & Entity Behavior Analytics (UEBA) and/or User Activity Monitoring (UAM) solutions to detect and respond to anomalous behavior that could indicate account compromise or other malicious activities.", "justification": "Anomalous Behavior (MON-16) provides detective monitoring capability that compensates for the absence of Account Creation and Modification Logging (MON-14.1) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "MON-14.2", "risk_if_not_implemented": "Without Privileged User Oversight, users, services and processes may obtain or retain access beyond authorized need, enabling misuse or escalation. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Undetected / Delayed Detection of Adverse Activity (R-SA-1), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Dysfunctional Management Practices (MT-8), Human Error (MT-9), Technical / Mechanical Failure (MT-10), Conflict of Interest (COI) / Undue Influence / Insider Misconduct (MT-15).", "compensating_control_1": { "control_id": "CPL-05", "name": "Conformity Monitoring", "description": "Mechanisms exist to validate that Technology Assets, Applications, Services and/or Data (TAASD) conform to the organization's security, compliance and/or resilience policies, standards and other applicable requirements.", "justification": "Conformity Monitoring (CPL-05) provides periodic assessment and assurance that compensates for the absence of Privileged User Oversight (MON-14.2) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "MON-06", "name": "Monitoring Reporting", "description": "Mechanisms exist to provide an event log report generation capability to aid in detecting and assessing anomalous activities.", "justification": "Monitoring Reporting (MON-06) provides detective monitoring capability that compensates for the absence of Privileged User Oversight (MON-14.2) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "MON-15", "risk_if_not_implemented": "Without Inventory of Technology Asset Event Logging, malicious, anomalous or unauthorized activity may go undetected or be detected too late to prevent or limit harm. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unaddressed Security / Compliance Exposure (R-GV-2), and most likely increases susceptibility to Human Error (MT-9), Data Quality Degradation / Data Poisoning (MT-12).", "compensating_control_1": { "control_id": "MON-12", "name": "Protection of Event Logs & Security-Relevant Telemetry", "description": "Mechanisms exist to protect event logs, security-relevant telemetry and audit tools from unauthorized access, modification and deletion.", "justification": "Protection of Event Logs & Security-Relevant Telemetry (MON-12) provides detective monitoring capability that compensates for the absence of Inventory of Technology Asset Event Logging (MON-15) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "MON-05", "name": "Centralized Collection of Event Logs & Security-Relevant Telemetry", "description": "Mechanisms exist to utilize a Security Incident Event Manager (SIEM), or similar automated tool, to support the centralized collection of event logs and security-relevant telemetry.", "justification": "Centralized Collection of Event Logs & Security-Relevant Telemetry (MON-05) provides detective monitoring capability that compensates for the absence of Inventory of Technology Asset Event Logging (MON-15) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "MON-16.1", "risk_if_not_implemented": "Without Unusual Transactions, malicious, anomalous or unauthorized activity may go undetected or be detected too late to prevent or limit harm. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Fraud / Theft / Direct Financial Loss (R-EX-10), Undetected / Delayed Detection of Adverse Activity (R-SA-1), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9), Data Quality Degradation / Data Poisoning (MT-12), Fraud, Corruption and/or Intentional Criminal Conduct (MT-14).", "compensating_control_1": { "control_id": "DCH-40", "name": "Data Loss Prevention (DLP)", "description": "Automated mechanisms exist to implement Data Loss Prevention (DLP) to protect sensitive information as it is stored, transmitted and processed.", "justification": "Data Loss Prevention (DLP) (DCH-40) provides detective monitoring capability that compensates for the absence of Transfer Activity Limits (MON-16.1) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CRY-05", "name": "Encrypting Data In Transit", "description": "Cryptographic mechanisms exist to prevent the unauthorized disclosure of data in transit.", "justification": "Encrypting Data In Transit (CRY-05) provides cryptographic protection that compensates for the absence of Transfer Activity Limits (MON-16.1) by ensuring data confidentiality and integrity through alternative technical means. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "MON-17", "risk_if_not_implemented": "Without Monitoring for Indicators of Compromise (IOC), malicious, anomalous or unauthorized activity may go undetected or be detected too late to prevent or limit harm. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Delayed Containment / Increased Incident Impact (R-IR-2), Undetected / Delayed Detection of Adverse Activity (R-SA-1), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Technical / Mechanical Failure (MT-10), Data Quality Degradation / Data Poisoning (MT-12).", "compensating_control_1": { "control_id": "MON-19", "name": "Monitoring For Information Disclosure", "description": "Mechanisms exist to monitor for evidence of unauthorized exfiltration or disclosure of non-public information.", "justification": "Monitoring For Information Disclosure (MON-19) provides detective monitoring capability that compensates for the absence of Monitoring for Indicators of Compromise (IOC) (MON-17) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "DCH-40", "name": "Data Loss Prevention (DLP)", "description": "Automated mechanisms exist to implement Data Loss Prevention (DLP) to protect sensitive information as it is stored, transmitted and processed.", "justification": "Data Loss Prevention (DLP) (DCH-40) provides detective monitoring capability that compensates for the absence of Monitoring for Indicators of Compromise (IOC) (MON-17) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "MON-17.1", "risk_if_not_implemented": "Without Deactivated Account Activity, unauthorized individuals, devices or services may gain access to Technology Assets, Applications, Services, Data and/or Facilities (TAASDF). Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Identity Compromise / Impersonation (R-AC-5), Undetected / Delayed Detection of Adverse Activity (R-SA-1), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "MON-05", "name": "Centralized Collection of Event Logs & Security-Relevant Telemetry", "description": "Mechanisms exist to utilize a Security Incident Event Manager (SIEM), or similar automated tool, to support the centralized collection of event logs and security-relevant telemetry.", "justification": "Centralized Collection of Event Logs & Security-Relevant Telemetry (MON-05) provides detective monitoring capability that compensates for the absence of Deactivated Account Activity (MON-17.1) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "MON-06", "name": "Monitoring Reporting", "description": "Mechanisms exist to provide an event log report generation capability to aid in detecting and assessing anomalous activities.", "justification": "Monitoring Reporting (MON-06) provides detective monitoring capability that compensates for the absence of Deactivated Account Activity (MON-17.1) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "MON-17.2", "risk_if_not_implemented": "Without Automated Response to Suspicious Events, malicious, anomalous or unauthorized activity may go undetected or be detected too late to prevent or limit harm. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Delayed Containment / Increased Incident Impact (R-IR-2), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "MON-05.2", "name": "Event Log & Security-Relevant Telemetry Analysis & Triage", "description": "Mechanisms exist to ensure event log and security-relevant telemetry reviews include analysis and triage practices that integrate with the organization's established incident response processes.", "justification": "Event Log & Security-Relevant Telemetry Analysis & Triage (MON-05.2) provides detective monitoring capability that compensates for the absence of Automated Response to Suspicious Events (MON-17.2) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "MON-06", "name": "Monitoring Reporting", "description": "Mechanisms exist to provide an event log report generation capability to aid in detecting and assessing anomalous activities.", "justification": "Monitoring Reporting (MON-06) provides detective monitoring capability that compensates for the absence of Automated Response to Suspicious Events (MON-17.2) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "MON-17.3", "risk_if_not_implemented": "Without Insider Threats, trusted insiders may misuse access or act on conflicts of interest without detection or deterrence. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to System / Data Compromise (Non-Technical Vector) (R-BC-5), Undetected / Delayed Detection of Adverse Activity (R-SA-1), and most likely increases susceptibility to man-made threats MT-2, MT-8, MT-9, MT-10, MT-14, MT-15.", "compensating_control_1": { "control_id": "MON-02", "name": "Continuous Monitoring", "description": "Mechanisms exist to facilitate the implementation of enterprise-wide monitoring controls.", "justification": "Continuous Monitoring (MON-02) provides detective monitoring capability that compensates for the absence of Insider Threats (MON-17.3) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "THR-09", "name": "Behavioral Baselining", "description": "Automated mechanisms exist to establish behavioral baselines that capture information about user and entity behavior to enable dynamic threat discovery.", "justification": "Behavioral Baselining (THR-09) provides overlapping security capability that compensates for the absence of Insider Threats (MON-17.3) by addressing related risk objectives through an alternative control mechanism aligned with Technology applicability. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "MON-17.4", "risk_if_not_implemented": "Without Third-Party Threats, supplier and External Service Provider (ESP) weaknesses, incidents or failures may propagate into the organization's environment unmanaged. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to System / Data Compromise (Non-Technical Vector) (R-BC-5), Uncontrolled Third-Party Security / Privacy Exposure (R-GV-5), Undetected / Delayed Detection of Adverse Activity (R-SA-1), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9), Technical / Mechanical Failure (MT-10), Fraud, Corruption and/or Intentional Criminal Conduct (MT-14), Conflict of Interest (COI) / Undue Influence / Insider Misconduct (MT-15).", "compensating_control_1": { "control_id": "THR-09", "name": "Behavioral Baselining", "description": "Automated mechanisms exist to establish behavioral baselines that capture information about user and entity behavior to enable dynamic threat discovery.", "justification": "Behavioral Baselining (THR-09) provides overlapping security capability that compensates for the absence of Third-Party Threats (MON-17.4) by addressing related risk objectives through an alternative control mechanism aligned with Technology applicability. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "MON-16", "name": "Anomalous Behavior", "description": "Mechanisms exist to utilize User & Entity Behavior Analytics (UEBA) and/or User Activity Monitoring (UAM) solutions to detect and respond to anomalous behavior that could indicate account compromise or other malicious activities.", "justification": "Anomalous Behavior (MON-16) provides detective monitoring capability that compensates for the absence of Third-Party Threats (MON-17.4) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "MON-18", "risk_if_not_implemented": "Without Individuals Posing Greater Risk, malicious, anomalous or unauthorized activity may go undetected or be detected too late to prevent or limit harm. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Undetected / Delayed Detection of Adverse Activity (R-SA-1), and most likely increases susceptibility to man-made threats MT-2, MT-9, MT-10, MT-14, MT-15, MT-25.", "compensating_control_1": { "control_id": "MON-05", "name": "Centralized Collection of Event Logs & Security-Relevant Telemetry", "description": "Mechanisms exist to utilize a Security Incident Event Manager (SIEM), or similar automated tool, to support the centralized collection of event logs and security-relevant telemetry.", "justification": "Centralized Collection of Event Logs & Security-Relevant Telemetry (MON-05) provides detective monitoring capability that compensates for the absence of Individuals Posing Greater Risk (MON-18) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CPL-05", "name": "Conformity Monitoring", "description": "Mechanisms exist to validate that Technology Assets, Applications, Services and/or Data (TAASD) conform to the organization's security, compliance and/or resilience policies, standards and other applicable requirements.", "justification": "Conformity Monitoring (CPL-05) provides periodic assessment and assurance that compensates for the absence of Individuals Posing Greater Risk (MON-18) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "MON-18.1", "risk_if_not_implemented": "Without Session Audit, the organization may fail to meet statutory, regulatory or contractual obligations, or be unable to demonstrate conformity when required. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss of Accountability / Attribution (R-AC-1), Loss of Investigative / Evidentiary Capability (R-IR-1), Undetected / Delayed Detection of Adverse Activity (R-SA-1), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Technical / Mechanical Failure (MT-10), Fraud, Corruption and/or Intentional Criminal Conduct (MT-14), Conflict of Interest (COI) / Undue Influence / Insider Misconduct (MT-15).", "compensating_control_1": { "control_id": "MON-05", "name": "Centralized Collection of Event Logs & Security-Relevant Telemetry", "description": "Mechanisms exist to utilize a Security Incident Event Manager (SIEM), or similar automated tool, to support the centralized collection of event logs and security-relevant telemetry.", "justification": "Centralized Collection of Event Logs & Security-Relevant Telemetry (MON-05) provides detective monitoring capability that compensates for the absence of Session Audit (MON-18.1) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "MON-05.2", "name": "Event Log & Security-Relevant Telemetry Analysis & Triage", "description": "Mechanisms exist to ensure event log and security-relevant telemetry reviews include analysis and triage practices that integrate with the organization's established incident response processes.", "justification": "Event Log & Security-Relevant Telemetry Analysis & Triage (MON-05.2) provides detective monitoring capability that compensates for the absence of Session Audit (MON-18.1) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "MON-18.2", "risk_if_not_implemented": "Without Real-Time Session Monitoring, malicious, anomalous or unauthorized activity may go undetected or be detected too late to prevent or limit harm. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Undetected / Delayed Detection of Adverse Activity (R-SA-1), and most likely increases susceptibility to man-made threats MT-2, MT-9, MT-10, MT-11, MT-14, MT-15, MT-25.", "compensating_control_1": { "control_id": "MON-05", "name": "Centralized Collection of Event Logs & Security-Relevant Telemetry", "description": "Mechanisms exist to utilize a Security Incident Event Manager (SIEM), or similar automated tool, to support the centralized collection of event logs and security-relevant telemetry.", "justification": "Centralized Collection of Event Logs & Security-Relevant Telemetry (MON-05) provides detective monitoring capability that compensates for the absence of Real-Time Session Monitoring (MON-18.2) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "MON-02", "name": "Continuous Monitoring", "description": "Mechanisms exist to facilitate the implementation of enterprise-wide monitoring controls.", "justification": "Continuous Monitoring (MON-02) provides detective monitoring capability that compensates for the absence of Real-Time Session Monitoring (MON-18.2) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "MON-19", "risk_if_not_implemented": "Without Monitoring For Information Disclosure, malicious, anomalous or unauthorized activity may go undetected or be detected too late to prevent or limit harm. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Undetected / Delayed Detection of Adverse Activity (R-SA-1), Loss of Confidentiality (R-IP-2), and most likely increases susceptibility to man-made threats MT-2, MT-9, MT-10, MT-12, MT-14, MT-25.", "compensating_control_1": { "control_id": "DCH-40", "name": "Data Loss Prevention (DLP)", "description": "Automated mechanisms exist to implement Data Loss Prevention (DLP) to protect sensitive information as it is stored, transmitted and processed.", "justification": "Data Loss Prevention (DLP) (DCH-40) provides detective monitoring capability that compensates for the absence of Monitoring For Information Disclosure (MON-19) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "MON-02", "name": "Continuous Monitoring", "description": "Mechanisms exist to facilitate the implementation of enterprise-wide monitoring controls.", "justification": "Continuous Monitoring (MON-02) provides detective monitoring capability that compensates for the absence of Monitoring For Information Disclosure (MON-19) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "MON-19.1", "risk_if_not_implemented": "Without Monitoring for Third-Party Information Disclosure, supplier and External Service Provider (ESP) weaknesses, incidents or failures may propagate into the organization's environment unmanaged. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Undetected / Delayed Detection of Adverse Activity (R-SA-1), Loss of Confidentiality (R-IP-2), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9), Technical / Mechanical Failure (MT-10), Fraud, Corruption and/or Intentional Criminal Conduct (MT-14), Workforce Shortage / Loss of Critical Skills / Labor Disruption (MT-25).", "compensating_control_1": { "control_id": "MON-19", "name": "Monitoring For Information Disclosure", "description": "Mechanisms exist to monitor for evidence of unauthorized exfiltration or disclosure of non-public information.", "justification": "Monitoring For Information Disclosure (MON-19) provides detective monitoring capability that compensates for the absence of Monitoring for Third-Party Information Disclosure (MON-19.1) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "MON-36.1", "name": "Cross-Organizational Monitoring", "description": "Mechanisms exist to coordinate sanitized event logs and security-relevant telemetry among external organizations to identify anomalous events when that data is shared across organizational boundaries, without giving away sensitive or critical business data.", "justification": "Cross-Organizational Monitoring (MON-36.1) provides detective monitoring capability that compensates for the absence of Monitoring for Third-Party Information Disclosure (MON-19.1) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "MON-20", "risk_if_not_implemented": "Without Covert Channel Analysis, malicious, anomalous or unauthorized activity may go undetected or be detected too late to prevent or limit harm. Based on the risk and threat mapping for this control, no risk is rated Likely; risks rated Possible include Loss of Accountability / Attribution (R-AC-1), Unauthorized Access (R-AC-4), System / Data Compromise (Technical Vector) (R-BC-4), and most likely increases susceptibility to Human Error (MT-9), Workforce Shortage / Loss of Critical Skills / Labor Disruption (MT-25).", "compensating_control_1": { "control_id": "NET-06", "name": "Network Segmentation (macrosegmentation)", "description": "Mechanisms exist to implement network segmentation within network architectures to isolate Technology Assets, Applications and/or Services (TAAS) from other network resources.", "justification": "Network Segmentation (macrosegmentation) (NET-06) provides network-level access restriction that compensates for the absence of Covert Channel Analysis (MON-20) by limiting attacker reach and lateral movement opportunities across the environment. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "MON-02", "name": "Continuous Monitoring", "description": "Mechanisms exist to facilitate the implementation of enterprise-wide monitoring controls.", "justification": "Continuous Monitoring (MON-02) provides detective monitoring capability that compensates for the absence of Covert Channel Analysis (MON-20) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "MON-20.1", "risk_if_not_implemented": "Without Analyze Traffic for Covert Exfiltration, sensitive and/or regulated data may be exfiltrated, leaked or transferred outside authorized boundaries without detection. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Undetected / Delayed Detection of Adverse Activity (R-SA-1), Loss of Confidentiality (R-IP-2), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Technical / Mechanical Failure (MT-10), Data Quality Degradation / Data Poisoning (MT-12), Fraud, Corruption and/or Intentional Criminal Conduct (MT-14).", "compensating_control_1": { "control_id": "MON-02", "name": "Continuous Monitoring", "description": "Mechanisms exist to facilitate the implementation of enterprise-wide monitoring controls.", "justification": "Continuous Monitoring (MON-02) provides detective monitoring capability that compensates for the absence of Analyze Traffic for Covert Exfiltration (MON-20.1) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "DCH-40", "name": "Data Loss Prevention (DLP)", "description": "Automated mechanisms exist to implement Data Loss Prevention (DLP) to protect sensitive information as it is stored, transmitted and processed.", "justification": "Data Loss Prevention (DLP) (DCH-40) provides detective monitoring capability that compensates for the absence of Analyze Traffic for Covert Exfiltration (MON-20.1) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "MON-21", "risk_if_not_implemented": "Without Unauthorized Activities, malicious, anomalous or unauthorized activity may go undetected or be detected too late to prevent or limit harm. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Access (R-AC-4), Undetected / Delayed Detection of Adverse Activity (R-SA-1), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9), Technical / Mechanical Failure (MT-10), Data Quality Degradation / Data Poisoning (MT-12), Workforce Shortage / Loss of Critical Skills / Labor Disruption (MT-25).", "compensating_control_1": { "control_id": "MON-16", "name": "Anomalous Behavior", "description": "Mechanisms exist to utilize User & Entity Behavior Analytics (UEBA) and/or User Activity Monitoring (UAM) solutions to detect and respond to anomalous behavior that could indicate account compromise or other malicious activities.", "justification": "Anomalous Behavior (MON-16) provides detective monitoring capability that compensates for the absence of Unauthorized Activities (MON-21) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "THR-09", "name": "Behavioral Baselining", "description": "Automated mechanisms exist to establish behavioral baselines that capture information about user and entity behavior to enable dynamic threat discovery.", "justification": "Behavioral Baselining (THR-09) provides overlapping security capability that compensates for the absence of Unauthorized Activities (MON-21) by addressing related risk objectives through an alternative control mechanism aligned with Technology applicability. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "MON-21.1", "risk_if_not_implemented": "Without Unauthorized Network Services, adversaries may move laterally, exfiltrate data or reach systems that should have been isolated from untrusted networks. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Delayed Containment / Increased Incident Impact (R-IR-2), Undetected / Delayed Detection of Adverse Activity (R-SA-1), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Technical / Mechanical Failure (MT-10), Data Quality Degradation / Data Poisoning (MT-12).", "compensating_control_1": { "control_id": "DCH-40", "name": "Data Loss Prevention (DLP)", "description": "Automated mechanisms exist to implement Data Loss Prevention (DLP) to protect sensitive information as it is stored, transmitted and processed.", "justification": "Data Loss Prevention (DLP) (DCH-40) provides detective monitoring capability that compensates for the absence of Unauthorized Network Services (MON-21.1) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "MON-19", "name": "Monitoring For Information Disclosure", "description": "Mechanisms exist to monitor for evidence of unauthorized exfiltration or disclosure of non-public information.", "justification": "Monitoring For Information Disclosure (MON-19) provides detective monitoring capability that compensates for the absence of Unauthorized Network Services (MON-21.1) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "MON-22", "risk_if_not_implemented": "Without Inbound & Outbound Communications Traffic, malicious, anomalous or unauthorized activity may go undetected or be detected too late to prevent or limit harm. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Access (R-AC-4), Undetected / Delayed Detection of Adverse Activity (R-SA-1), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9), Technical / Mechanical Failure (MT-10), Data Quality Degradation / Data Poisoning (MT-12), Workforce Shortage / Loss of Critical Skills / Labor Disruption (MT-25).", "compensating_control_1": { "control_id": "MON-05", "name": "Centralized Collection of Event Logs & Security-Relevant Telemetry", "description": "Mechanisms exist to utilize a Security Incident Event Manager (SIEM), or similar automated tool, to support the centralized collection of event logs and security-relevant telemetry.", "justification": "Centralized Collection of Event Logs & Security-Relevant Telemetry (MON-05) provides detective monitoring capability that compensates for the absence of Inbound & Outbound Communications Traffic (MON-22) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "MON-05.2", "name": "Event Log & Security-Relevant Telemetry Analysis & Triage", "description": "Mechanisms exist to ensure event log and security-relevant telemetry reviews include analysis and triage practices that integrate with the organization's established incident response processes.", "justification": "Event Log & Security-Relevant Telemetry Analysis & Triage (MON-05.2) provides detective monitoring capability that compensates for the absence of Inbound & Outbound Communications Traffic (MON-22) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "MON-22.1", "risk_if_not_implemented": "Without Proxy Logging, malicious, anomalous or unauthorized activity may go undetected or be detected too late to prevent or limit harm. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss of Investigative / Evidentiary Capability (R-IR-1), Undetected / Delayed Detection of Adverse Activity (R-SA-1), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "MON-06", "name": "Monitoring Reporting", "description": "Mechanisms exist to provide an event log report generation capability to aid in detecting and assessing anomalous activities.", "justification": "Monitoring Reporting (MON-06) provides detective monitoring capability that compensates for the absence of Proxy Logging (MON-22.1) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "MON-05", "name": "Centralized Collection of Event Logs & Security-Relevant Telemetry", "description": "Mechanisms exist to utilize a Security Incident Event Manager (SIEM), or similar automated tool, to support the centralized collection of event logs and security-relevant telemetry.", "justification": "Centralized Collection of Event Logs & Security-Relevant Telemetry (MON-05) provides detective monitoring capability that compensates for the absence of Proxy Logging (MON-22.1) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "MON-23", "risk_if_not_implemented": "Without Network Intrusion Detection & Prevention Systems (NIDS & NIPS) Monitoring, malicious, anomalous or unauthorized activity may go undetected or be detected too late to prevent or limit harm. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to System / Data Compromise (Technical Vector) (R-BC-4), System / Service Compromise (R-EX-7), Undetected / Delayed Detection of Adverse Activity (R-SA-1), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9), Technical / Mechanical Failure (MT-10), Data Quality Degradation / Data Poisoning (MT-12), Workforce Shortage / Loss of Critical Skills / Labor Disruption (MT-25).", "compensating_control_1": { "control_id": "MON-05", "name": "Centralized Collection of Event Logs & Security-Relevant Telemetry", "description": "Mechanisms exist to utilize a Security Incident Event Manager (SIEM), or similar automated tool, to support the centralized collection of event logs and security-relevant telemetry.", "justification": "Centralized Collection of Event Logs & Security-Relevant Telemetry (MON-05) provides detective monitoring capability that compensates for the absence of Intrusion Detection & Prevention Systems (IDS & IPS) (MON-23) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "MON-05.2", "name": "Event Log & Security-Relevant Telemetry Analysis & Triage", "description": "Mechanisms exist to ensure event log and security-relevant telemetry reviews include analysis and triage practices that integrate with the organization's established incident response processes.", "justification": "Event Log & Security-Relevant Telemetry Analysis & Triage (MON-05.2) provides detective monitoring capability that compensates for the absence of Intrusion Detection & Prevention Systems (IDS & IPS) (MON-23) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "MON-24", "risk_if_not_implemented": "Without Host Intrusion Detection & Prevention Systems (HIDS & HIPS) Monitoring, malicious, anomalous or unauthorized activity may go undetected or be detected too late to prevent or limit harm. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to System / Data Compromise (Technical Vector) (R-BC-4), System / Service Compromise (R-EX-7), Delayed Containment / Increased Incident Impact (R-IR-2), Undetected / Delayed Detection of Adverse Activity (R-SA-1), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "MON-05", "name": "Centralized Collection of Event Logs & Security-Relevant Telemetry", "description": "Mechanisms exist to utilize a Security Incident Event Manager (SIEM), or similar automated tool, to support the centralized collection of event logs and security-relevant telemetry.", "justification": "Centralized Collection of Event Logs & Security-Relevant Telemetry (MON-05) provides detective monitoring capability that compensates for the absence of Host-Based Devices (MON-24) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CPL-07.3", "name": "Audit Planning Activities", "description": "Mechanisms exist to thoughtfully plan audits by including input from operational risk and compliance partners to minimize the impact of audit-related activities on business operations.", "justification": "Audit Planning Activities (CPL-07.3) provides detective monitoring capability that compensates for the absence of Host-Based Devices (MON-24) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "MON-25", "risk_if_not_implemented": "Without De-Militarized Zone (DMZ) Monitoring, malicious, anomalous or unauthorized activity may go undetected or be detected too late to prevent or limit harm. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to System / Data Compromise (Technical Vector) (R-BC-4), System / Service Compromise (R-EX-7), Undetected / Delayed Detection of Adverse Activity (R-SA-1), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "MON-05.2", "name": "Event Log & Security-Relevant Telemetry Analysis & Triage", "description": "Mechanisms exist to ensure event log and security-relevant telemetry reviews include analysis and triage practices that integrate with the organization's established incident response processes.", "justification": "Event Log & Security-Relevant Telemetry Analysis & Triage (MON-05.2) provides detective monitoring capability that compensates for the absence of DMZ Networks (MON-25) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "NET-31", "name": "Network Intrusion Detection / Prevention Systems (NIDS / NIPS)", "description": "Mechanisms exist to employ Network Intrusion Detection / Prevention Systems (NIDS/NIPS) to detect and/or prevent intrusions into the network.", "justification": "Network Intrusion Detection / Prevention Systems (NIDS / NIPS) (NET-31) provides detective monitoring capability that compensates for the absence of DMZ Networks (MON-25) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "MON-26", "risk_if_not_implemented": "Without Wireless Network Monitoring, malicious, anomalous or unauthorized activity may go undetected or be detected too late to prevent or limit harm. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Access (R-AC-4), System / Data Compromise (Technical Vector) (R-BC-4), System / Service Compromise (R-EX-7), Undetected / Delayed Detection of Adverse Activity (R-SA-1), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "MON-05.2", "name": "Event Log & Security-Relevant Telemetry Analysis & Triage", "description": "Mechanisms exist to ensure event log and security-relevant telemetry reviews include analysis and triage practices that integrate with the organization's established incident response processes.", "justification": "Event Log & Security-Relevant Telemetry Analysis & Triage (MON-05.2) provides detective monitoring capability that compensates for the absence of Wireless Network Monitoring (MON-26) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "MON-05", "name": "Centralized Collection of Event Logs & Security-Relevant Telemetry", "description": "Mechanisms exist to utilize a Security Incident Event Manager (SIEM), or similar automated tool, to support the centralized collection of event logs and security-relevant telemetry.", "justification": "Centralized Collection of Event Logs & Security-Relevant Telemetry (MON-05) provides detective monitoring capability that compensates for the absence of Wireless Network Monitoring (MON-26) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "MON-27", "risk_if_not_implemented": "Without File Integrity Monitoring (FIM), malicious, anomalous or unauthorized activity may go undetected or be detected too late to prevent or limit harm. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Modification / Loss of System Integrity (R-AM-2), Undetected / Delayed Detection of Adverse Activity (R-SA-1), Loss of Data Integrity (R-IP-3), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "MON-05.2", "name": "Event Log & Security-Relevant Telemetry Analysis & Triage", "description": "Mechanisms exist to ensure event log and security-relevant telemetry reviews include analysis and triage practices that integrate with the organization's established incident response processes.", "justification": "Event Log & Security-Relevant Telemetry Analysis & Triage (MON-05.2) provides detective monitoring capability that compensates for the absence of File Integrity Monitoring (FIM) (MON-27) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CPL-05", "name": "Conformity Monitoring", "description": "Mechanisms exist to validate that Technology Assets, Applications, Services and/or Data (TAASD) conform to the organization's security, compliance and/or resilience policies, standards and other applicable requirements.", "justification": "Conformity Monitoring (CPL-05) provides periodic assessment and assurance that compensates for the absence of File Integrity Monitoring (FIM) (MON-27) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "MON-28", "risk_if_not_implemented": "Without File Activity Monitoring (FAM), malicious, anomalous or unauthorized activity may go undetected or be detected too late to prevent or limit harm. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Undetected / Delayed Detection of Adverse Activity (R-SA-1), Loss of Confidentiality (R-IP-2), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "MON-02", "name": "Continuous Monitoring", "description": "Mechanisms exist to facilitate the implementation of enterprise-wide monitoring controls.", "justification": "Continuous Monitoring (MON-02) provides detective monitoring capability that compensates for the absence of File Activity Monitoring (FAM) (MON-28) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "MON-12", "name": "Protection of Event Logs & Security-Relevant Telemetry", "description": "Mechanisms exist to protect event logs, security-relevant telemetry and audit tools from unauthorized access, modification and deletion.", "justification": "Protection of Event Logs & Security-Relevant Telemetry (MON-12) provides detective monitoring capability that compensates for the absence of File Activity Monitoring (FAM) (MON-28) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "MON-29", "risk_if_not_implemented": "Without Permitted Monitoring Actions, malicious, anomalous or unauthorized activity may go undetected or be detected too late to prevent or limit harm. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Excessive or Unauthorized Privilege (R-AC-2), and most likely increases susceptibility to Human Error (MT-9).", "compensating_control_1": { "control_id": "MON-09", "name": "Content of Event Logs", "description": "Mechanisms exist to configure Technology Assets, Applications and/or Services (TAAS) to produce event logs that contain sufficient information to, at a minimum:\n(1) Establish what type of event occurred;\n(2) When (date and time) the event occurred;\n(3) Where the event occurred;\n(4) The source of the event;\n(5) The outcome (success or failure) of the event; and \n(6) The identity of any user/subject associated with the event.", "justification": "Content of Event Logs (MON-09) provides detective monitoring capability that compensates for the absence of Permitted Actions (MON-29) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "MON-12", "name": "Protection of Event Logs & Security-Relevant Telemetry", "description": "Mechanisms exist to protect event logs, security-relevant telemetry and audit tools from unauthorized access, modification and deletion.", "justification": "Protection of Event Logs & Security-Relevant Telemetry (MON-12) provides detective monitoring capability that compensates for the absence of Permitted Actions (MON-29) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "MON-29.1", "risk_if_not_implemented": "Without Changes by Authorized Individuals, malicious, anomalous or unauthorized activity may go undetected or be detected too late to prevent or limit harm. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss of Investigative / Evidentiary Capability (R-IR-1), Undetected / Delayed Detection of Adverse Activity (R-SA-1), and most likely increases susceptibility to Human Error (MT-9), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "MON-09", "name": "Content of Event Logs", "description": "Mechanisms exist to configure Technology Assets, Applications and/or Services (TAAS) to produce event logs that contain sufficient information to, at a minimum:\n(1) Establish what type of event occurred;\n(2) When (date and time) the event occurred;\n(3) Where the event occurred;\n(4) The source of the event;\n(5) The outcome (success or failure) of the event; and \n(6) The identity of any user/subject associated with the event.", "justification": "Content of Event Logs (MON-09) provides detective monitoring capability that compensates for the absence of Changes by Authorized Individuals (MON-29.1) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "MON-05", "name": "Centralized Collection of Event Logs & Security-Relevant Telemetry", "description": "Mechanisms exist to utilize a Security Incident Event Manager (SIEM), or similar automated tool, to support the centralized collection of event logs and security-relevant telemetry.", "justification": "Centralized Collection of Event Logs & Security-Relevant Telemetry (MON-05) provides detective monitoring capability that compensates for the absence of Changes by Authorized Individuals (MON-29.1) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "MON-29.2", "risk_if_not_implemented": "Without Query Parameter Audits of Personal Data (PD), Personal Data (PD) may be collected, processed, retained or shared without lawful authority or adequate safeguards, harming individuals and exposing the organization to regulatory action. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss of Accountability / Attribution (R-AC-1), Loss of Investigative / Evidentiary Capability (R-IR-1), Undetected / Delayed Detection of Adverse Activity (R-SA-1), Privacy Harm / Unauthorized Processing (R-IP-6), and most likely increases susceptibility to Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "MON-02", "name": "Continuous Monitoring", "description": "Mechanisms exist to facilitate the implementation of enterprise-wide monitoring controls.", "justification": "Continuous Monitoring (MON-02) provides detective monitoring capability that compensates for the absence of Query Parameter Audits of Personal Data (PD) (MON-29.2) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CPL-07", "name": "Executive Leadership Oversight of Security, Compliance & Resilience Controls", "description": "Mechanisms exist to provide a security, compliance and resilience controls oversight function that reports to the organization's executive leadership.", "justification": "Executive Leadership Oversight of Security, Compliance & Resilience Controls (CPL-07) provides resilience and recovery capability that compensates for the absence of Query Parameter Audits of Personal Data (PD) (MON-29.2) by ensuring the organization can restore operations and data when the primary control is absent. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "MON-30", "risk_if_not_implemented": "Without Sensitive Event Log & Security-Relevant Telemetry Data, malicious, anomalous or unauthorized activity may go undetected or be detected too late to prevent or limit harm. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss of Confidentiality (R-IP-2), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "MON-10", "name": "Event Log & Security-Relevant Telemetry Storage Capacity", "description": "Mechanisms exist to allocate and proactively manage sufficient event log and security-relevant telemetry storage capacity to reduce the likelihood of such capacity being exceeded.", "justification": "Event Log & Security-Relevant Telemetry Storage Capacity (MON-10) provides detective monitoring capability that compensates for the absence of Sensitive Event Log Information (MON-30) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the data-handling focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "MON-05", "name": "Centralized Collection of Event Logs & Security-Relevant Telemetry", "description": "Mechanisms exist to utilize a Security Incident Event Manager (SIEM), or similar automated tool, to support the centralized collection of event logs and security-relevant telemetry.", "justification": "Centralized Collection of Event Logs & Security-Relevant Telemetry (MON-05) provides detective monitoring capability that compensates for the absence of Sensitive Event Log Information (MON-30) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the data-handling focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "MON-30.1", "risk_if_not_implemented": "Without Limit Personal Data (PD) In Event Logs & Security-Relevant Telemetry, Personal Data (PD) may be collected, processed, retained or shared without lawful authority or adequate safeguards, harming individuals and exposing the organization to regulatory action. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Retention / Inability to Dispose of Data (R-AM-3), Privacy Harm / Unauthorized Processing (R-IP-6), and most likely increases susceptibility to Human Error (MT-9).", "compensating_control_1": { "control_id": "MON-05", "name": "Centralized Collection of Event Logs & Security-Relevant Telemetry", "description": "Mechanisms exist to utilize a Security Incident Event Manager (SIEM), or similar automated tool, to support the centralized collection of event logs and security-relevant telemetry.", "justification": "Centralized Collection of Event Logs & Security-Relevant Telemetry (MON-05) provides detective monitoring capability that compensates for the absence of Limit Personal Data (PD) In Audit Records (MON-30.1) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "MON-10", "name": "Event Log & Security-Relevant Telemetry Storage Capacity", "description": "Mechanisms exist to allocate and proactively manage sufficient event log and security-relevant telemetry storage capacity to reduce the likelihood of such capacity being exceeded.", "justification": "Event Log & Security-Relevant Telemetry Storage Capacity (MON-10) provides detective monitoring capability that compensates for the absence of Limit Personal Data (PD) In Audit Records (MON-30.1) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "MON-31", "risk_if_not_implemented": "Without Verbosity Logging for Boundary Devices, malicious, anomalous or unauthorized activity may go undetected or be detected too late to prevent or limit harm. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss of Investigative / Evidentiary Capability (R-IR-1), Undetected / Delayed Detection of Adverse Activity (R-SA-1), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "MON-10", "name": "Event Log & Security-Relevant Telemetry Storage Capacity", "description": "Mechanisms exist to allocate and proactively manage sufficient event log and security-relevant telemetry storage capacity to reduce the likelihood of such capacity being exceeded.", "justification": "Event Log & Security-Relevant Telemetry Storage Capacity (MON-10) provides detective monitoring capability that compensates for the absence of Verbosity Logging for Boundary Devices (MON-31) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "MON-09", "name": "Content of Event Logs", "description": "Mechanisms exist to configure Technology Assets, Applications and/or Services (TAAS) to produce event logs that contain sufficient information to, at a minimum:\n(1) Establish what type of event occurred;\n(2) When (date and time) the event occurred;\n(3) Where the event occurred;\n(4) The source of the event;\n(5) The outcome (success or failure) of the event; and \n(6) The identity of any user/subject associated with the event.", "justification": "Content of Event Logs (MON-09) provides detective monitoring capability that compensates for the absence of Verbosity Logging for Boundary Devices (MON-31) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "MON-32", "risk_if_not_implemented": "Without Database Logging, malicious, anomalous or unauthorized activity may go undetected or be detected too late to prevent or limit harm. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss of Accountability / Attribution (R-AC-1), Loss of Investigative / Evidentiary Capability (R-IR-1), Undetected / Delayed Detection of Adverse Activity (R-SA-1), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "MON-09", "name": "Content of Event Logs", "description": "Mechanisms exist to configure Technology Assets, Applications and/or Services (TAAS) to produce event logs that contain sufficient information to, at a minimum:\n(1) Establish what type of event occurred;\n(2) When (date and time) the event occurred;\n(3) Where the event occurred;\n(4) The source of the event;\n(5) The outcome (success or failure) of the event; and \n(6) The identity of any user/subject associated with the event.", "justification": "Content of Event Logs (MON-09) provides detective monitoring capability that compensates for the absence of Database Logging (MON-32) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "MON-05", "name": "Centralized Collection of Event Logs & Security-Relevant Telemetry", "description": "Mechanisms exist to utilize a Security Incident Event Manager (SIEM), or similar automated tool, to support the centralized collection of event logs and security-relevant telemetry.", "justification": "Centralized Collection of Event Logs & Security-Relevant Telemetry (MON-05) provides detective monitoring capability that compensates for the absence of Database Logging (MON-32) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "MON-33", "risk_if_not_implemented": "Without Response To Event Log Processing Failures, malicious, anomalous or unauthorized activity may go undetected or be detected too late to prevent or limit harm. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss of Accountability / Attribution (R-AC-1), Loss of Investigative / Evidentiary Capability (R-IR-1), Undetected / Delayed Detection of Adverse Activity (R-SA-1), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "MON-35", "name": "Alternate Event Logging Capability", "description": "Mechanisms exist to provide an alternate event logging capability in the event of a failure in primary audit capability.", "justification": "Alternate Event Logging Capability (MON-35) provides detective monitoring capability that compensates for the absence of Response To Event Log Processing Failures (MON-33) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "MON-05", "name": "Centralized Collection of Event Logs & Security-Relevant Telemetry", "description": "Mechanisms exist to utilize a Security Incident Event Manager (SIEM), or similar automated tool, to support the centralized collection of event logs and security-relevant telemetry.", "justification": "Centralized Collection of Event Logs & Security-Relevant Telemetry (MON-33) provides detective monitoring capability that compensates for the absence of Response To Event Log Processing Failures (MON-33) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "MON-33.1", "risk_if_not_implemented": "Without Real-Time Alerts of Event Logging Failure, malicious, anomalous or unauthorized activity may go undetected or be detected too late to prevent or limit harm. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss of Accountability / Attribution (R-AC-1), Loss of Investigative / Evidentiary Capability (R-IR-1), Undetected / Delayed Detection of Adverse Activity (R-SA-1), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "MON-05", "name": "Centralized Collection of Event Logs & Security-Relevant Telemetry", "description": "Mechanisms exist to utilize a Security Incident Event Manager (SIEM), or similar automated tool, to support the centralized collection of event logs and security-relevant telemetry.", "justification": "Centralized Collection of Event Logs & Security-Relevant Telemetry (MON-05) provides detective monitoring capability that compensates for the absence of Real-Time Alerts of Event Logging Failure (MON-33.1) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "MON-35", "name": "Alternate Event Logging Capability", "description": "Mechanisms exist to provide an alternate event logging capability in the event of a failure in primary audit capability.", "justification": "Alternate Event Logging Capability (MON-35) provides detective monitoring capability that compensates for the absence of Real-Time Alerts of Event Logging Failure (MON-33.1) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "MON-34", "risk_if_not_implemented": "Without Non-Repudiation, required evidence, logs and chain-of-custody integrity may be unavailable or unreliable when needed for investigation or legal proceedings. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss of Accountability / Attribution (R-AC-1), Loss of Investigative / Evidentiary Capability (R-IR-1), Loss of Authenticity / Provenance (R-IP-5), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Fraud, Corruption and/or Intentional Criminal Conduct (MT-14), Cryptographic Compromise / Cryptanalytic Capability Advancement (MT-31).", "compensating_control_1": { "control_id": "CRY-14", "name": "Cryptographic Hash", "description": "Mechanisms exist to utilize hash algorithms to generate a hash value that can be used to validate the integrity of data and/or software.", "justification": "Cryptographic Hash (CRY-14) provides cryptographic protection that compensates for the absence of Non-Repudiation (MON-34) by ensuring data confidentiality and integrity through alternative technical means. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "MON-12", "name": "Protection of Event Logs & Security-Relevant Telemetry", "description": "Mechanisms exist to protect event logs, security-relevant telemetry and audit tools from unauthorized access, modification and deletion.", "justification": "Protection of Event Logs & Security-Relevant Telemetry (MON-12) provides detective monitoring capability that compensates for the absence of Non-Repudiation (MON-34) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "MON-34.1", "risk_if_not_implemented": "Without Identity Binding, unauthorized individuals, devices or services may gain access to Technology Assets, Applications, Services, Data and/or Facilities (TAASDF). Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss of Accountability / Attribution (R-AC-1), Loss of Investigative / Evidentiary Capability (R-IR-1), Loss of Authenticity / Provenance (R-IP-5), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Fraud, Corruption and/or Intentional Criminal Conduct (MT-14).", "compensating_control_1": { "control_id": "MON-12", "name": "Protection of Event Logs & Security-Relevant Telemetry", "description": "Mechanisms exist to protect event logs, security-relevant telemetry and audit tools from unauthorized access, modification and deletion.", "justification": "Protection of Event Logs & Security-Relevant Telemetry (MON-12) provides detective monitoring capability that compensates for the absence of Identity Binding (MON-34.1) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CRY-14", "name": "Cryptographic Hash", "description": "Mechanisms exist to utilize hash algorithms to generate a hash value that can be used to validate the integrity of data and/or software.", "justification": "Cryptographic Hash (CRY-14) provides cryptographic protection that compensates for the absence of Identity Binding (MON-34.1) by ensuring data confidentiality and integrity through alternative technical means. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "MON-35", "risk_if_not_implemented": "Without Alternate Event Logging Capability, malicious, anomalous or unauthorized activity may go undetected or be detected too late to prevent or limit harm. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss of Investigative / Evidentiary Capability (R-IR-1), Concentration / Single-Point Dependency Failure (R-OR-2), and most likely increases susceptibility to Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "MON-05", "name": "Centralized Collection of Event Logs & Security-Relevant Telemetry", "description": "Mechanisms exist to utilize a Security Incident Event Manager (SIEM), or similar automated tool, to support the centralized collection of event logs and security-relevant telemetry.", "justification": "Centralized Collection of Event Logs & Security-Relevant Telemetry (MON-05) provides detective monitoring capability that compensates for the absence of Alternate Event Logging Capability (MON-35) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "MON-10", "name": "Event Log & Security-Relevant Telemetry Storage Capacity", "description": "Mechanisms exist to allocate and proactively manage sufficient event log and security-relevant telemetry storage capacity to reduce the likelihood of such capacity being exceeded.", "justification": "Event Log & Security-Relevant Telemetry Storage Capacity (MON-10) provides detective monitoring capability that compensates for the absence of Alternate Event Logging Capability (MON-35) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "MON-36", "risk_if_not_implemented": "Without Sharing of Event Logs & Security-Relevant Telemetry, malicious, anomalous or unauthorized activity may go undetected or be detected too late to prevent or limit harm. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss of Confidentiality (R-IP-2), and most likely increases susceptibility to Statutory / Regulatory / Contractual Change (MT-11).", "compensating_control_1": { "control_id": "TPM-02", "name": "Third-Party Management", "description": "Mechanisms exist to facilitate the implementation of third-party management controls.", "justification": "Third-Party Management (TPM-02) provides third-party oversight that compensates for the absence of Sharing of Event Logs (MON-36) by extending security obligations contractually and monitoring third-party risk in lieu of direct control. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "NET-05", "name": "Interconnection Security Agreements (ISAs)", "description": "Mechanisms exist to authorize connections from systems to other systems using Interconnection Security Agreements (ISAs), or similar methods, that document, for each interconnection:\n(1) Interface characteristics;\n(2) Security, compliance and resilience requirements; and;\n(3) The nature of the information communicated.", "justification": "Interconnection Security Agreements (ISAs) (NET-05) provides overlapping security capability that compensates for the absence of Sharing of Event Logs (MON-36) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "MON-36.1", "risk_if_not_implemented": "Without Cross-Organizational Monitoring, malicious, anomalous or unauthorized activity may go undetected or be detected too late to prevent or limit harm. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Undetected / Delayed Detection of Adverse Activity (R-SA-1), Loss of Confidentiality (R-IP-2), and most likely increases susceptibility to Statutory / Regulatory / Contractual Change (MT-11).", "compensating_control_1": { "control_id": "NET-05", "name": "Interconnection Security Agreements (ISAs)", "description": "Mechanisms exist to authorize connections from systems to other systems using Interconnection Security Agreements (ISAs), or similar methods, that document, for each interconnection:\n(1) Interface characteristics;\n(2) Security, compliance and resilience requirements; and;\n(3) The nature of the information communicated.", "justification": "Interconnection Security Agreements (ISAs) (NET-05) provides overlapping security capability that compensates for the absence of Cross-Organizational Monitoring (MON-36.1) by addressing related risk objectives through an alternative control mechanism aligned with Technology applicability. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "TPM-02", "name": "Third-Party Management", "description": "Mechanisms exist to facilitate the implementation of third-party management controls.", "justification": "Third-Party Management (TPM-02) provides third-party oversight that compensates for the absence of Cross-Organizational Monitoring (MON-36.1) by extending security obligations contractually and monitoring third-party risk in lieu of direct control. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "MON-37", "risk_if_not_implemented": "Without Control Assurance Automation (CAA) Data Feed Identification, automated control assurance results may be manipulated, misattributed or lose integrity, causing misplaced confidence in control effectiveness. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Undetected / Delayed Detection of Adverse Activity (R-SA-1), and most likely increases susceptibility to Malicious Cyber Activity (MT-2).", "compensating_control_1": { "control_id": "MON-15", "name": "Inventory of Technology Asset Event Logging", "description": "Mechanisms exist to maintain a current and accurate inventory of technology-related Technology Assets, Applications and/or Services (TAAS) being logged.", "justification": "Inventory of Technology Asset Event Logging (MON-15) provides detective monitoring capability that compensates for the absence of Control Assurance Automation (CAA) Data Feed Identification (MON-37) by identifying unauthorized, anomalous or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "MON-05", "name": "Centralized Collection of Event Logs & Security-Relevant Telemetry", "description": "Mechanisms exist to utilize a Security Incident Event Manager (SIEM), or similar automated tool, to support the centralized collection of event logs and security-relevant telemetry.", "justification": "Centralized Collection of Event Logs & Security-Relevant Telemetry (MON-05) provides detective monitoring capability that compensates for the absence of Control Assurance Automation (CAA) Data Feed Identification (MON-37) by identifying unauthorized, anomalous or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "CRY-03", "risk_if_not_implemented": "Without Cryptographic Management, data in transit and at rest may be exposed through weak, misconfigured or compromised cryptographic protections. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Modification / Loss of System Integrity (R-AM-2), Unaddressed Security / Compliance Exposure (R-GV-2), and most likely increases susceptibility to Human Error (MT-9).", "compensating_control_1": { "control_id": "MON-02", "name": "Continuous Monitoring", "description": "Mechanisms exist to facilitate the implementation of enterprise-wide monitoring controls.", "justification": "Continuous Monitoring (MON-02) provides detective monitoring capability that compensates for the absence of Cryptographic Management (CRY-03) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CHG-03", "name": "Configuration Change Control", "description": "Mechanisms exist to govern the technical configuration change control processes.", "justification": "Configuration Change Control (CHG-03) provides configuration hardening that compensates for the absence of Cryptographic Management (CRY-03) by eliminating unnecessary services and enforcing secure settings to reduce inherent exposure. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "CRY-03.1", "risk_if_not_implemented": "Without Alternate Physical Protection, unauthorized individuals may gain physical access to facilities and equipment, enabling theft, tampering, damage or safety incidents. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Long-Term Confidentiality Loss from Cryptographic Obsolescence (R-IP-1), Loss of Confidentiality (R-IP-2), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Harvest Now / Decrypt Later (HNDL) (MT-28), Cryptographic Compromise / Cryptanalytic Capability Advancement (MT-31).", "compensating_control_1": { "control_id": "CRY-10", "name": "Cryptographic Key Management", "description": "Mechanisms exist to facilitate cryptographic key management controls to protect the confidentiality, integrity and availability of keys.", "justification": "Cryptographic Key Management (CRY-10) provides cryptographic protection that compensates for the absence of Alternate Physical Protection (CRY-03.1) by ensuring data confidentiality and integrity through alternative technical means. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CRY-02", "name": "Use of Cryptographic Controls", "description": "Mechanisms exist to facilitate the implementation of cryptographic protections controls using known public standards and trusted cryptographic technologies.", "justification": "Use of Cryptographic Controls (CRY-02) provides cryptographic protection that compensates for the absence of Alternate Physical Protection (CRY-03.1) by ensuring data confidentiality and integrity through alternative technical means. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "CRY-03.2", "risk_if_not_implemented": "Without Pre/Post Transmission Handling, security, compliance and resilience activities may lack direction, ownership and executive support, leaving required controls unperformed. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Long-Term Confidentiality Loss from Cryptographic Obsolescence (R-IP-1), Loss of Confidentiality (R-IP-2), Loss of Data Integrity (R-IP-3), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Harvest Now / Decrypt Later (HNDL) (MT-28), Cryptographic Compromise / Cryptanalytic Capability Advancement (MT-31).", "compensating_control_1": { "control_id": "CFG-04", "name": "Secure Baseline Configurations", "description": "Mechanisms exist to develop, document and maintain secure baseline configurations for Technology Assets, Applications and/or Services (TAAS) that are consistent with industry-accepted hardening standards.", "justification": "Secure Baseline Configurations (CFG-04) provides configuration hardening that compensates for the absence of Pre/Post Transmission Handling (CRY-03.2) by eliminating unnecessary services and enforcing secure settings to reduce inherent exposure. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CRY-02", "name": "Use of Cryptographic Controls", "description": "Mechanisms exist to facilitate the implementation of cryptographic protections controls using known public standards and trusted cryptographic technologies.", "justification": "Use of Cryptographic Controls (CRY-02) provides cryptographic protection that compensates for the absence of Pre/Post Transmission Handling (CRY-03.2) by ensuring data confidentiality and integrity through alternative technical means. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "CRY-04", "risk_if_not_implemented": "Without Cryptographic Cipher Suites and Protocols Inventory, data in transit and at rest may be exposed through weak, misconfigured or compromised cryptographic protections. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unaddressed Security / Compliance Exposure (R-GV-2), Lack of oversight of internal controls (R-GV-6), Long-Term Confidentiality Loss from Cryptographic Obsolescence (R-IP-1), and most likely increases susceptibility to Human Error (MT-9), Data Quality Degradation / Data Poisoning (MT-12), Harvest Now / Decrypt Later (HNDL) (MT-28), Cryptographic Compromise / Cryptanalytic Capability Advancement (MT-31).", "compensating_control_1": { "control_id": "CRY-02", "name": "Use of Cryptographic Controls", "description": "Mechanisms exist to facilitate the implementation of cryptographic protections controls using known public standards and trusted cryptographic technologies.", "justification": "Use of Cryptographic Controls (CRY-02) provides cryptographic protection that compensates for the absence of Cryptographic Cipher Suites and Protocols Inventory (CRY-04) by ensuring data confidentiality and integrity through alternative technical means. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CRY-10", "name": "Cryptographic Key Management", "description": "Mechanisms exist to facilitate cryptographic key management controls to protect the confidentiality, integrity and availability of keys.", "justification": "Cryptographic Key Management (CRY-10) provides cryptographic protection that compensates for the absence of Cryptographic Cipher Suites and Protocols Inventory (CRY-04) by ensuring data confidentiality and integrity through alternative technical means. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "CRY-07.1", "risk_if_not_implemented": "Without Encrypting Storage Media, data in transit and at rest may be exposed through weak, misconfigured or compromised cryptographic protections. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Long-Term Confidentiality Loss from Cryptographic Obsolescence (R-IP-1), Loss of Confidentiality (R-IP-2), Loss of Data Integrity (R-IP-3), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Physical Crime (MT-5), Harvest Now / Decrypt Later (HNDL) (MT-28), Cryptographic Compromise / Cryptanalytic Capability Advancement (MT-31).", "compensating_control_1": { "control_id": "IAC-30", "name": "Least Privilege", "description": "Mechanisms exist to utilize the concept of least privilege, allowing only authorized access to processes necessary to accomplish assigned tasks in accordance with organizational business functions.", "justification": "Least Privilege (IAC-30) provides access control enforcement that compensates for the absence of Storage Media (CRY-07.1) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the data-handling focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CRY-10", "name": "Cryptographic Key Management", "description": "Mechanisms exist to facilitate cryptographic key management controls to protect the confidentiality, integrity and availability of keys.", "justification": "Cryptographic Key Management (CRY-10) provides cryptographic protection that compensates for the absence of Storage Media (CRY-07.1) by ensuring data confidentiality and integrity through alternative technical means. Given the data-handling focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "CRY-07.2", "risk_if_not_implemented": "Without Encrypting Offline Storage, data in transit and at rest may be exposed through weak, misconfigured or compromised cryptographic protections. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Retention / Inability to Dispose of Data (R-AM-3), and most likely increases susceptibility to Physical Crime (MT-5), Human Error (MT-9).", "compensating_control_1": { "control_id": "DCH-02", "name": "Data Protection", "description": "Mechanisms exist to facilitate the implementation of data protection controls.", "justification": "Data Protection (DCH-02) provides overlapping security capability that compensates for the absence of Offline Storage (CRY-07.2) by addressing related risk objectives through an alternative control mechanism aligned with Data applicability. Given the data-handling focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CRY-10", "name": "Cryptographic Key Management", "description": "Mechanisms exist to facilitate cryptographic key management controls to protect the confidentiality, integrity and availability of keys.", "justification": "Cryptographic Key Management (CRY-10) provides cryptographic protection that compensates for the absence of Offline Storage (CRY-07.2) by ensuring data confidentiality and integrity through alternative technical means. Given the data-handling focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "CRY-08", "risk_if_not_implemented": "Without Database Encryption, data in transit and at rest may be exposed through weak, misconfigured or compromised cryptographic protections. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Long-Term Confidentiality Loss from Cryptographic Obsolescence (R-IP-1), Loss of Confidentiality (R-IP-2), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Harvest Now / Decrypt Later (HNDL) (MT-28), Cryptographic Compromise / Cryptanalytic Capability Advancement (MT-31).", "compensating_control_1": { "control_id": "CRY-10", "name": "Cryptographic Key Management", "description": "Mechanisms exist to facilitate cryptographic key management controls to protect the confidentiality, integrity and availability of keys.", "justification": "Cryptographic Key Management (CRY-10) provides cryptographic protection that compensates for the absence of Database Encryption (CRY-08) by ensuring data confidentiality and integrity through alternative technical means. Given the data-handling focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "IAC-30", "name": "Least Privilege", "description": "Mechanisms exist to utilize the concept of least privilege, allowing only authorized access to processes necessary to accomplish assigned tasks in accordance with organizational business functions.", "justification": "Least Privilege (IAC-30) provides access control enforcement that compensates for the absence of Database Encryption (CRY-08) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the data-handling focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "CRY-09", "risk_if_not_implemented": "Without Public Key Infrastructure (PKI), data in transit and at rest may be exposed through weak, misconfigured or compromised cryptographic protections. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Identity Compromise / Impersonation (R-AC-5), Loss of Authenticity / Provenance (R-IP-5), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9), Cryptographic Compromise / Cryptanalytic Capability Advancement (MT-31).", "compensating_control_1": { "control_id": "CRY-10", "name": "Cryptographic Key Management", "description": "Mechanisms exist to facilitate cryptographic key management controls to protect the confidentiality, integrity and availability of keys.", "justification": "Cryptographic Key Management (CRY-10) provides cryptographic protection that compensates for the absence of Public Key Infrastructure (PKI) (CRY-09) by ensuring data confidentiality and integrity through alternative technical means. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CRY-02", "name": "Use of Cryptographic Controls", "description": "Mechanisms exist to facilitate the implementation of cryptographic protections controls using known public standards and trusted cryptographic technologies.", "justification": "Use of Cryptographic Controls (CRY-02) provides cryptographic protection that compensates for the absence of Public Key Infrastructure (PKI) (CRY-09) by ensuring data confidentiality and integrity through alternative technical means. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "CRY-09.1", "risk_if_not_implemented": "Without Public Key Infrastructure (PKI) Availability, data in transit and at rest may be exposed through weak, misconfigured or compromised cryptographic protections. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Data Loss / Integrity Compromise (R-BC-2), Recovery Failure / Unacceptable Recovery Delay (R-OR-1), Loss of Data / Service Availability (R-IP-4), and most likely increases susceptibility to Human Error (MT-9), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "CRY-02", "name": "Use of Cryptographic Controls", "description": "Mechanisms exist to facilitate the implementation of cryptographic protections controls using known public standards and trusted cryptographic technologies.", "justification": "Use of Cryptographic Controls (CRY-02) provides cryptographic protection that compensates for the absence of Availability (CRY-09.1) by ensuring data confidentiality and integrity through alternative technical means. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CRY-10", "name": "Cryptographic Key Management", "description": "Mechanisms exist to facilitate cryptographic key management controls to protect the confidentiality, integrity and availability of keys.", "justification": "Cryptographic Key Management (CRY-10) provides cryptographic protection that compensates for the absence of Availability (CRY-09.1) by ensuring data confidentiality and integrity through alternative technical means. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "CRY-10.1", "risk_if_not_implemented": "Without Symmetric Keys, data in transit and at rest may be exposed through weak, misconfigured or compromised cryptographic protections. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss of Confidentiality (R-IP-2), and most likely increases susceptibility to Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11), Harvest Now / Decrypt Later (HNDL) (MT-28), Cryptographic Compromise / Cryptanalytic Capability Advancement (MT-31).", "compensating_control_1": { "control_id": "IAC-14", "name": "Authenticator Management", "description": "Mechanisms exist to:\n(1) Securely manage authenticators for users and devices; and\n(2) Ensure the strength of authentication is appropriate to the classification of the data being accessed.", "justification": "Authenticator Management (IAC-14) provides access control enforcement that compensates for the absence of Symmetric Keys (CRY-10.1) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CRY-10", "name": "Cryptographic Key Management", "description": "Mechanisms exist to facilitate cryptographic key management controls to protect the confidentiality, integrity and availability of keys.", "justification": "Cryptographic Key Management (CRY-10) provides cryptographic protection that compensates for the absence of Symmetric Keys (CRY-10.1) by ensuring data confidentiality and integrity through alternative technical means. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "CRY-10.2", "risk_if_not_implemented": "Without Asymmetric Keys, data in transit and at rest may be exposed through weak, misconfigured or compromised cryptographic protections. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Identity Compromise / Impersonation (R-AC-5), Loss of Confidentiality (R-IP-2), Loss of Authenticity / Provenance (R-IP-5), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Technical / Mechanical Failure (MT-10), Harvest Now / Decrypt Later (HNDL) (MT-28), Cryptographic Compromise / Cryptanalytic Capability Advancement (MT-31).", "compensating_control_1": { "control_id": "CRY-10", "name": "Cryptographic Key Management", "description": "Mechanisms exist to facilitate cryptographic key management controls to protect the confidentiality, integrity and availability of keys.", "justification": "Cryptographic Key Management (CRY-10) provides cryptographic protection that compensates for the absence of Asymmetric Keys (CRY-10.2) by ensuring data confidentiality and integrity through alternative technical means. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CFG-02", "name": "Configuration Management Program", "description": "Mechanisms exist to facilitate the implementation of configuration management controls.", "justification": "Configuration Management Program (CFG-02) provides policy-level governance that compensates for the absence of Asymmetric Keys (CRY-10.2) by establishing documented expectations, accountability structures, and organizational guardrails. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "CRY-10.3", "risk_if_not_implemented": "Without Cryptographic Key Loss or Change, data in transit and at rest may be exposed through weak, misconfigured or compromised cryptographic protections. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Data Loss / Integrity Compromise (R-BC-2), Loss of Data / Service Availability (R-IP-4), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "CRY-02", "name": "Use of Cryptographic Controls", "description": "Mechanisms exist to facilitate the implementation of cryptographic protections controls using known public standards and trusted cryptographic technologies.", "justification": "Use of Cryptographic Controls (CRY-02) provides cryptographic protection that compensates for the absence of Cryptographic Key Loss or Change (CRY-10.3) by ensuring data confidentiality and integrity through alternative technical means. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CRY-10", "name": "Cryptographic Key Management", "description": "Mechanisms exist to facilitate cryptographic key management controls to protect the confidentiality, integrity and availability of keys.", "justification": "Cryptographic Key Management (CRY-10) provides cryptographic protection that compensates for the absence of Cryptographic Key Loss or Change (CRY-10.3) by ensuring data confidentiality and integrity through alternative technical means. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "CRY-10.4", "risk_if_not_implemented": "Without Control & Distribution of Cryptographic Keys, data in transit and at rest may be exposed through weak, misconfigured or compromised cryptographic protections. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Identity Compromise / Impersonation (R-AC-5), Loss of Confidentiality (R-IP-2), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Technical / Mechanical Failure (MT-10), Harvest Now / Decrypt Later (HNDL) (MT-28), Cryptographic Compromise / Cryptanalytic Capability Advancement (MT-31).", "compensating_control_1": { "control_id": "IAC-14", "name": "Authenticator Management", "description": "Mechanisms exist to:\n(1) Securely manage authenticators for users and devices; and\n(2) Ensure the strength of authentication is appropriate to the classification of the data being accessed.", "justification": "Authenticator Management (IAC-14) provides access control enforcement that compensates for the absence of Control & Distribution of Cryptographic Keys (CRY-10.4) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CRY-02", "name": "Use of Cryptographic Controls", "description": "Mechanisms exist to facilitate the implementation of cryptographic protections controls using known public standards and trusted cryptographic technologies.", "justification": "Use of Cryptographic Controls (CRY-02) provides cryptographic protection that compensates for the absence of Control & Distribution of Cryptographic Keys (CRY-10.4) by ensuring data confidentiality and integrity through alternative technical means. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "CRY-10.5", "risk_if_not_implemented": "Without Assigned Cryptographic Key Owners, data in transit and at rest may be exposed through weak, misconfigured or compromised cryptographic protections. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss of Accountability / Attribution (R-AC-1), Identity Compromise / Impersonation (R-AC-5), Loss of Authenticity / Provenance (R-IP-5), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "CRY-10", "name": "Cryptographic Key Management", "description": "Mechanisms exist to facilitate cryptographic key management controls to protect the confidentiality, integrity and availability of keys.", "justification": "Cryptographic Key Management (CRY-10) provides cryptographic protection that compensates for the absence of Assigned Owners (CRY-10.5) by ensuring data confidentiality and integrity through alternative technical means. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "IAC-14", "name": "Authenticator Management", "description": "Mechanisms exist to:\n(1) Securely manage authenticators for users and devices; and\n(2) Ensure the strength of authentication is appropriate to the classification of the data being accessed.", "justification": "Authenticator Management (IAC-14) provides access control enforcement that compensates for the absence of Assigned Owners (CRY-10.5) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "CRY-10.6", "risk_if_not_implemented": "Without Third-Party Cryptographic Keys, supplier and External Service Provider (ESP) weaknesses, incidents or failures may propagate into the organization's environment unmanaged. Based on the risk and threat mapping for this control, no risk is rated Likely; risks rated Possible include Unauthorized Access (R-AC-4), Identity Compromise / Impersonation (R-AC-5), Data Loss / Integrity Compromise (R-BC-2), and most likely increases susceptibility to Human Error (MT-9).", "compensating_control_1": { "control_id": "CRY-02", "name": "Use of Cryptographic Controls", "description": "Mechanisms exist to facilitate the implementation of cryptographic protections controls using known public standards and trusted cryptographic technologies.", "justification": "Use of Cryptographic Controls (CRY-02) provides cryptographic protection that compensates for the absence of Third-Party Cryptographic Keys (CRY-10.6) by ensuring data confidentiality and integrity through alternative technical means. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "IAC-14", "name": "Authenticator Management", "description": "Mechanisms exist to:\n(1) Securely manage authenticators for users and devices; and\n(2) Ensure the strength of authentication is appropriate to the classification of the data being accessed.", "justification": "Authenticator Management (IAC-14) provides access control enforcement that compensates for the absence of Third-Party Cryptographic Keys (CRY-10.6) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "CRY-10.7", "risk_if_not_implemented": "Without External System Cryptographic Key Control, data in transit and at rest may be exposed through weak, misconfigured or compromised cryptographic protections. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss of Confidentiality (R-IP-2), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Technical / Mechanical Failure (MT-10), Harvest Now / Decrypt Later (HNDL) (MT-28), Cryptographic Compromise / Cryptanalytic Capability Advancement (MT-31).", "compensating_control_1": { "control_id": "IAC-14", "name": "Authenticator Management", "description": "Mechanisms exist to:\n(1) Securely manage authenticators for users and devices; and\n(2) Ensure the strength of authentication is appropriate to the classification of the data being accessed.", "justification": "Authenticator Management (IAC-14) provides access control enforcement that compensates for the absence of External System Cryptographic Key Control (CRY-10.7) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CFG-02", "name": "Configuration Management Program", "description": "Mechanisms exist to facilitate the implementation of configuration management controls.", "justification": "Configuration Management Program (CFG-02) provides policy-level governance that compensates for the absence of External System Cryptographic Key Control (CRY-10.7) by establishing documented expectations, accountability structures, and organizational guardrails. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "CRY-11", "risk_if_not_implemented": "Without Transmission of Cybersecurity & Data Protection Attributes, sensitive and/or regulated data may be disclosed, altered or lost through inadequate classification, handling or protection. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss of Authenticity / Provenance (R-IP-5), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "MON-02", "name": "Continuous Monitoring", "description": "Mechanisms exist to facilitate the implementation of enterprise-wide monitoring controls.", "justification": "Continuous Monitoring (MON-02) provides detective monitoring capability that compensates for the absence of Transmission of Cybersecurity & Data Protection Attributes (CRY-11) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CRY-05", "name": "Encrypting Data In Transit", "description": "Cryptographic mechanisms exist to prevent the unauthorized disclosure of data in transit.", "justification": "Encrypting Data In Transit (CRY-05) provides cryptographic protection that compensates for the absence of Transmission of Cybersecurity & Data Protection Attributes (CRY-11) by ensuring data confidentiality and integrity through alternative technical means. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "CRY-12", "risk_if_not_implemented": "Without Certificate Authorities, data in transit and at rest may be exposed through weak, misconfigured or compromised cryptographic protections. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Identity Compromise / Impersonation (R-AC-5), Loss of Confidentiality (R-IP-2), Loss of Authenticity / Provenance (R-IP-5), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Technical / Mechanical Failure (MT-10), Harvest Now / Decrypt Later (HNDL) (MT-28), Cryptographic Compromise / Cryptanalytic Capability Advancement (MT-31).", "compensating_control_1": { "control_id": "CRY-10", "name": "Cryptographic Key Management", "description": "Mechanisms exist to facilitate cryptographic key management controls to protect the confidentiality, integrity and availability of keys.", "justification": "Cryptographic Key Management (CRY-10) provides cryptographic protection that compensates for the absence of Certificate Authorities (CRY-12) by ensuring data confidentiality and integrity through alternative technical means. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CRY-09", "name": "Public Key Infrastructure (PKI)", "description": "Mechanisms exist to securely implement an internal Public Key Infrastructure (PKI) infrastructure or obtain PKI services from a reputable PKI service provider.", "justification": "Public Key Infrastructure (PKI) (CRY-09) provides overlapping security capability that compensates for the absence of Certificate Authorities (CRY-12) by addressing related risk objectives through an alternative control mechanism aligned with Technology applicability. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "CRY-13", "risk_if_not_implemented": "Without Certificate Monitoring, data in transit and at rest may be exposed through weak, misconfigured or compromised cryptographic protections. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Undetected / Delayed Detection of Adverse Activity (R-SA-1), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "MON-02", "name": "Continuous Monitoring", "description": "Mechanisms exist to facilitate the implementation of enterprise-wide monitoring controls.", "justification": "Continuous Monitoring (MON-02) provides detective monitoring capability that compensates for the absence of Certificate Monitoring (CRY-13) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CRY-12", "name": "Certificate Authorities", "description": "Automated mechanisms exist to enable the use of organization-defined Certificate Authorities (CAs) to facilitate the establishment of protected sessions.", "justification": "Certificate Authorities (CRY-13) provides overlapping security capability that compensates for the absence of Certificate Monitoring (CRY-13) by addressing related risk objectives through an alternative control mechanism aligned with Technology applicability. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "CRY-14", "risk_if_not_implemented": "Without Cryptographic Hash, data in transit and at rest may be exposed through weak, misconfigured or compromised cryptographic protections. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Modification / Loss of System Integrity (R-AM-2), Loss of Data Integrity (R-IP-3), Loss of Authenticity / Provenance (R-IP-5), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Technical / Mechanical Failure (MT-10), Cryptographic Compromise / Cryptanalytic Capability Advancement (MT-31).", "compensating_control_1": { "control_id": "CRY-06", "name": "Integrity of Data In Transit", "description": "Cryptographic mechanisms exist to detect unauthorized changes to data in transit.", "justification": "Integrity of Data In Transit (CRY-06) provides cryptographic protection that compensates for the absence of Cryptographic Hash (CRY-14) by ensuring data confidentiality and integrity through alternative technical means. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "MON-34", "name": "Non-Repudiation", "description": "Mechanisms exist to utilize a non-repudiation capability to protect against an individual falsely denying having performed a particular action.", "justification": "Non-Repudiation (MON-34) provides overlapping security capability that compensates for the absence of Cryptographic Hash (CRY-14) by addressing related risk objectives through an alternative control mechanism aligned with Technology applicability. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "CRY-15", "risk_if_not_implemented": "Without Export-Controlled Cryptography, data in transit and at rest may be exposed through weak, misconfigured or compromised cryptographic protections. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Regulatory / Legal / Contractual Financial Liability (R-EX-5), and most likely increases susceptibility to Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11), Sanctions / Trade Restriction Disruption (MT-19).", "compensating_control_1": { "control_id": "CRY-02", "name": "Use of Cryptographic Controls", "description": "Mechanisms exist to facilitate the implementation of cryptographic protections controls using known public standards and trusted cryptographic technologies.", "justification": "Use of Cryptographic Controls (CRY-02) provides cryptographic protection that compensates for the absence of Export-Controlled Cryptography (CRY-15) by ensuring data confidentiality and integrity through alternative technical means. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CFG-04", "name": "Secure Baseline Configurations", "description": "Mechanisms exist to develop, document and maintain secure baseline configurations for Technology Assets, Applications and/or Services (TAAS) that are consistent with industry-accepted hardening standards.", "justification": "Secure Baseline Configurations (CFG-04) provides configuration hardening that compensates for the absence of Export-Controlled Cryptography (CRY-15) by eliminating unnecessary services and enforcing secure settings to reduce inherent exposure. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "DCH-03", "risk_if_not_implemented": "Without Sensitive / Regulated Data Governance, sensitive and/or regulated data may be disclosed, altered or lost through inadequate classification, handling or protection. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Regulatory / Legal / Contractual Financial Liability (R-EX-5), Unaddressed Security / Compliance Exposure (R-GV-2), Inability to Demonstrate Due Diligence / Due Care (R-GV-9), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11).", "compensating_control_1": { "control_id": "DCH-02", "name": "Data Protection", "description": "Mechanisms exist to facilitate the implementation of data protection controls.", "justification": "Data Protection (DCH-02) provides overlapping security capability that compensates for the absence of Data Governance (DCH-03) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "PRI-02", "name": "Data Privacy Program", "description": "Mechanisms exist to facilitate the implementation and operation of data protection controls throughout the data lifecycle to ensure all forms of Personal Data (PD) are processed lawfully, fairly and transparently.", "justification": "Data Privacy Program (PRI-02) provides policy-level governance that compensates for the absence of Data Governance (DCH-03) by establishing documented expectations, accountability structures, and organizational guardrails. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "DCH-03.1", "risk_if_not_implemented": "Without Data Catalog, sensitive and/or regulated data may be disclosed, altered or lost through inadequate classification, handling or protection. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Retention / Inability to Dispose of Data (R-AM-3), Unaddressed Security / Compliance Exposure (R-GV-2), and most likely increases susceptibility to Human Error (MT-9), Data Quality Degradation / Data Poisoning (MT-12).", "compensating_control_1": { "control_id": "DCH-29", "name": "Logical Data Location", "description": "Mechanisms exist to identify and document the logical location of data and the specific Technology Assets, Applications and/or Services (TAAS) on which the data resides.", "justification": "Logical Data Location (DCH-29) provides overlapping security capability that compensates for the absence of Data Catalog (DCH-03.1) by addressing related risk objectives through an alternative control mechanism. Given the data-handling focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "DCH-04", "name": "Data & Asset Classification", "description": "Mechanisms exist to ensure data and assets are categorized in accordance with applicable statutory, regulatory and contractual requirements.", "justification": "Data & Asset Classification (DCH-04) provides asset and inventory visibility that compensates for the absence of Data Catalog (DCH-03.1) by providing the foundational asset knowledge needed to manage risks associated with the primary control. Given the data-handling focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "DCH-04.1", "risk_if_not_implemented": "Without Highest Classification Level, sensitive and/or regulated data may be disclosed, altered or lost through inadequate classification, handling or protection. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unaddressed Security / Compliance Exposure (R-GV-2), and most likely increases susceptibility to Human Error (MT-9).", "compensating_control_1": { "control_id": "AST-15", "name": "Asset Categorization", "description": "Mechanisms exist to categorize Technology Assets, Applications and/or Services (TAAS).", "justification": "Asset Categorization (AST-15) provides overlapping security capability that compensates for the absence of Highest Classification Level (DCH-04.1) by addressing related risk objectives through an alternative control mechanism aligned with Data applicability. Given the data-handling focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "DCH-04", "name": "Data & Asset Classification", "description": "Mechanisms exist to ensure data and assets are categorized in accordance with applicable statutory, regulatory and contractual requirements.", "justification": "Data & Asset Classification (DCH-04) provides overlapping security capability that compensates for the absence of Highest Classification Level (DCH-04.1) by addressing related risk objectives through an alternative control mechanism aligned with Data applicability. Given the data-handling focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "DCH-04.2", "risk_if_not_implemented": "Without Data Reclassification, sensitive and/or regulated data may be disclosed, altered or lost through inadequate classification, handling or protection. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unaddressed Security / Compliance Exposure (R-GV-2), and most likely increases susceptibility to Human Error (MT-9).", "compensating_control_1": { "control_id": "DCH-04", "name": "Data & Asset Classification", "description": "Mechanisms exist to ensure data and assets are categorized in accordance with applicable statutory, regulatory and contractual requirements.", "justification": "Data & Asset Classification (DCH-04) provides overlapping security capability that compensates for the absence of Data Reclassification (DCH-04.2) by addressing related risk objectives through an alternative control mechanism aligned with Data applicability. Given the data-handling focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "DCH-03", "name": "Sensitive / Regulated Data Governance", "description": "Mechanisms exist to facilitate data governance so that sensitive and/or regulated data is effectively managed and maintained in accordance with applicable statutory, regulatory and contractual obligations.", "justification": "Sensitive / Regulated Data Governance (DCH-03) provides policy-level governance that compensates for the absence of Data Reclassification (DCH-04.2) by establishing documented expectations, accountability structures, and organizational guardrails. Given the data-handling focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "DCH-05", "risk_if_not_implemented": "Without Sensitive Data Inventories, sensitive and/or regulated data may be disclosed, altered or lost through inadequate classification, handling or protection. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss, Theft or Damage of Assets (R-AM-1), Unauthorized Retention / Inability to Dispose of Data (R-AM-3), and most likely increases susceptibility to Physical Crime (MT-5), Human Error (MT-9).", "compensating_control_1": { "control_id": "PES-08", "name": "Physical Access Control", "description": "Physical access control mechanisms exist to enforce physical access authorizations for all physical access points (including designated entry/exit points) to facilities (excluding those areas within the facility officially designated as publicly accessible).", "justification": "Physical Access Control (PES-08) provides access control enforcement that compensates for the absence of Sensitive Data Inventories (DCH-05) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the data-handling focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CRY-07", "name": "Encrypting Data At Rest", "description": "Cryptographic mechanisms exist to prevent the unauthorized disclosure of data at rest.", "justification": "Encrypting Data At Rest (CRY-07) provides cryptographic protection that compensates for the absence of Sensitive Data Inventories (DCH-05) by ensuring data confidentiality and integrity through alternative technical means. Given the data-handling focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "DCH-05.1", "risk_if_not_implemented": "Without Periodic Scans for Sensitive / Regulated Data, sensitive and/or regulated data may be disclosed, altered or lost through inadequate classification, handling or protection. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Retention / Inability to Dispose of Data (R-AM-3), Unaddressed Security / Compliance Exposure (R-GV-2), and most likely increases susceptibility to Human Error (MT-9), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "CRY-07", "name": "Encrypting Data At Rest", "description": "Cryptographic mechanisms exist to prevent the unauthorized disclosure of data at rest.", "justification": "Encrypting Data At Rest (CRY-07) provides cryptographic protection that compensates for the absence of Periodic Scans for Sensitive / Regulated Data (DCH-05.1) by ensuring data confidentiality and integrity through alternative technical means. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "DCH-13", "name": "Media Storage", "description": "Mechanisms exist to: \n(1) Physically control and securely store digital and non-digital media within controlled areas using organization-defined security measures; and\n(2) Protect system media until the media are destroyed or sanitized using approved equipment, techniques and procedures.", "justification": "Media Storage (DCH-13) provides overlapping security capability that compensates for the absence of Periodic Scans for Sensitive / Regulated Data (DCH-05.1) by addressing related risk objectives through an alternative control mechanism aligned with Technology applicability. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "DCH-06.1", "risk_if_not_implemented": "Without Defining Access Authorizations for Sensitive / Regulated Data, sensitive and/or regulated data may be disclosed, altered or lost through inadequate classification, handling or protection. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Excessive or Unauthorized Privilege (R-AC-2), Unauthorized Access (R-AC-4), and most likely increases susceptibility to Human Error (MT-9).", "compensating_control_1": { "control_id": "CRY-05", "name": "Encrypting Data In Transit", "description": "Cryptographic mechanisms exist to prevent the unauthorized disclosure of data in transit.", "justification": "Encrypting Data In Transit (CRY-05) provides cryptographic protection that compensates for the absence of Defining Access Authorizations for Sensitive / Regulated Data (DCH-06.1) by ensuring data confidentiality and integrity through alternative technical means. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CRY-07", "name": "Encrypting Data At Rest", "description": "Cryptographic mechanisms exist to prevent the unauthorized disclosure of data at rest.", "justification": "Encrypting Data At Rest (CRY-07) provides cryptographic protection that compensates for the absence of Defining Access Authorizations for Sensitive / Regulated Data (DCH-06.1) by ensuring data confidentiality and integrity through alternative technical means. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "DCH-07", "risk_if_not_implemented": "Without Sensitive / Regulated Data Protection, sensitive and/or regulated data may be disclosed, altered or lost through inadequate classification, handling or protection. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss of Confidentiality (R-IP-2), Loss of Data Integrity (R-IP-3), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9).", "compensating_control_1": { "control_id": "IAC-30", "name": "Least Privilege", "description": "Mechanisms exist to utilize the concept of least privilege, allowing only authorized access to processes necessary to accomplish assigned tasks in accordance with organizational business functions.", "justification": "Least Privilege (IAC-30) provides access control enforcement that compensates for the absence of Sensitive / Regulated Data Protection (DCH-07) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the data-handling focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CRY-05", "name": "Encrypting Data In Transit", "description": "Cryptographic mechanisms exist to prevent the unauthorized disclosure of data in transit.", "justification": "Encrypting Data In Transit (CRY-05) provides cryptographic protection that compensates for the absence of Sensitive / Regulated Data Protection (DCH-07) by ensuring data confidentiality and integrity through alternative technical means. Given the data-handling focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "DCH-07.1", "risk_if_not_implemented": "Without Restrict Sensitive / Regulated Data Access To Authorized Individuals, sensitive and/or regulated data may be disclosed, altered or lost through inadequate classification, handling or protection. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Access (R-AC-4), Loss of Confidentiality (R-IP-2), and most likely increases susceptibility to Physical Crime (MT-5), Human Error (MT-9).", "compensating_control_1": { "control_id": "IAC-25", "name": "Access Enforcement", "description": "Mechanisms exist to enforce Logical Access Control (LAC) permissions that conform to the principle of \"least privilege.\"", "justification": "Access Enforcement (IAC-25) provides access control enforcement that compensates for the absence of Media Access (DCH-07.1) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the data-handling focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "PES-08", "name": "Physical Access Control", "description": "Physical access control mechanisms exist to enforce physical access authorizations for all physical access points (including designated entry/exit points) to facilities (excluding those areas within the facility officially designated as publicly accessible).", "justification": "Physical Access Control (PES-08) provides access control enforcement that compensates for the absence of Media Access (DCH-07.1) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the data-handling focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "DCH-08.1", "risk_if_not_implemented": "Without Sensitive / Regulated Data Sharing Decisions, sensitive and/or regulated data may be disclosed, altered or lost through inadequate classification, handling or protection. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Lack of a security-minded workforce (R-SA-2), Loss of Confidentiality (R-IP-2), and most likely increases susceptibility to Human Error (MT-9).", "compensating_control_1": { "control_id": "TPM-14", "name": "Third-Party Contract Requirements", "description": "Mechanisms exist to require contractual requirements for applicable security, compliance and resilience requirements with third-parties, reflecting the organization's needs to protect its Technology Assets, Applications, Services and/or Data (TAASD).", "justification": "Third-Party Contract Requirements (TPM-14) provides third-party oversight that compensates for the absence of Information Sharing (DCH-08.1) by extending security obligations contractually and monitoring third-party risk in lieu of direct control. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CRY-05", "name": "Encrypting Data In Transit", "description": "Cryptographic mechanisms exist to prevent the unauthorized disclosure of data in transit.", "justification": "Encrypting Data In Transit (CRY-05) provides cryptographic protection that compensates for the absence of Information Sharing (DCH-08.1) by ensuring data confidentiality and integrity through alternative technical means. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "DCH-08.3", "risk_if_not_implemented": "Without Controlled Release of Sensitive / Regulated Data, sensitive and/or regulated data may be disclosed, altered or lost through inadequate classification, handling or protection. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss of Confidentiality (R-IP-2), and most likely increases susceptibility to Technical / Mechanical Failure (MT-10), Data Quality Degradation / Data Poisoning (MT-12).", "compensating_control_1": { "control_id": "IAC-25", "name": "Access Enforcement", "description": "Mechanisms exist to enforce Logical Access Control (LAC) permissions that conform to the principle of \"least privilege.\"", "justification": "Access Enforcement (IAC-25) provides access control enforcement that compensates for the absence of Controlled Release (DCH-08.3) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "DCH-07.1", "name": "Restrict Sensitive / Regulated Data Access To Authorized Individuals", "description": "Mechanisms exist to control and restrict access to sensitive and/or regulated data on digital and non-digital media formats to authorized individuals.", "justification": "Restrict Sensitive / Regulated Data Access To Authorized Individuals (DCH-07.1) provides access control enforcement that compensates for the absence of Controlled Release (DCH-08.3) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "DCH-08.4", "risk_if_not_implemented": "Without Sensitive / Regulated Data Release Sanitization, sensitive and/or regulated data may be retained beyond authorized periods or recovered from improperly disposed media and equipment. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss of Confidentiality (R-IP-2), Privacy Harm / Unauthorized Processing (R-IP-6), and most likely increases susceptibility to Human Error (MT-9).", "compensating_control_1": { "control_id": "DCH-36", "name": "De-Identification (Anonymization)", "description": "Mechanisms exist to de-identify sensitive and/or regulated data through\n(1) Anonymization;\n(2) De-identification;\n(3) Pseudonymization; and/or\n(4) Redaction.", "justification": "De-Identification (Anonymization) (DCH-36) provides overlapping security capability that compensates for the absence of Release (DCH-08.4) by addressing related risk objectives through an alternative control mechanism aligned with Data applicability. Given the data-handling focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "DCH-02", "name": "Data Protection", "description": "Mechanisms exist to facilitate the implementation of data protection controls.", "justification": "Data Protection (DCH-02) provides overlapping security capability that compensates for the absence of Release (DCH-08.4) by addressing related risk objectives through an alternative control mechanism aligned with Data applicability. Given the data-handling focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "DCH-09", "risk_if_not_implemented": "Without Sensitive / Regulated Data Access Mapping, sensitive and/or regulated data may be disclosed, altered or lost through inadequate classification, handling or protection. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unaddressed Security / Compliance Exposure (R-GV-2), Uncontrolled Third-Party Security / Privacy Exposure (R-GV-5), and most likely increases susceptibility to Human Error (MT-9), Data Quality Degradation / Data Poisoning (MT-12).", "compensating_control_1": { "control_id": "CRY-05", "name": "Encrypting Data In Transit", "description": "Cryptographic mechanisms exist to prevent the unauthorized disclosure of data in transit.", "justification": "Encrypting Data In Transit (CRY-05) provides cryptographic protection that compensates for the absence of Data Access Mapping (DCH-09) by ensuring data confidentiality and integrity through alternative technical means. Given the data-handling focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "DCH-08.1", "name": "Sensitive / Regulated Data Sharing Decisions", "description": "Mechanisms exist to utilize a process to assist users in making information sharing decisions to ensure data is appropriately protected.", "justification": "Sensitive / Regulated Data Sharing Decisions (DCH-08.1) provides overlapping security capability that compensates for the absence of Data Access Mapping (DCH-09) by addressing related risk objectives through an alternative control mechanism aligned with Data applicability. Given the data-handling focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "DCH-10", "risk_if_not_implemented": "Without Sensitive / Regulated Media Records, sensitive and/or regulated data may be disclosed, altered or lost through inadequate classification, handling or protection. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss of Investigative / Evidentiary Capability (R-IR-1), and most likely increases susceptibility to Human Error (MT-9), Data Quality Degradation / Data Poisoning (MT-12).", "compensating_control_1": { "control_id": "IAC-25", "name": "Access Enforcement", "description": "Mechanisms exist to enforce Logical Access Control (LAC) permissions that conform to the principle of \"least privilege.\"", "justification": "Access Enforcement (IAC-25) provides access control enforcement that compensates for the absence of Sensitive / Regulated Media Records (DCH-10) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the data-handling focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CRY-07", "name": "Encrypting Data At Rest", "description": "Cryptographic mechanisms exist to prevent the unauthorized disclosure of data at rest.", "justification": "Encrypting Data At Rest (CRY-07) provides cryptographic protection that compensates for the absence of Sensitive / Regulated Media Records (DCH-10) by ensuring data confidentiality and integrity through alternative technical means. Given the data-handling focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "DCH-11", "risk_if_not_implemented": "Without Media Marking, sensitive and/or regulated data may be disclosed, altered or lost through inadequate classification, handling or protection. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Lack of a security-minded workforce (R-SA-2), and most likely increases susceptibility to Human Error (MT-9).", "compensating_control_1": { "control_id": "DCH-04", "name": "Data & Asset Classification", "description": "Mechanisms exist to ensure data and assets are categorized in accordance with applicable statutory, regulatory and contractual requirements.", "justification": "Data & Asset Classification (DCH-11) provides overlapping security capability that compensates for the absence of Media Marking (DCH-11) by addressing related risk objectives through an alternative control mechanism aligned with Data applicability. Given the data-handling focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "DCH-37", "name": "Cybersecurity & Data Protection Attributes", "description": "Mechanisms exist to bind cybersecurity and data protection attributes to information as it is stored, transmitted and processed.", "justification": "Cybersecurity & Data Protection Attributes (DCH-37) provides overlapping security capability that compensates for the absence of Media Marking (DCH-11) by addressing related risk objectives through an alternative control mechanism aligned with Data applicability. Given the data-handling focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "DCH-11.1", "risk_if_not_implemented": "Without Automated Marking, sensitive and/or regulated data may be disclosed, altered or lost through inadequate classification, handling or protection. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Lack of a security-minded workforce (R-SA-2), and most likely increases susceptibility to Technical / Mechanical Failure (MT-10), Data Quality Degradation / Data Poisoning (MT-12).", "compensating_control_1": { "control_id": "DCH-04", "name": "Data & Asset Classification", "description": "Mechanisms exist to ensure data and assets are categorized in accordance with applicable statutory, regulatory and contractual requirements.", "justification": "Data & Asset Classification (DCH-04) provides overlapping security capability that compensates for the absence of Automated Marking (DCH-11.1) by addressing related risk objectives through an alternative control mechanism aligned with Technology applicability. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "AST-15", "name": "Asset Categorization", "description": "Mechanisms exist to categorize Technology Assets, Applications and/or Services (TAAS).", "justification": "Asset Categorization (AST-15) provides overlapping security capability that compensates for the absence of Automated Marking (DCH-11.1) by addressing related risk objectives through an alternative control mechanism aligned with Technology applicability. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "DCH-12", "risk_if_not_implemented": "Without Masking Displayed Sensitive / Regulated Data, inaccurate, stale, corrupted or manipulated data may drive flawed decisions and control failures. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss of Confidentiality (R-IP-2). No threat is rated Likely for this control; threats rated Possible include Malicious Cyber Activity (MT-2), Dysfunctional Management Practices (MT-8), Human Error (MT-9).", "compensating_control_1": { "control_id": "PES-08", "name": "Physical Access Control", "description": "Physical access control mechanisms exist to enforce physical access authorizations for all physical access points (including designated entry/exit points) to facilities (excluding those areas within the facility officially designated as publicly accessible).", "justification": "Physical Access Control (PES-08) provides access control enforcement that compensates for the absence of Masking Displayed Data (DCH-12) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the data-handling focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "IAC-25", "name": "Access Enforcement", "description": "Mechanisms exist to enforce Logical Access Control (LAC) permissions that conform to the principle of \"least privilege.\"", "justification": "Access Enforcement (IAC-25) provides access control enforcement that compensates for the absence of Masking Displayed Data (DCH-12) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the data-handling focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "DCH-12.1", "risk_if_not_implemented": "Without Making Sensitive / Regulated Data Unreadable In Storage, sensitive and/or regulated data may be disclosed, altered or lost through inadequate classification, handling or protection. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Long-Term Confidentiality Loss from Cryptographic Obsolescence (R-IP-1), Loss of Confidentiality (R-IP-2), and most likely increases susceptibility to Harvest Now / Decrypt Later (HNDL) (MT-28), Cryptographic Compromise / Cryptanalytic Capability Advancement (MT-31).", "compensating_control_1": { "control_id": "PES-02", "name": "Physical & Environmental Protections", "description": "Mechanisms exist to facilitate the operation of physical and environmental protection controls.", "justification": "Physical & Environmental Protections (PES-02) provides physical access control that compensates for the absence of Making Sensitive Data Unreadable In Storage (DCH-12.1) by preventing unauthorized physical interaction with systems and infrastructure. Given the data-handling focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "DCH-13", "name": "Media Storage", "description": "Mechanisms exist to: \n(1) Physically control and securely store digital and non-digital media within controlled areas using organization-defined security measures; and\n(2) Protect system media until the media are destroyed or sanitized using approved equipment, techniques and procedures.", "justification": "Media Storage (DCH-13) provides overlapping security capability that compensates for the absence of Making Sensitive Data Unreadable In Storage (DCH-12.1) by addressing related risk objectives through an alternative control mechanism aligned with Data applicability. Given the data-handling focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "DCH-13", "risk_if_not_implemented": "Without Media Storage, sensitive and/or regulated data may be disclosed, altered or lost through inadequate classification, handling or protection. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Access (R-AC-4), Loss, Theft or Damage of Assets (R-AM-1), Unauthorized Retention / Inability to Dispose of Data (R-AM-3), Loss of Confidentiality (R-IP-2), and most likely increases susceptibility to natural threats NT-2, NT-3, NT-4, NT-5, NT-6, NT-8, NT-11, NT-12, NT-13, NT-14; Physical Crime (MT-5), Human Error (MT-9).", "compensating_control_1": { "control_id": "PES-02", "name": "Physical & Environmental Protections", "description": "Mechanisms exist to facilitate the operation of physical and environmental protection controls.", "justification": "Physical & Environmental Protections (PES-02) provides physical access control that compensates for the absence of Media Storage (DCH-13) by preventing unauthorized physical interaction with systems and infrastructure. Given the data-handling focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CRY-07", "name": "Encrypting Data At Rest", "description": "Cryptographic mechanisms exist to prevent the unauthorized disclosure of data at rest.", "justification": "Encrypting Data At Rest (CRY-07) provides cryptographic protection that compensates for the absence of Media Storage (DCH-13) by ensuring data confidentiality and integrity through alternative technical means. Given the data-handling focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "DCH-13.1", "risk_if_not_implemented": "Without Data Storage Location Reviews, sensitive and/or regulated data may be disclosed, altered or lost through inadequate classification, handling or protection. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unaddressed Security / Compliance Exposure (R-GV-2), Lack of oversight of internal controls (R-GV-6), Inability to Demonstrate Due Diligence / Due Care (R-GV-9), Undetected / Delayed Detection of Adverse Activity (R-SA-1), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9).", "compensating_control_1": { "control_id": "RSK-13", "name": "Risk Assessment", "description": "Mechanisms exist to conduct recurring assessments of risk that includes the likelihood and magnitude of harm, from unauthorized access, use, disclosure, disruption, modification or destruction of the organization's Technology Assets, Applications, Services and/or Data (TAASD).", "justification": "Risk Assessment (RSK-13) provides periodic assessment and assurance that compensates for the absence of Data Storage Location Reviews (DCH-13.1) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "AST-05", "name": "Identify Critical Assets", "description": "Mechanisms exist to identify and document the critical Technology Assets, Applications, Services and/or Data (TAASD) that support essential missions and business functions.", "justification": "Identify Critical Assets (AST-05) provides overlapping security capability that compensates for the absence of Data Storage Location Reviews (DCH-13.1) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "DCH-14", "risk_if_not_implemented": "Without Physically Secure All Media Containing Sensitive / Regulated Data, unauthorized individuals may gain physical access to facilities and equipment, enabling theft, tampering, damage or safety incidents. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Access (R-AC-4), Loss, Theft or Damage of Assets (R-AM-1), System / Data Compromise (Non-Technical Vector) (R-BC-5), Loss of Confidentiality (R-IP-2), and most likely increases susceptibility to natural threats NT-2, NT-3, NT-4, NT-5, NT-6, NT-8, NT-11, NT-12, NT-13, NT-14; Physical Crime (MT-5), Human Error (MT-9).", "compensating_control_1": { "control_id": "CRY-07", "name": "Encrypting Data At Rest", "description": "Cryptographic mechanisms exist to prevent the unauthorized disclosure of data at rest.", "justification": "Encrypting Data At Rest (CRY-07) provides cryptographic protection that compensates for the absence of Physically Secure All Media (DCH-14) by ensuring data confidentiality and integrity through alternative technical means. Given the data-handling focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "PES-08", "name": "Physical Access Control", "description": "Physical access control mechanisms exist to enforce physical access authorizations for all physical access points (including designated entry/exit points) to facilities (excluding those areas within the facility officially designated as publicly accessible).", "justification": "Physical Access Control (PES-08) provides access control enforcement that compensates for the absence of Physically Secure All Media (DCH-14) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the data-handling focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "DCH-15", "risk_if_not_implemented": "Without Storing Authentication Data, credentials may be phished, replayed, guessed or stolen, allowing unauthorized actors to authenticate as trusted identities. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Retention / Inability to Dispose of Data (R-AM-3), Regulatory / Legal / Contractual Financial Liability (R-EX-5), and most likely increases susceptibility to Human Error (MT-9).", "compensating_control_1": { "control_id": "DCH-13", "name": "Media Storage", "description": "Mechanisms exist to: \n(1) Physically control and securely store digital and non-digital media within controlled areas using organization-defined security measures; and\n(2) Protect system media until the media are destroyed or sanitized using approved equipment, techniques and procedures.", "justification": "Media Storage (DCH-13) provides overlapping security capability that compensates for the absence of Storing Authentication Data (DCH-15) by addressing related risk objectives through an alternative control mechanism aligned with Data applicability. Given the data-handling focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CRY-07", "name": "Encrypting Data At Rest", "description": "Cryptographic mechanisms exist to prevent the unauthorized disclosure of data at rest.", "justification": "Encrypting Data At Rest (CRY-07) provides cryptographic protection that compensates for the absence of Storing Authentication Data (DCH-15) by ensuring data confidentiality and integrity through alternative technical means. Given the data-handling focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "DCH-16", "risk_if_not_implemented": "Without Media Transportation, sensitive and/or regulated data may be disclosed, altered or lost through inadequate classification, handling or protection. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Access (R-AC-4), Loss, Theft or Damage of Assets (R-AM-1), System / Data Compromise (Non-Technical Vector) (R-BC-5), Loss of Confidentiality (R-IP-2), and most likely increases susceptibility to Physical Crime (MT-5), Human Error (MT-9), Transportation / Logistics Disruption (MT-26).", "compensating_control_1": { "control_id": "CRY-05", "name": "Encrypting Data In Transit", "description": "Cryptographic mechanisms exist to prevent the unauthorized disclosure of data in transit.", "justification": "Encrypting Data In Transit (CRY-05) provides cryptographic protection that compensates for the absence of Media Transportation (DCH-16) by ensuring data confidentiality and integrity through alternative technical means. Given the data-handling focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "MON-36.1", "name": "Cross-Organizational Monitoring", "description": "Mechanisms exist to coordinate sanitized event logs and security-relevant telemetry among external organizations to identify anomalous events when that data is shared across organizational boundaries, without giving away sensitive or critical business data.", "justification": "Cross-Organizational Monitoring (MON-36.1) provides detective monitoring capability that compensates for the absence of Media Transportation (DCH-16) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the data-handling focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "DCH-16.1", "risk_if_not_implemented": "Without Media Transportation Custodians, sensitive and/or regulated data may be disclosed, altered or lost through inadequate classification, handling or protection. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss of Accountability / Attribution (R-AC-1), Loss of Investigative / Evidentiary Capability (R-IR-1), Loss of Authenticity / Provenance (R-IP-5), and most likely increases susceptibility to Human Error (MT-9).", "compensating_control_1": { "control_id": "CRY-05", "name": "Encrypting Data In Transit", "description": "Cryptographic mechanisms exist to prevent the unauthorized disclosure of data in transit.", "justification": "Encrypting Data In Transit (CRY-05) provides cryptographic protection that compensates for the absence of Custodians (DCH-16.1) by ensuring data confidentiality and integrity through alternative technical means. Given the data-handling focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "NET-05", "name": "Interconnection Security Agreements (ISAs)", "description": "Mechanisms exist to authorize connections from systems to other systems using Interconnection Security Agreements (ISAs), or similar methods, that document, for each interconnection:\n(1) Interface characteristics;\n(2) Security, compliance and resilience requirements; and;\n(3) The nature of the information communicated.", "justification": "Interconnection Security Agreements (ISAs) (NET-05) provides overlapping security capability that compensates for the absence of Custodians (DCH-16.1) by addressing related risk objectives through an alternative control mechanism aligned with Data applicability. Given the data-handling focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "DCH-16.2", "risk_if_not_implemented": "Without Encrypting Data Outside of Controlled Areas, data in transit and at rest may be exposed through weak, misconfigured or compromised cryptographic protections. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Long-Term Confidentiality Loss from Cryptographic Obsolescence (R-IP-1), Loss of Confidentiality (R-IP-2), Loss of Data Integrity (R-IP-3), and most likely increases susceptibility to Human Error (MT-9), Harvest Now / Decrypt Later (HNDL) (MT-28), Cryptographic Compromise / Cryptanalytic Capability Advancement (MT-31).", "compensating_control_1": { "control_id": "NET-05", "name": "Interconnection Security Agreements (ISAs)", "description": "Mechanisms exist to authorize connections from systems to other systems using Interconnection Security Agreements (ISAs), or similar methods, that document, for each interconnection:\n(1) Interface characteristics;\n(2) Security, compliance and resilience requirements; and;\n(3) The nature of the information communicated.", "justification": "Interconnection Security Agreements (ISAs) (NET-05) provides overlapping security capability that compensates for the absence of Encrypting Data In Storage Media (DCH-16.2) by addressing related risk objectives through an alternative control mechanism aligned with Data applicability. Given the data-handling focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CRY-05", "name": "Encrypting Data In Transit", "description": "Cryptographic mechanisms exist to prevent the unauthorized disclosure of data in transit.", "justification": "Encrypting Data In Transit (CRY-05) provides cryptographic protection that compensates for the absence of Encrypting Data In Storage Media (DCH-16.2) by ensuring data confidentiality and integrity through alternative technical means. Given the data-handling focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "DCH-17.1", "risk_if_not_implemented": "Without Dual Authorization for Sensitive / Regulated Data Destruction, users, services and processes may obtain or retain access beyond authorized need, enabling misuse or escalation. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss, Theft or Damage of Assets (R-AM-1), Data Loss / Integrity Compromise (R-BC-2), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Fraud, Corruption and/or Intentional Criminal Conduct (MT-14), Conflict of Interest (COI) / Undue Influence / Insider Misconduct (MT-15).", "compensating_control_1": { "control_id": "DCH-17", "name": "Digital & Non-Digital Media Disposal", "description": "Mechanisms exist to securely dispose of, destroy and/or erase digital and non-digital media when it is no longer required, using organization-defined procedures.", "justification": "Digital & Non-Digital Media Disposal (DCH-17) provides physical access control that compensates for the absence of Dual Authorization for Sensitive Data Destruction (DCH-17.1) by preventing unauthorized physical interaction with systems and infrastructure. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "AST-22", "name": "Secure Disposal, Destruction or Re-Use of Equipment", "description": "Mechanisms exist to securely dispose of, destroy or repurpose technology assets using organization-defined techniques and methods to prevent:\n(1) Data recovery; and\n(2) Components from being resold, redistributed and/or reused through unauthorized channels.", "justification": "Secure Disposal, Destruction or Re-Use of Equipment (AST-22) provides overlapping security capability that compensates for the absence of Dual Authorization for Sensitive Data Destruction (DCH-17.1) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "DCH-18.1", "risk_if_not_implemented": "Without Sanitization of Sensitive / Regulated Data, sensitive and/or regulated data may be retained beyond authorized periods or recovered from improperly disposed media and equipment. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Retention / Inability to Dispose of Data (R-AM-3), Loss of Confidentiality (R-IP-2), and most likely increases susceptibility to Human Error (MT-9).", "compensating_control_1": { "control_id": "AST-22", "name": "Secure Disposal, Destruction or Re-Use of Equipment", "description": "Mechanisms exist to securely dispose of, destroy or repurpose technology assets using organization-defined techniques and methods to prevent:\n(1) Data recovery; and\n(2) Components from being resold, redistributed and/or reused through unauthorized channels.", "justification": "Secure Disposal, Destruction or Re-Use of Equipment (AST-22) provides overlapping security capability that compensates for the absence of Sanitization of Personal Data (PD) (DCH-18.1) by addressing related risk objectives through an alternative control mechanism aligned with Data applicability. Given the data-handling focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "DCH-18", "name": "Digital Media Sanitization", "description": "Mechanisms exist to sanitize digital media with the strength and integrity commensurate with the classification or sensitivity of the information prior to disposal, release out of organizational control or release for reuse.", "justification": "Digital Media Sanitization (DCH-18) provides overlapping security capability that compensates for the absence of Sanitization of Personal Data (PD) (DCH-18.1) by addressing related risk objectives through an alternative control mechanism aligned with Data applicability. Given the data-handling focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "DCH-18.2", "risk_if_not_implemented": "Without Digital Media Sanitization Documentation, sensitive and/or regulated data may be retained beyond authorized periods or recovered from improperly disposed media and equipment. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss of Accountability / Attribution (R-AC-1), Unauthorized Retention / Inability to Dispose of Data (R-AM-3), Lack of oversight of internal controls (R-GV-6), Inability to Demonstrate Due Diligence / Due Care (R-GV-9), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9).", "compensating_control_1": { "control_id": "AST-22", "name": "Secure Disposal, Destruction or Re-Use of Equipment", "description": "Mechanisms exist to securely dispose of, destroy or repurpose technology assets using organization-defined techniques and methods to prevent:\n(1) Data recovery; and\n(2) Components from being resold, redistributed and/or reused through unauthorized channels.", "justification": "Secure Disposal, Destruction or Re-Use of Equipment (AST-22) provides overlapping security capability that compensates for the absence of System Media Sanitization Documentation (DCH-18.2) by addressing related risk objectives through an alternative control mechanism aligned with Data applicability. Given the data-handling focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "DCH-17", "name": "Digital & Non-Digital Media Disposal", "description": "Mechanisms exist to securely dispose of, destroy and/or erase digital and non-digital media when it is no longer required, using organization-defined procedures.", "justification": "Digital & Non-Digital Media Disposal (DCH-17) provides physical access control that compensates for the absence of System Media Sanitization Documentation (DCH-18.2) by preventing unauthorized physical interaction with systems and infrastructure. Given the data-handling focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "DCH-18.3", "risk_if_not_implemented": "Without Digital Media Sanitization Equipment Testing, sensitive and/or regulated data may be retained beyond authorized periods or recovered from improperly disposed media and equipment. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Retention / Inability to Dispose of Data (R-AM-3), Lack of oversight of internal controls (R-GV-6), Loss of Confidentiality (R-IP-2), and most likely increases susceptibility to Human Error (MT-9), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "DCH-17", "name": "Digital & Non-Digital Media Disposal", "description": "Mechanisms exist to securely dispose of, destroy and/or erase digital and non-digital media when it is no longer required, using organization-defined procedures.", "justification": "Digital & Non-Digital Media Disposal (DCH-17) provides physical access control that compensates for the absence of Equipment Testing (DCH-18.3) by preventing unauthorized physical interaction with systems and infrastructure. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "DCH-18", "name": "Digital Media Sanitization", "description": "Mechanisms exist to sanitize digital media with the strength and integrity commensurate with the classification or sensitivity of the information prior to disposal, release out of organizational control or release for reuse.", "justification": "Digital Media Sanitization (DCH-18) provides overlapping security capability that compensates for the absence of Equipment Testing (DCH-18.3) by addressing related risk objectives through an alternative control mechanism aligned with Technology applicability. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "DCH-18.4", "risk_if_not_implemented": "Without First Time Use Sanitization, sensitive and/or regulated data may be retained beyond authorized periods or recovered from improperly disposed media and equipment. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to System / Data Compromise (Technical Vector) (R-BC-4), and most likely increases susceptibility to Human Error (MT-9), Counterfeit / Non-Conforming Products (MT-20).", "compensating_control_1": { "control_id": "DCH-18", "name": "Digital Media Sanitization", "description": "Mechanisms exist to sanitize digital media with the strength and integrity commensurate with the classification or sensitivity of the information prior to disposal, release out of organizational control or release for reuse.", "justification": "Digital Media Sanitization (DCH-18) provides overlapping security capability that compensates for the absence of First Time Use Sanitization (DCH-18.4) by addressing related risk objectives through an alternative control mechanism aligned with Technology applicability. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "AST-22", "name": "Secure Disposal, Destruction or Re-Use of Equipment", "description": "Mechanisms exist to securely dispose of, destroy or repurpose technology assets using organization-defined techniques and methods to prevent:\n(1) Data recovery; and\n(2) Components from being resold, redistributed and/or reused through unauthorized channels.", "justification": "Secure Disposal, Destruction or Re-Use of Equipment (AST-22) provides overlapping security capability that compensates for the absence of First Time Use Sanitization (DCH-18.4) by addressing related risk objectives through an alternative control mechanism aligned with Technology applicability. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "DCH-19", "risk_if_not_implemented": "Without Digital Media Use Restrictions, sensitive and/or regulated data may be disclosed, altered or lost through inadequate classification, handling or protection. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to System / Data Compromise (Technical Vector) (R-BC-4), Loss of Confidentiality (R-IP-2), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9).", "compensating_control_1": { "control_id": "CFG-03", "name": "Least Functionality", "description": "Mechanisms exist to configure Technology Assets, Applications and/or Services (TAAS) to provide only essential capabilities by specifically prohibiting or restricting the use of ports, protocols, and/or services.", "justification": "Least Functionality (CFG-03) provides configuration hardening that compensates for the absence of Media Use (DCH-19) by eliminating unnecessary services and enforcing secure settings to reduce inherent exposure. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "IAC-30", "name": "Least Privilege", "description": "Mechanisms exist to utilize the concept of least privilege, allowing only authorized access to processes necessary to accomplish assigned tasks in accordance with organizational business functions.", "justification": "Least Privilege (IAC-30) provides access control enforcement that compensates for the absence of Media Use (DCH-19) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "DCH-20", "risk_if_not_implemented": "Without Portable Storage Devices, mobile and portable devices may expose organizational data through loss, theft, insecure configuration or unauthorized use. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss of Confidentiality (R-IP-2), and most likely increases susceptibility to Human Error (MT-9).", "compensating_control_1": { "control_id": "TPM-02", "name": "Third-Party Management", "description": "Mechanisms exist to facilitate the implementation of third-party management controls.", "justification": "Third-Party Management (TPM-02) provides third-party oversight that compensates for the absence of Portable Storage Devices (DCH-20) by extending security obligations contractually and monitoring third-party risk in lieu of direct control. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "DCH-22", "name": "Use of External Technology Assets, Applications and/or Services (TAAS)", "description": "Mechanisms exist to govern how external parties, including Technology Assets, Applications and/or Services (TAAS), are used to securely store, process and transmit data.", "justification": "Use of External Technology Assets, Applications and/or Services (TAAS) (DCH-22) provides detective monitoring capability that compensates for the absence of Portable Storage Devices (DCH-20) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "DCH-20.1", "risk_if_not_implemented": "Without Prohibit Portable Storage Devices Use Without Owner, mobile and portable devices may expose organizational data through loss, theft, insecure configuration or unauthorized use. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss of Accountability / Attribution (R-AC-1), System / Data Compromise (Technical Vector) (R-BC-4), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9).", "compensating_control_1": { "control_id": "CFG-03", "name": "Least Functionality", "description": "Mechanisms exist to configure Technology Assets, Applications and/or Services (TAAS) to provide only essential capabilities by specifically prohibiting or restricting the use of ports, protocols, and/or services.", "justification": "Least Functionality (CFG-03) provides configuration hardening that compensates for the absence of Prohibit Use Without Owner (DCH-20.1) by eliminating unnecessary services and enforcing secure settings to reduce inherent exposure. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "DCH-19", "name": "Digital Media Use Restrictions", "description": "Mechanisms exist to restrict the use of types of digital media on systems or system components.", "justification": "Digital Media Use Restrictions (DCH-19) provides overlapping security capability that compensates for the absence of Prohibit Use Without Owner (DCH-20.1) by addressing related risk objectives through an alternative control mechanism aligned with Technology applicability. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "DCH-22", "risk_if_not_implemented": "Without Use of External Technology Assets, Applications and/or Services (TAAS), sensitive and/or regulated data may be disclosed, altered or lost through inadequate classification, handling or protection. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Uncontrolled Third-Party Security / Privacy Exposure (R-GV-5), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11).", "compensating_control_1": { "control_id": "TPM-02", "name": "Third-Party Management", "description": "Mechanisms exist to facilitate the implementation of third-party management controls.", "justification": "Third-Party Management (TPM-02) provides third-party oversight that compensates for the absence of Use of External Technology Assets, Applications and/or Services (TAAS) (DCH-22) by extending security obligations contractually and monitoring third-party risk in lieu of direct control. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CFG-11", "name": "Software Usage Restrictions", "description": "Mechanisms exist to enforce software usage restrictions to comply with applicable contract agreements and copyright laws.", "justification": "Software Usage Restrictions (CFG-11) provides overlapping security capability that compensates for the absence of Use of External Technology Assets, Applications and/or Services (TAAS) (DCH-22) by addressing related risk objectives through an alternative control mechanism aligned with Technology applicability. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "DCH-22.1", "risk_if_not_implemented": "Without Limits of Authorized Use To Process, Store and/or Transmit Data, sensitive and/or regulated data may be disclosed, altered or lost through inadequate classification, handling or protection. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Uncontrolled Third-Party Security / Privacy Exposure (R-GV-5), Lack of oversight of third-party controls (R-GV-7), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11).", "compensating_control_1": { "control_id": "CFG-11", "name": "Software Usage Restrictions", "description": "Mechanisms exist to enforce software usage restrictions to comply with applicable contract agreements and copyright laws.", "justification": "Software Usage Restrictions (CFG-11) provides overlapping security capability that compensates for the absence of Limits of Authorized Use (DCH-22.1) by addressing related risk objectives through an alternative control mechanism aligned with Technology applicability. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "TPM-02", "name": "Third-Party Management", "description": "Mechanisms exist to facilitate the implementation of third-party management controls.", "justification": "Third-Party Management (TPM-02) provides third-party oversight that compensates for the absence of Limits of Authorized Use (DCH-22.1) by extending security obligations contractually and monitoring third-party risk in lieu of direct control. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "DCH-22.3", "risk_if_not_implemented": "Without Non-Organizationally Owned Technology Assets, Applications and/or Services (TAAS), sensitive and/or regulated data may be disclosed, altered or lost through inadequate classification, handling or protection. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss of Confidentiality (R-IP-2), and most likely increases susceptibility to Human Error (MT-9).", "compensating_control_1": { "control_id": "TPM-14", "name": "Third-Party Contract Requirements", "description": "Mechanisms exist to require contractual requirements for applicable security, compliance and resilience requirements with third-parties, reflecting the organization's needs to protect its Technology Assets, Applications, Services and/or Data (TAASD).", "justification": "Third-Party Contract Requirements (TPM-14) provides third-party oversight that compensates for the absence of Non-Organizationally Owned Technology Assets, Applications and/or Services (TAAS) (DCH-22.3) by extending security obligations contractually and monitoring third-party risk in lieu of direct control. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CFG-11", "name": "Software Usage Restrictions", "description": "Mechanisms exist to enforce software usage restrictions to comply with applicable contract agreements and copyright laws.", "justification": "Software Usage Restrictions (CFG-11) provides overlapping security capability that compensates for the absence of Non-Organizationally Owned Technology Assets, Applications and/or Services (TAAS) (DCH-22.3) by addressing related risk objectives through an alternative control mechanism aligned with Technology applicability. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "DCH-23", "risk_if_not_implemented": "Without Information Search & Retrieval, AI training, retrieval and inference data may be disclosed, contaminated or stripped of provenance, undermining model integrity. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Access (R-AC-4), Loss of Confidentiality (R-IP-2), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9).", "compensating_control_1": { "control_id": "CRY-05", "name": "Encrypting Data In Transit", "description": "Cryptographic mechanisms exist to prevent the unauthorized disclosure of data in transit.", "justification": "Encrypting Data In Transit (CRY-05) provides cryptographic protection that compensates for the absence of Information Search & Retrieval (DCH-23) by ensuring data confidentiality and integrity through alternative technical means. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "IAC-25", "name": "Access Enforcement", "description": "Mechanisms exist to enforce Logical Access Control (LAC) permissions that conform to the principle of \"least privilege.\"", "justification": "Access Enforcement (IAC-25) provides access control enforcement that compensates for the absence of Information Search & Retrieval (DCH-23) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "DCH-23.1", "risk_if_not_implemented": "Without Electronic Discovery (eDiscovery), sensitive and/or regulated data may be disclosed, altered or lost through inadequate classification, handling or protection. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Retention / Inability to Dispose of Data (R-AM-3), Regulatory / Legal / Contractual Financial Liability (R-EX-5), Loss of Investigative / Evidentiary Capability (R-IR-1), and most likely increases susceptibility to Human Error (MT-9), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "BCD-24", "name": "Data Backups", "description": "Mechanisms exist to create recurring backups of data, software and/or system images, as well as verify the integrity of these backups, to ensure the availability of the data to satisfy Recovery Time Objectives (RTOs) and Recovery Point Objectives (RPOs).", "justification": "Data Backups (BCD-24) provides resilience and recovery capability that compensates for the absence of Electronic Discovery (eDiscovery) (DCH-23.1) by ensuring the organization can restore operations and data when the primary control is absent. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "BCD-18", "name": "Technology Assets, Applications and/or Services (TAAS) Recovery & Reconstitution", "description": "Mechanisms exist to ensure the secure recovery and reconstitution of Technology Assets, Applications and/or Services (TAAS) to a known state after a disruption, compromise or failure.", "justification": "Technology Assets, Applications and/or Services (TAAS) Recovery & Reconstitution (BCD-18) provides detective monitoring capability that compensates for the absence of Electronic Discovery (eDiscovery) (DCH-23.1) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "DCH-24.1", "risk_if_not_implemented": "Without Data Mining Protection, sensitive and/or regulated data may be disclosed, altered or lost through inadequate classification, handling or protection. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss of Confidentiality (R-IP-2), and most likely increases susceptibility to Malicious Cyber Activity (MT-2).", "compensating_control_1": { "control_id": "IAC-25", "name": "Access Enforcement", "description": "Mechanisms exist to enforce Logical Access Control (LAC) permissions that conform to the principle of \"least privilege.\"", "justification": "Access Enforcement (IAC-25) provides access control enforcement that compensates for the absence of Data Mining Protection (DCH-24.1) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the data-handling focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "DCH-40", "name": "Data Loss Prevention (DLP)", "description": "Automated mechanisms exist to implement Data Loss Prevention (DLP) to protect sensitive information as it is stored, transmitted and processed.", "justification": "Data Loss Prevention (DLP) (DCH-40) provides detective monitoring capability that compensates for the absence of Data Mining Protection (DCH-24.1) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the data-handling focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "DCH-25", "risk_if_not_implemented": "Without Ad-Hoc Transfers, sensitive and/or regulated data may be exfiltrated, leaked or transferred outside authorized boundaries without detection. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss of Confidentiality (R-IP-2), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9).", "compensating_control_1": { "control_id": "DCH-40", "name": "Data Loss Prevention (DLP)", "description": "Automated mechanisms exist to implement Data Loss Prevention (DLP) to protect sensitive information as it is stored, transmitted and processed.", "justification": "Data Loss Prevention (DLP) (DCH-40) provides detective monitoring capability that compensates for the absence of Ad-Hoc Transfers (DCH-25) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the data-handling focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "IAC-25", "name": "Access Enforcement", "description": "Mechanisms exist to enforce Logical Access Control (LAC) permissions that conform to the principle of \"least privilege.\"", "justification": "Access Enforcement (IAC-25) provides access control enforcement that compensates for the absence of Ad-Hoc Transfers (DCH-25) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the data-handling focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "DCH-26", "risk_if_not_implemented": "Without Transfer Authorizations, sensitive and/or regulated data may be exfiltrated, leaked or transferred outside authorized boundaries without detection. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Access (R-AC-4), Loss of Confidentiality (R-IP-2). No threat is rated Likely for this control; threats rated Possible include Malicious Cyber Activity (MT-2), Dysfunctional Management Practices (MT-8), Human Error (MT-9).", "compensating_control_1": { "control_id": "IAC-25", "name": "Access Enforcement", "description": "Mechanisms exist to enforce Logical Access Control (LAC) permissions that conform to the principle of \"least privilege.\"", "justification": "Access Enforcement (IAC-25) provides access control enforcement that compensates for the absence of Transfer Authorizations (DCH-26) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CRY-05", "name": "Encrypting Data In Transit", "description": "Cryptographic mechanisms exist to prevent the unauthorized disclosure of data in transit.", "justification": "Encrypting Data In Transit (CRY-05) provides cryptographic protection that compensates for the absence of Transfer Authorizations (DCH-26) by ensuring data confidentiality and integrity through alternative technical means. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "DCH-27", "risk_if_not_implemented": "Without Media & Data Retention, data may be retained longer than authorized or necessary, or may be unrecoverable when legally or operationally required. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Retention / Inability to Dispose of Data (R-AM-3), Data Loss / Integrity Compromise (R-BC-2), Contractual Default / Termination (R-EX-2), Regulatory / Legal / Contractual Financial Liability (R-EX-5), Loss of Investigative / Evidentiary Capability (R-IR-1), and most likely increases susceptibility to Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11).", "compensating_control_1": { "control_id": "DCH-18", "name": "Digital Media Sanitization", "description": "Mechanisms exist to sanitize digital media with the strength and integrity commensurate with the classification or sensitivity of the information prior to disposal, release out of organizational control or release for reuse.", "justification": "Digital Media Sanitization (DCH-27) provides overlapping security capability that compensates for the absence of Media & Data Retention (DCH-27) by addressing related risk objectives through an alternative control mechanism aligned with Data applicability. Given the data-handling focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "MON-13", "name": "Event Log & Security-Relevant Telemetry Retention", "description": "Mechanisms exist to retain event logs and security-relevant telemetry for a time period consistent with records retention requirements to provide support for after-the-fact investigations of security incidents and to meet statutory, regulatory and contractual retention requirements.", "justification": "Event Log & Security-Relevant Telemetry Retention (MON-13) provides detective monitoring capability that compensates for the absence of Media & Data Retention (DCH-27) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the data-handling focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "DCH-27.1", "risk_if_not_implemented": "Without Minimize Sensitive / Regulated Data Exposure, sensitive and/or regulated data may be disclosed, altered or lost through inadequate classification, handling or protection. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Retention / Inability to Dispose of Data (R-AM-3), Privacy Harm / Unauthorized Processing (R-IP-6), and most likely increases susceptibility to Human Error (MT-9).", "compensating_control_1": { "control_id": "MON-13", "name": "Event Log & Security-Relevant Telemetry Retention", "description": "Mechanisms exist to retain event logs and security-relevant telemetry for a time period consistent with records retention requirements to provide support for after-the-fact investigations of security incidents and to meet statutory, regulatory and contractual retention requirements.", "justification": "Event Log & Security-Relevant Telemetry Retention (MON-13) provides detective monitoring capability that compensates for the absence of Minimize Sensitive / Regulated Data (DCH-27.1) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the data-handling focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "DCH-27", "name": "Media & Data Retention", "description": "Mechanisms exist to retain media and data in accordance with applicable statutory, regulatory and contractual obligations.", "justification": "Media & Data Retention (DCH-27) provides overlapping security capability that compensates for the absence of Minimize Sensitive / Regulated Data (DCH-27.1) by addressing related risk objectives through an alternative control mechanism aligned with Data applicability. Given the data-handling focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "DCH-27.2", "risk_if_not_implemented": "Without Archived Data Set Retention, data, software and system images cannot be reliably restored within required recovery objectives following a disruption. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Data Loss / Integrity Compromise (R-BC-2), Contractual Default / Termination (R-EX-2), Regulatory / Legal / Contractual Financial Liability (R-EX-5), Loss of Confidentiality (R-IP-2), and most likely increases susceptibility to Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11).", "compensating_control_1": { "control_id": "BCD-24", "name": "Data Backups", "description": "Mechanisms exist to create recurring backups of data, software and/or system images, as well as verify the integrity of these backups, to ensure the availability of the data to satisfy Recovery Time Objectives (RTOs) and Recovery Point Objectives (RPOs).", "justification": "Data Backups (BCD-24) provides resilience and recovery capability that compensates for the absence of Archived Data Sets (DCH-27.2) by ensuring the organization can restore operations and data when the primary control is absent. Given the data-handling focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "DCH-13", "name": "Media Storage", "description": "Mechanisms exist to: \n(1) Physically control and securely store digital and non-digital media within controlled areas using organization-defined security measures; and\n(2) Protect system media until the media are destroyed or sanitized using approved equipment, techniques and procedures.", "justification": "Media Storage (DCH-13) provides overlapping security capability that compensates for the absence of Archived Data Sets (DCH-27.2) by addressing related risk objectives through an alternative control mechanism aligned with Data applicability. Given the data-handling focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "DCH-27.3", "risk_if_not_implemented": "Without Archiving Sensitive / Regulated Data, data, software and system images cannot be reliably restored within required recovery objectives following a disruption. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Retention / Inability to Dispose of Data (R-AM-3), Privacy Harm / Unauthorized Processing (R-IP-6), and most likely increases susceptibility to Human Error (MT-9).", "compensating_control_1": { "control_id": "PRI-30", "name": "Personal Data (PD) Retention & Disposal", "description": "Mechanisms exist to: \n(1) Retain Personal Data (PD), including metadata, for an organization-defined time period to fulfill the purpose(s) identified in the notice or as required by law;\n(2) Dispose of, destroys, erases, and/or anonymizes the PD, regardless of the method of storage; and\n(3) Use organization-defined techniques or methods to ensure secure deletion or destruction of PD (including originals, copies and archived records).", "justification": "Personal Data (PD) Retention & Disposal (PRI-30) provides privacy protection that compensates for the absence of Archiving (DCH-27.3) by applying alternative privacy safeguards to protect personal data and honor data subject rights. Given the data-handling focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "DCH-36", "name": "De-Identification (Anonymization)", "description": "Mechanisms exist to de-identify sensitive and/or regulated data through\n(1) Anonymization;\n(2) De-identification;\n(3) Pseudonymization; and/or\n(4) Redaction.", "justification": "De-Identification (Anonymization) (DCH-36) provides overlapping security capability that compensates for the absence of Archiving (DCH-27.3) by addressing related risk objectives through an alternative control mechanism aligned with Data applicability. Given the data-handling focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "DCH-27.4", "risk_if_not_implemented": "Without Mobile Device Data Retention Limitations, data may be retained longer than authorized or necessary, or may be unrecoverable when legally or operationally required. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Retention / Inability to Dispose of Data (R-AM-3), and most likely increases susceptibility to Physical Crime (MT-5), Human Error (MT-9).", "compensating_control_1": { "control_id": "DCH-27", "name": "Media & Data Retention", "description": "Mechanisms exist to retain media and data in accordance with applicable statutory, regulatory and contractual obligations.", "justification": "Media & Data Retention (DCH-27) provides overlapping security capability that compensates for the absence of Mobile Device Data Retention Limitations (DCH-27.4) by addressing related risk objectives through an alternative control mechanism aligned with Technology applicability. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "DCH-18", "name": "Digital Media Sanitization", "description": "Mechanisms exist to sanitize digital media with the strength and integrity commensurate with the classification or sensitivity of the information prior to disposal, release out of organizational control or release for reuse.", "justification": "Digital Media Sanitization (DCH-18) provides overlapping security capability that compensates for the absence of Mobile Device Data Retention Limitations (DCH-27.4) by addressing related risk objectives through an alternative control mechanism aligned with Technology applicability. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "DCH-28", "risk_if_not_implemented": "Without Limit Sensitive / Regulated Data In Testing, Training & Research, personnel are more likely to make unsafe decisions, fall victim to social engineering, mishandle data or violate requirements. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Privacy Harm / Unauthorized Processing (R-IP-6), and most likely increases susceptibility to Human Error (MT-9).", "compensating_control_1": { "control_id": "DCH-27", "name": "Media & Data Retention", "description": "Mechanisms exist to retain media and data in accordance with applicable statutory, regulatory and contractual obligations.", "justification": "Media & Data Retention (DCH-27) provides overlapping security capability that compensates for the absence of Limit Sensitive / Regulated Data In Testing, Training & Research (DCH-28) by addressing related risk objectives through an alternative control mechanism aligned with Data applicability. Given the data-handling focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "MON-13", "name": "Event Log & Security-Relevant Telemetry Retention", "description": "Mechanisms exist to retain event logs and security-relevant telemetry for a time period consistent with records retention requirements to provide support for after-the-fact investigations of security incidents and to meet statutory, regulatory and contractual retention requirements.", "justification": "Event Log & Security-Relevant Telemetry Retention (MON-13) provides detective monitoring capability that compensates for the absence of Limit Sensitive / Regulated Data In Testing, Training & Research (DCH-28) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the data-handling focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "DCH-29.1", "risk_if_not_implemented": "Without Automated Tools to Support Logical Data Location, sensitive and/or regulated data may be disclosed, altered or lost through inadequate classification, handling or protection. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Retention / Inability to Dispose of Data (R-AM-3), Unaddressed Security / Compliance Exposure (R-GV-2), and most likely increases susceptibility to Technical / Mechanical Failure (MT-10), Data Quality Degradation / Data Poisoning (MT-12).", "compensating_control_1": { "control_id": "DCH-04", "name": "Data & Asset Classification", "description": "Mechanisms exist to ensure data and assets are categorized in accordance with applicable statutory, regulatory and contractual requirements.", "justification": "Data & Asset Classification (DCH-04) provides overlapping security capability that compensates for the absence of Automated Tools to Support Information Location (DCH-29.1) by addressing related risk objectives through an alternative control mechanism aligned with Technology applicability. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "AST-04", "name": "Asset Inventories", "description": "Mechanisms exist to perform inventories of Technology Assets, Applications, Services and/or Data (TAASD) that:\n(1) Accurately reflects the current TAASD in use; \n(2) Identifies authorized software products, including business justification details;\n(3) Is at the level of granularity deemed necessary for tracking and reporting;\n(4) Includes organization-defined information deemed necessary to achieve effective property accountability; and\n(5) Is available for review and audit by designated organizational personnel.", "justification": "Asset Inventories (AST-04) provides overlapping security capability that compensates for the absence of Automated Tools to Support Information Location (DCH-29.1) by addressing related risk objectives through an alternative control mechanism aligned with Technology applicability. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "DCH-30", "risk_if_not_implemented": "Without Geographic Data Location, sensitive and/or regulated data may be disclosed, altered or lost through inadequate classification, handling or protection. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Retention / Inability to Dispose of Data (R-AM-3), Unaddressed Security / Compliance Exposure (R-GV-2), Inability to Demonstrate Due Diligence / Due Care (R-GV-9), and most likely increases susceptibility to Human Error (MT-9), Data Quality Degradation / Data Poisoning (MT-12).", "compensating_control_1": { "control_id": "DCH-30.1", "name": "Geolocation Requirements for Processing, Storage and Service Locations", "description": "Mechanisms exist to control the location of Technology Assets, Applications and/or Services (TAAS) processing and/or storage based on business requirements that includes statutory, regulatory and contractual obligations.", "justification": "Geolocation Requirements for Processing, Storage and Service Locations (DCH-30.1) provides overlapping security capability that compensates for the absence of Geographic Location of Data (DCH-30) by addressing related risk objectives through an alternative control mechanism aligned with Data applicability. Given the data-handling focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "DCH-31", "name": "Data Localization", "description": "Mechanisms exist to constrain the impact of \"digital sovereignty laws,\" that require localized data within the host country, where data and processes may be subjected to arbitrary enforcement actions that potentially violate other applicable statutory, regulatory and/or contractual obligations.", "justification": "Data Localization (DCH-31) provides overlapping security capability that compensates for the absence of Geographic Location of Data (DCH-30) by addressing related risk objectives through an alternative control mechanism aligned with Data applicability. Given the data-handling focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "DCH-33", "risk_if_not_implemented": "Without Data Quality Operations, inaccurate, stale, corrupted or manipulated data may drive flawed decisions and control failures. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Retention / Inability to Dispose of Data (R-AM-3), Loss of Data Integrity (R-IP-3), and most likely increases susceptibility to Human Error (MT-9), Data Quality Degradation / Data Poisoning (MT-12).", "compensating_control_1": { "control_id": "DCH-03", "name": "Sensitive / Regulated Data Governance", "description": "Mechanisms exist to facilitate data governance so that sensitive and/or regulated data is effectively managed and maintained in accordance with applicable statutory, regulatory and contractual obligations.", "justification": "Sensitive / Regulated Data Governance (DCH-03) provides policy-level governance that compensates for the absence of Data Quality Operations (DCH-33) by establishing documented expectations, accountability structures, and organizational guardrails. Given the data-handling focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "DCH-33.2", "name": "Data Quality Management", "description": "Mechanisms exist to manage the quality, utility, objectivity, integrity and impact determination and de-identification of sensitive and/or regulated data across the information lifecycle.", "justification": "Data Quality Management (DCH-33.2) provides overlapping security capability that compensates for the absence of Data Quality Operations (DCH-33) by addressing related risk objectives through an alternative control mechanism aligned with Data applicability. Given the data-handling focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "DCH-33.1", "risk_if_not_implemented": "Without Data Management Board, sensitive and/or regulated data may be disclosed, altered or lost through inadequate classification, handling or protection. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unperformed / Unowned Control Responsibilities (R-GV-3), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8).", "compensating_control_1": { "control_id": "DCH-03", "name": "Sensitive / Regulated Data Governance", "description": "Mechanisms exist to facilitate data governance so that sensitive and/or regulated data is effectively managed and maintained in accordance with applicable statutory, regulatory and contractual obligations.", "justification": "Sensitive / Regulated Data Governance (DCH-03) provides policy-level governance that compensates for the absence of Data Management Board (DCH-33.1) by establishing documented expectations, accountability structures, and organizational guardrails. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "PRI-02", "name": "Data Privacy Program", "description": "Mechanisms exist to facilitate the implementation and operation of data protection controls throughout the data lifecycle to ensure all forms of Personal Data (PD) are processed lawfully, fairly and transparently.", "justification": "Data Privacy Program (PRI-02) provides policy-level governance that compensates for the absence of Data Management Board (DCH-33.1) by establishing documented expectations, accountability structures, and organizational guardrails. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "DCH-33.2", "risk_if_not_implemented": "Without Data Quality Management, inaccurate, stale, corrupted or manipulated data may drive flawed decisions and control failures. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss of Data Integrity (R-IP-3), and most likely increases susceptibility to Human Error (MT-9), Data Quality Degradation / Data Poisoning (MT-12).", "compensating_control_1": { "control_id": "DCH-33", "name": "Data Quality Operations", "description": "Mechanisms exist to check for Redundant, Obsolete/Outdated, Toxic or Trivial (ROTT) data to ensure the accuracy, relevance, timeliness, impact, completeness and de-identification of information throughout the information lifecycle.", "justification": "Data Quality Operations (DCH-33) provides overlapping security capability that compensates for the absence of Data Quality Management (DCH-33.2) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "DCH-03", "name": "Sensitive / Regulated Data Governance", "description": "Mechanisms exist to facilitate data governance so that sensitive and/or regulated data is effectively managed and maintained in accordance with applicable statutory, regulatory and contractual obligations.", "justification": "Sensitive / Regulated Data Governance (DCH-03) provides policy-level governance that compensates for the absence of Data Quality Management (DCH-33.2) by establishing documented expectations, accountability structures, and organizational guardrails. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "DCH-33.3", "risk_if_not_implemented": "Without Data Quality Automation, inaccurate, stale, corrupted or manipulated data may drive flawed decisions and control failures. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss of Data Integrity (R-IP-3), and most likely increases susceptibility to Technical / Mechanical Failure (MT-10), Data Quality Degradation / Data Poisoning (MT-12).", "compensating_control_1": { "control_id": "DCH-03", "name": "Sensitive / Regulated Data Governance", "description": "Mechanisms exist to facilitate data governance so that sensitive and/or regulated data is effectively managed and maintained in accordance with applicable statutory, regulatory and contractual obligations.", "justification": "Sensitive / Regulated Data Governance (DCH-03) provides policy-level governance that compensates for the absence of Data Quality Automation (DCH-33.3) by establishing documented expectations, accountability structures, and organizational guardrails. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "DCH-33", "name": "Data Quality Operations", "description": "Mechanisms exist to check for Redundant, Obsolete/Outdated, Toxic or Trivial (ROTT) data to ensure the accuracy, relevance, timeliness, impact, completeness and de-identification of information throughout the information lifecycle.", "justification": "Data Quality Operations (DCH-33) provides overlapping security capability that compensates for the absence of Data Quality Automation (DCH-33.3) by addressing related risk objectives through an alternative control mechanism aligned with Technology applicability. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "DCH-34", "risk_if_not_implemented": "Without Data Modeling Guidelines, AI and autonomous systems may produce unreliable, biased or unsafe outputs, act outside authorized scope, or expose sensitive data. Based on the risk and threat mapping for this control, no risk is rated Likely; risks rated Possible include Unauthorized Retention / Inability to Dispose of Data (R-AM-3), Regulatory / Legal / Contractual Financial Liability (R-EX-5), Unaddressed Security / Compliance Exposure (R-GV-2). No threat is rated Likely for this control; threats rated Possible include Dysfunctional Management Practices (MT-8), Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11).", "compensating_control_1": { "control_id": "DCH-11", "name": "Media Marking", "description": "Mechanisms exist to mark media in accordance with data protection requirements so that personnel are alerted to distribution limitations, handling caveats and applicable security requirements.", "justification": "Media Marking (DCH-11) provides overlapping security capability that compensates for the absence of Data Tagging (DCH-34) by addressing related risk objectives through an alternative control mechanism aligned with Data applicability. Given the data-handling focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "DCH-37", "name": "Cybersecurity & Data Protection Attributes", "description": "Mechanisms exist to bind cybersecurity and data protection attributes to information as it is stored, transmitted and processed.", "justification": "Cybersecurity & Data Protection Attributes (DCH-37) provides overlapping security capability that compensates for the absence of Data Tagging (DCH-34) by addressing related risk objectives through an alternative control mechanism aligned with Data applicability. Given the data-handling focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "DCH-34.1", "risk_if_not_implemented": "Without Data Tags, sensitive and/or regulated data may be disclosed, altered or lost through inadequate classification, handling or protection. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Retention / Inability to Dispose of Data (R-AM-3), and most likely increases susceptibility to Data Quality Degradation / Data Poisoning (MT-12).", "compensating_control_1": { "control_id": "DCH-03", "name": "Sensitive / Regulated Data Governance", "description": "Mechanisms exist to facilitate data governance so that sensitive and/or regulated data is effectively managed and maintained in accordance with applicable statutory, regulatory and contractual obligations.", "justification": "Sensitive / Regulated Data Governance (DCH-03) provides policy-level governance that compensates for the absence of Data Tags (DCH-34.1) by establishing documented expectations, accountability structures, and organizational guardrails. Given the data-handling focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "DCH-33", "name": "Data Quality Operations", "description": "Mechanisms exist to check for Redundant, Obsolete/Outdated, Toxic or Trivial (ROTT) data to ensure the accuracy, relevance, timeliness, impact, completeness and de-identification of information throughout the information lifecycle.", "justification": "Data Quality Operations (DCH-33) provides overlapping security capability that compensates for the absence of Data Tags (DCH-34.1) by addressing related risk objectives through an alternative control mechanism aligned with Data applicability. Given the data-handling focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "DCH-35", "risk_if_not_implemented": "Without Data Analytics Bias, inaccurate, stale, corrupted or manipulated data may drive flawed decisions and control failures. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to AI Bias / Discriminatory Outcome (R-AI-6), and most likely increases susceptibility to Human Error (MT-9).", "compensating_control_1": { "control_id": "DCH-33", "name": "Data Quality Operations", "description": "Mechanisms exist to check for Redundant, Obsolete/Outdated, Toxic or Trivial (ROTT) data to ensure the accuracy, relevance, timeliness, impact, completeness and de-identification of information throughout the information lifecycle.", "justification": "Data Quality Operations (DCH-33) provides overlapping security capability that compensates for the absence of Data Analytics Bias (DCH-35) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "DCH-33.2", "name": "Data Quality Management", "description": "Mechanisms exist to manage the quality, utility, objectivity, integrity and impact determination and de-identification of sensitive and/or regulated data across the information lifecycle.", "justification": "Data Quality Management (DCH-33.2) provides overlapping security capability that compensates for the absence of Data Analytics Bias (DCH-35) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "DCH-36", "risk_if_not_implemented": "Without De-Identification (Anonymization), inaccurate, stale, corrupted or manipulated data may drive flawed decisions and control failures. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss of Confidentiality (R-IP-2), Privacy Harm / Unauthorized Processing (R-IP-6), and most likely increases susceptibility to Human Error (MT-9).", "compensating_control_1": { "control_id": "PRI-30", "name": "Personal Data (PD) Retention & Disposal", "description": "Mechanisms exist to: \n(1) Retain Personal Data (PD), including metadata, for an organization-defined time period to fulfill the purpose(s) identified in the notice or as required by law;\n(2) Dispose of, destroys, erases, and/or anonymizes the PD, regardless of the method of storage; and\n(3) Use organization-defined techniques or methods to ensure secure deletion or destruction of PD (including originals, copies and archived records).", "justification": "Personal Data (PD) Retention & Disposal (PRI-30) provides privacy protection that compensates for the absence of De-Identification (Anonymization) (DCH-23) by applying alternative privacy safeguards to protect personal data and honor data subject rights. Given the data-handling focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "DCH-02", "name": "Data Protection", "description": "Mechanisms exist to facilitate the implementation of data protection controls.", "justification": "Data Protection (DCH-02) provides overlapping security capability that compensates for the absence of De-Identification (Anonymization) (DCH-23) by addressing related risk objectives through an alternative control mechanism aligned with Data applicability. Given the data-handling focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "DCH-36.1", "risk_if_not_implemented": "Without Automated De-Identification of Sensitive / Regulated Data, inaccurate, stale, corrupted or manipulated data may drive flawed decisions and control failures. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss of Confidentiality (R-IP-2), Privacy Harm / Unauthorized Processing (R-IP-6). No threat is rated Likely for this control; threats rated Possible include Malicious Cyber Activity (MT-2), Dysfunctional Management Practices (MT-8), Human Error (MT-9).", "compensating_control_1": { "control_id": "DCH-02", "name": "Data Protection", "description": "Mechanisms exist to facilitate the implementation of data protection controls.", "justification": "Data Protection (DCH-02) provides overlapping security capability that compensates for the absence of Automated De-Identification of Sensitive Data (DCH-36.1) by addressing related risk objectives through an alternative control mechanism aligned with Technology applicability. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "DCH-36", "name": "De-Identification (Anonymization)", "description": "Mechanisms exist to de-identify sensitive and/or regulated data through\n(1) Anonymization;\n(2) De-identification;\n(3) Pseudonymization; and/or\n(4) Redaction.", "justification": "De-Identification (Anonymization) (DCH-36) provides overlapping security capability that compensates for the absence of Automated De-Identification of Sensitive Data (DCH-36.1) by addressing related risk objectives through an alternative control mechanism aligned with Technology applicability. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "DCH-36.2", "risk_if_not_implemented": "Without De-Identify Dataset Upon Collection, inaccurate, stale, corrupted or manipulated data may drive flawed decisions and control failures. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Retention / Inability to Dispose of Data (R-AM-3), Privacy Harm / Unauthorized Processing (R-IP-6). No threat is rated Likely for this control; threats rated Possible include Dysfunctional Management Practices (MT-8), Human Error (MT-9), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "DCH-02", "name": "Data Protection", "description": "Mechanisms exist to facilitate the implementation of data protection controls.", "justification": "Data Protection (DCH-02) provides overlapping security capability that compensates for the absence of De-Identify Dataset Upon Collection (DCH-36.2) by addressing related risk objectives through an alternative control mechanism aligned with Data applicability. Given the data-handling focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "PRI-30", "name": "Personal Data (PD) Retention & Disposal", "description": "Mechanisms exist to: \n(1) Retain Personal Data (PD), including metadata, for an organization-defined time period to fulfill the purpose(s) identified in the notice or as required by law;\n(2) Dispose of, destroys, erases, and/or anonymizes the PD, regardless of the method of storage; and\n(3) Use organization-defined techniques or methods to ensure secure deletion or destruction of PD (including originals, copies and archived records).", "justification": "Personal Data (PD) Retention & Disposal (PRI-30) provides privacy protection that compensates for the absence of De-Identify Dataset Upon Collection (DCH-36.2) by applying alternative privacy safeguards to protect personal data and honor data subject rights. Given the data-handling focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "DCH-36.3", "risk_if_not_implemented": "Without Removal, Masking, Encryption, Hashing or Replacement of Direct Identifiers, data in transit and at rest may be exposed through weak, misconfigured or compromised cryptographic protections. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss of Confidentiality (R-IP-2), Privacy Harm / Unauthorized Processing (R-IP-6). No threat is rated Likely for this control; threats rated Possible include Malicious Cyber Activity (MT-2), Dysfunctional Management Practices (MT-8), Human Error (MT-9).", "compensating_control_1": { "control_id": "DCH-02", "name": "Data Protection", "description": "Mechanisms exist to facilitate the implementation of data protection controls.", "justification": "Data Protection (DCH-02) provides overlapping security capability that compensates for the absence of Removal, Masking, Encryption, Hashing or Replacement of Direct Identifiers (DCH-36.3) by addressing related risk objectives through an alternative control mechanism aligned with Data applicability. Given the data-handling focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "DCH-36", "name": "De-Identification (Anonymization)", "description": "Mechanisms exist to de-identify sensitive and/or regulated data through\n(1) Anonymization;\n(2) De-identification;\n(3) Pseudonymization; and/or\n(4) Redaction.", "justification": "De-Identification (Anonymization) (DCH-36) provides overlapping security capability that compensates for the absence of Removal, Masking, Encryption, Hashing or Replacement of Direct Identifiers (DCH-36.3) by addressing related risk objectives through an alternative control mechanism aligned with Data applicability. Given the data-handling focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "DCH-36.4", "risk_if_not_implemented": "Without Statistical Disclosure Control, sensitive and/or regulated data may be disclosed, altered or lost through inadequate classification, handling or protection. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss of Confidentiality (R-IP-2), Privacy Harm / Unauthorized Processing (R-IP-6). No threat is rated Likely for this control; threats rated Possible include Malicious Cyber Activity (MT-2), Dysfunctional Management Practices (MT-8), Human Error (MT-9).", "compensating_control_1": { "control_id": "PRI-30", "name": "Personal Data (PD) Retention & Disposal", "description": "Mechanisms exist to: \n(1) Retain Personal Data (PD), including metadata, for an organization-defined time period to fulfill the purpose(s) identified in the notice or as required by law;\n(2) Dispose of, destroys, erases, and/or anonymizes the PD, regardless of the method of storage; and\n(3) Use organization-defined techniques or methods to ensure secure deletion or destruction of PD (including originals, copies and archived records).", "justification": "Personal Data (PD) Retention & Disposal (PRI-30) provides privacy protection that compensates for the absence of Statistical Disclosure Control (DCH-36.4) by applying alternative privacy safeguards to protect personal data and honor data subject rights. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "DCH-02", "name": "Data Protection", "description": "Mechanisms exist to facilitate the implementation of data protection controls.", "justification": "Data Protection (DCH-02) provides overlapping security capability that compensates for the absence of Statistical Disclosure Control (DCH-36.4) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "DCH-36.5", "risk_if_not_implemented": "Without Motivated Intruder, sensitive and/or regulated data may be disclosed, altered or lost through inadequate classification, handling or protection. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Lack of oversight of internal controls (R-GV-6), Loss of Confidentiality (R-IP-2), Privacy Harm / Unauthorized Processing (R-IP-6), and most likely increases susceptibility to Human Error (MT-9).", "compensating_control_1": { "control_id": "PRI-30", "name": "Personal Data (PD) Retention & Disposal", "description": "Mechanisms exist to: \n(1) Retain Personal Data (PD), including metadata, for an organization-defined time period to fulfill the purpose(s) identified in the notice or as required by law;\n(2) Dispose of, destroys, erases, and/or anonymizes the PD, regardless of the method of storage; and\n(3) Use organization-defined techniques or methods to ensure secure deletion or destruction of PD (including originals, copies and archived records).", "justification": "Personal Data (PD) Retention & Disposal (PRI-30) provides privacy protection that compensates for the absence of Motivated Intruder (DCH-36.5) by applying alternative privacy safeguards to protect personal data and honor data subject rights. Given the data-handling focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "DCH-36", "name": "De-Identification (Anonymization)", "description": "Mechanisms exist to de-identify sensitive and/or regulated data through\n(1) Anonymization;\n(2) De-identification;\n(3) Pseudonymization; and/or\n(4) Redaction.", "justification": "De-Identification (Anonymization) (DCH-36) provides overlapping security capability that compensates for the absence of Motivated Intruder (DCH-36.5) by addressing related risk objectives through an alternative control mechanism aligned with Data applicability. Given the data-handling focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "DCH-36.6", "risk_if_not_implemented": "Without Differential Privacy, Personal Data (PD) may be collected, processed, retained or shared without lawful authority or adequate safeguards, harming individuals and exposing the organization to regulatory action. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss of Confidentiality (R-IP-2), Privacy Harm / Unauthorized Processing (R-IP-6). No threat is rated Likely for this control; threats rated Possible include Malicious Cyber Activity (MT-2), Dysfunctional Management Practices (MT-8), Human Error (MT-9).", "compensating_control_1": { "control_id": "DCH-36", "name": "De-Identification (Anonymization)", "description": "Mechanisms exist to de-identify sensitive and/or regulated data through\n(1) Anonymization;\n(2) De-identification;\n(3) Pseudonymization; and/or\n(4) Redaction.", "justification": "De-Identification (Anonymization) (DCH-36) provides overlapping security capability that compensates for the absence of Differential Data Privacy (DCH-36.6) by addressing related risk objectives through an alternative control mechanism aligned with Data applicability. Given the data-handling focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "PRI-30", "name": "Personal Data (PD) Retention & Disposal", "description": "Mechanisms exist to: \n(1) Retain Personal Data (PD), including metadata, for an organization-defined time period to fulfill the purpose(s) identified in the notice or as required by law;\n(2) Dispose of, destroys, erases, and/or anonymizes the PD, regardless of the method of storage; and\n(3) Use organization-defined techniques or methods to ensure secure deletion or destruction of PD (including originals, copies and archived records).", "justification": "Personal Data (PD) Retention & Disposal (PRI-30) provides privacy protection that compensates for the absence of Differential Data Privacy (DCH-36.6) by applying alternative privacy safeguards to protect personal data and honor data subject rights. Given the data-handling focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "DCH-37", "risk_if_not_implemented": "Without Cybersecurity & Data Protection Attributes, sensitive and/or regulated data may be disclosed, altered or lost through inadequate classification, handling or protection. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unaddressed Security / Compliance Exposure (R-GV-2). No threat is rated Likely for this control; threats rated Possible include Malicious Cyber Activity (MT-2), Dysfunctional Management Practices (MT-8), Human Error (MT-9).", "compensating_control_1": { "control_id": "DCH-04", "name": "Data & Asset Classification", "description": "Mechanisms exist to ensure data and assets are categorized in accordance with applicable statutory, regulatory and contractual requirements.", "justification": "Data & Asset Classification (DCH-04) provides overlapping security capability that compensates for the absence of Cybersecurity & Data Protection Attributes (DCH-37) by addressing related risk objectives through an alternative control mechanism aligned with Technology applicability. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "DCH-11", "name": "Media Marking", "description": "Mechanisms exist to mark media in accordance with data protection requirements so that personnel are alerted to distribution limitations, handling caveats and applicable security requirements.", "justification": "Media Marking (DCH-11) provides overlapping security capability that compensates for the absence of Cybersecurity & Data Protection Attributes (DCH-37) by addressing related risk objectives through an alternative control mechanism aligned with Technology applicability. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "DCH-37.1", "risk_if_not_implemented": "Without Dynamic Attribute Association, sensitive and/or regulated data may be disclosed, altered or lost through inadequate classification, handling or protection. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unaddressed Security / Compliance Exposure (R-GV-2). No threat is rated Likely for this control; threats rated Possible include Malicious Cyber Activity (MT-2), Dysfunctional Management Practices (MT-8), Human Error (MT-9).", "compensating_control_1": { "control_id": "DCH-11", "name": "Media Marking", "description": "Mechanisms exist to mark media in accordance with data protection requirements so that personnel are alerted to distribution limitations, handling caveats and applicable security requirements.", "justification": "Media Marking (DCH-11) provides overlapping security capability that compensates for the absence of Dynamic Attribute Association (DCH-37.1) by addressing related risk objectives through an alternative control mechanism aligned with Data applicability. Given the data-handling focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "DCH-04", "name": "Data & Asset Classification", "description": "Mechanisms exist to ensure data and assets are categorized in accordance with applicable statutory, regulatory and contractual requirements.", "justification": "Data & Asset Classification (DCH-04) provides overlapping security capability that compensates for the absence of Dynamic Attribute Association (DCH-37.1) by addressing related risk objectives through an alternative control mechanism aligned with Data applicability. Given the data-handling focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "DCH-37.2", "risk_if_not_implemented": "Without Attribute Value Changes By Authorized Individuals, sensitive and/or regulated data may be disclosed, altered or lost through inadequate classification, handling or protection. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Modification / Loss of System Integrity (R-AM-2), Unaddressed Security / Compliance Exposure (R-GV-2), and most likely increases susceptibility to Human Error (MT-9).", "compensating_control_1": { "control_id": "DCH-04", "name": "Data & Asset Classification", "description": "Mechanisms exist to ensure data and assets are categorized in accordance with applicable statutory, regulatory and contractual requirements.", "justification": "Data & Asset Classification (DCH-04) provides overlapping security capability that compensates for the absence of Attribute Value Changes By Authorized Individuals (DCH-37.2) by addressing related risk objectives through an alternative control mechanism aligned with Technology applicability. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "DCH-37", "name": "Cybersecurity & Data Protection Attributes", "description": "Mechanisms exist to bind cybersecurity and data protection attributes to information as it is stored, transmitted and processed.", "justification": "Cybersecurity & Data Protection Attributes (DCH-37) provides overlapping security capability that compensates for the absence of Attribute Value Changes By Authorized Individuals (DCH-37.2) by addressing related risk objectives through an alternative control mechanism aligned with Technology applicability. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "DCH-37.3", "risk_if_not_implemented": "Without Maintenance of Attribute Associations By System, maintenance activities may introduce unauthorized changes, expose systems to untrusted personnel or tools, or leave systems in an unsafe state. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Modification / Loss of System Integrity (R-AM-2), Unaddressed Security / Compliance Exposure (R-GV-2), Loss of Data Integrity (R-IP-3). No threat is rated Likely for this control; threats rated Possible include Malicious Cyber Activity (MT-2), Dysfunctional Management Practices (MT-8), Human Error (MT-9).", "compensating_control_1": { "control_id": "DCH-37", "name": "Cybersecurity & Data Protection Attributes", "description": "Mechanisms exist to bind cybersecurity and data protection attributes to information as it is stored, transmitted and processed.", "justification": "Cybersecurity & Data Protection Attributes (DCH-37) provides overlapping security capability that compensates for the absence of Maintenance of Attribute Associations By System (DCH-37.3) by addressing related risk objectives through an alternative control mechanism aligned with Technology applicability. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "DCH-11", "name": "Media Marking", "description": "Mechanisms exist to mark media in accordance with data protection requirements so that personnel are alerted to distribution limitations, handling caveats and applicable security requirements.", "justification": "Media Marking (DCH-11) provides overlapping security capability that compensates for the absence of Maintenance of Attribute Associations By System (DCH-37.3) by addressing related risk objectives through an alternative control mechanism aligned with Technology applicability. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "DCH-37.4", "risk_if_not_implemented": "Without Association of Attributes By Authorized Individuals, sensitive and/or regulated data may be disclosed, altered or lost through inadequate classification, handling or protection. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Modification / Loss of System Integrity (R-AM-2), Unaddressed Security / Compliance Exposure (R-GV-2), and most likely increases susceptibility to Human Error (MT-9).", "compensating_control_1": { "control_id": "DCH-11", "name": "Media Marking", "description": "Mechanisms exist to mark media in accordance with data protection requirements so that personnel are alerted to distribution limitations, handling caveats and applicable security requirements.", "justification": "Media Marking (DCH-11) provides overlapping security capability that compensates for the absence of Association of Attributes By Authorized Individuals (DCH-37.4) by addressing related risk objectives through an alternative control mechanism aligned with Technology applicability. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "DCH-37", "name": "Cybersecurity & Data Protection Attributes", "description": "Mechanisms exist to bind cybersecurity and data protection attributes to information as it is stored, transmitted and processed.", "justification": "Cybersecurity & Data Protection Attributes (DCH-37) provides overlapping security capability that compensates for the absence of Association of Attributes By Authorized Individuals (DCH-37.4) by addressing related risk objectives through an alternative control mechanism aligned with Technology applicability. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "DCH-37.5", "risk_if_not_implemented": "Without Attribute Displays for Output Devices, sensitive and/or regulated data may be disclosed, altered or lost through inadequate classification, handling or protection. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss of Confidentiality (R-IP-2), and most likely increases susceptibility to Technical / Mechanical Failure (MT-10), Data Quality Degradation / Data Poisoning (MT-12).", "compensating_control_1": { "control_id": "DCH-04", "name": "Data & Asset Classification", "description": "Mechanisms exist to ensure data and assets are categorized in accordance with applicable statutory, regulatory and contractual requirements.", "justification": "Data & Asset Classification (DCH-04) provides overlapping security capability that compensates for the absence of Attribute Displays for Output Devices (DCH-37.5) by addressing related risk objectives through an alternative control mechanism aligned with Technology applicability. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "DCH-11", "name": "Media Marking", "description": "Mechanisms exist to mark media in accordance with data protection requirements so that personnel are alerted to distribution limitations, handling caveats and applicable security requirements.", "justification": "Media Marking (DCH-11) provides overlapping security capability that compensates for the absence of Attribute Displays for Output Devices (DCH-37.5) by addressing related risk objectives through an alternative control mechanism aligned with Technology applicability. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "DCH-37.6", "risk_if_not_implemented": "Without Data Subject Attribute Associations, Personal Data (PD) may be collected, processed, retained or shared without lawful authority or adequate safeguards, harming individuals and exposing the organization to regulatory action. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss of Confidentiality (R-IP-2), and most likely increases susceptibility to Human Error (MT-9), Workforce Shortage / Loss of Critical Skills / Labor Disruption (MT-25).", "compensating_control_1": { "control_id": "DCH-37", "name": "Cybersecurity & Data Protection Attributes", "description": "Mechanisms exist to bind cybersecurity and data protection attributes to information as it is stored, transmitted and processed.", "justification": "Cybersecurity & Data Protection Attributes (DCH-37) provides overlapping security capability that compensates for the absence of Data Subject Attribute Associations (DCH-37.6) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "DCH-04", "name": "Data & Asset Classification", "description": "Mechanisms exist to ensure data and assets are categorized in accordance with applicable statutory, regulatory and contractual requirements.", "justification": "Data & Asset Classification (DCH-04) provides overlapping security capability that compensates for the absence of Data Subject Attribute Associations (DCH-37.6) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "DCH-37.7", "risk_if_not_implemented": "Without Consistent Attribute Interpretation, sensitive and/or regulated data may be disclosed, altered or lost through inadequate classification, handling or protection. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Access (R-AC-4), Loss of Confidentiality (R-IP-2), and most likely increases susceptibility to Technical / Mechanical Failure (MT-10), Data Quality Degradation / Data Poisoning (MT-12).", "compensating_control_1": { "control_id": "DCH-11", "name": "Media Marking", "description": "Mechanisms exist to mark media in accordance with data protection requirements so that personnel are alerted to distribution limitations, handling caveats and applicable security requirements.", "justification": "Media Marking (DCH-11) provides overlapping security capability that compensates for the absence of Consistent Attribute Interpretation (DCH-37.7) by addressing related risk objectives through an alternative control mechanism aligned with Technology applicability. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "DCH-04", "name": "Data & Asset Classification", "description": "Mechanisms exist to ensure data and assets are categorized in accordance with applicable statutory, regulatory and contractual requirements.", "justification": "Data & Asset Classification (DCH-04) provides overlapping security capability that compensates for the absence of Consistent Attribute Interpretation (DCH-37.7) by addressing related risk objectives through an alternative control mechanism aligned with Technology applicability. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "DCH-37.8", "risk_if_not_implemented": "Without Identity Association Techniques & Technologies, unauthorized individuals, devices or services may gain access to Technology Assets, Applications, Services, Data and/or Facilities (TAASDF). Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss of Confidentiality (R-IP-2), and most likely increases susceptibility to Technical / Mechanical Failure (MT-10), Data Quality Degradation / Data Poisoning (MT-12).", "compensating_control_1": { "control_id": "DCH-04", "name": "Data & Asset Classification", "description": "Mechanisms exist to ensure data and assets are categorized in accordance with applicable statutory, regulatory and contractual requirements.", "justification": "Data & Asset Classification (DCH-04) provides overlapping security capability that compensates for the absence of Identity Association Techniques & Technologies (DCH-37.8) by addressing related risk objectives through an alternative control mechanism aligned with Technology applicability. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "DCH-11", "name": "Media Marking", "description": "Mechanisms exist to mark media in accordance with data protection requirements so that personnel are alerted to distribution limitations, handling caveats and applicable security requirements.", "justification": "Media Marking (DCH-11) provides overlapping security capability that compensates for the absence of Identity Association Techniques & Technologies (DCH-37.8) by addressing related risk objectives through an alternative control mechanism aligned with Technology applicability. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "DCH-37.9", "risk_if_not_implemented": "Without Attribute Reassignment, sensitive and/or regulated data may be disclosed, altered or lost through inadequate classification, handling or protection. Based on the risk and threat mapping for this control, no risk is rated Likely; risks rated Possible include Unauthorized Access (R-AC-4), Unauthorized Retention / Inability to Dispose of Data (R-AM-3), Contractual Default / Termination (R-EX-2), and most likely increases susceptibility to Human Error (MT-9).", "compensating_control_1": { "control_id": "DCH-37", "name": "Cybersecurity & Data Protection Attributes", "description": "Mechanisms exist to bind cybersecurity and data protection attributes to information as it is stored, transmitted and processed.", "justification": "Cybersecurity & Data Protection Attributes (DCH-37) provides overlapping security capability that compensates for the absence of Attribute Reassignment (DCH-37.9) by addressing related risk objectives through an alternative control mechanism aligned with Technology applicability. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "DCH-11", "name": "Media Marking", "description": "Mechanisms exist to mark media in accordance with data protection requirements so that personnel are alerted to distribution limitations, handling caveats and applicable security requirements.", "justification": "Media Marking (DCH-11) provides overlapping security capability that compensates for the absence of Attribute Reassignment (DCH-37.9) by addressing related risk objectives through an alternative control mechanism aligned with Technology applicability. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "DCH-37.10", "risk_if_not_implemented": "Without Attribute Configuration By Authorized Individuals, Technology Assets, Applications and/or Services (TAAS) may operate with insecure, unauthorized or drifted configurations that expand the attack surface. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Modification / Loss of System Integrity (R-AM-2), and most likely increases susceptibility to Human Error (MT-9).", "compensating_control_1": { "control_id": "DCH-11", "name": "Media Marking", "description": "Mechanisms exist to mark media in accordance with data protection requirements so that personnel are alerted to distribution limitations, handling caveats and applicable security requirements.", "justification": "Media Marking (DCH-11) provides overlapping security capability that compensates for the absence of Attribute Configuration By Authorized Individuals (DCH-37.10) by addressing related risk objectives through an alternative control mechanism aligned with Technology applicability. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "DCH-37", "name": "Cybersecurity & Data Protection Attributes", "description": "Mechanisms exist to bind cybersecurity and data protection attributes to information as it is stored, transmitted and processed.", "justification": "Cybersecurity & Data Protection Attributes (DCH-37) provides overlapping security capability that compensates for the absence of Attribute Configuration By Authorized Individuals (DCH-37.10) by addressing related risk objectives through an alternative control mechanism aligned with Technology applicability. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "DCH-37.11", "risk_if_not_implemented": "Without Audit Changes, the organization may fail to meet statutory, regulatory or contractual obligations, or be unable to demonstrate conformity when required. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss of Accountability / Attribution (R-AC-1), Loss of Investigative / Evidentiary Capability (R-IR-1), Undetected / Delayed Detection of Adverse Activity (R-SA-1), and most likely increases susceptibility to Human Error (MT-9).", "compensating_control_1": { "control_id": "DCH-04", "name": "Data & Asset Classification", "description": "Mechanisms exist to ensure data and assets are categorized in accordance with applicable statutory, regulatory and contractual requirements.", "justification": "Data & Asset Classification (DCH-04) provides overlapping security capability that compensates for the absence of Audit Changes (DCH-37.11) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "DCH-37", "name": "Cybersecurity & Data Protection Attributes", "description": "Mechanisms exist to bind cybersecurity and data protection attributes to information as it is stored, transmitted and processed.", "justification": "Cybersecurity & Data Protection Attributes (DCH-37) provides overlapping security capability that compensates for the absence of Audit Changes (DCH-37.11) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "DCH-38", "risk_if_not_implemented": "Without Code Names, applications may be built and deployed with exploitable design and coding weaknesses that adversaries can leverage. Based on the risk and threat mapping for this control, no risk is rated Likely; risks rated Possible include System / Data Compromise (Non-Technical Vector) (R-BC-5), Loss of Competitive Advantage (R-EX-3), Intellectual Property / Trade Secret Loss (R-EX-9), and most likely increases susceptibility to Human Error (MT-9).", "compensating_control_1": { "control_id": "DCH-36", "name": "De-Identification (Anonymization)", "description": "Mechanisms exist to de-identify sensitive and/or regulated data through\n(1) Anonymization;\n(2) De-identification;\n(3) Pseudonymization; and/or\n(4) Redaction.", "justification": "De-Identification (Anonymization) (DCH-36) provides overlapping security capability that compensates for the absence of Code Names (DCH-38) by addressing related risk objectives through an alternative control mechanism aligned with Data applicability. Given the data-handling focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "PRI-30", "name": "Personal Data (PD) Retention & Disposal", "description": "Mechanisms exist to: \n(1) Retain Personal Data (PD), including metadata, for an organization-defined time period to fulfill the purpose(s) identified in the notice or as required by law;\n(2) Dispose of, destroys, erases, and/or anonymizes the PD, regardless of the method of storage; and\n(3) Use organization-defined techniques or methods to ensure secure deletion or destruction of PD (including originals, copies and archived records).", "justification": "Personal Data (PD) Retention & Disposal (PRI-30) provides privacy protection that compensates for the absence of Code Names (DCH-38) by applying alternative privacy safeguards to protect personal data and honor data subject rights. Given the data-handling focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "DCH-39", "risk_if_not_implemented": "Without Data Rights Management (DRM), sensitive and/or regulated data may be disclosed, altered or lost through inadequate classification, handling or protection. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Intellectual Property / Trade Secret Loss (R-EX-9), Loss of Confidentiality (R-IP-2), Loss of Data Integrity (R-IP-3), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Technical / Mechanical Failure (MT-10), Fraud, Corruption and/or Intentional Criminal Conduct (MT-14).", "compensating_control_1": { "control_id": "IAC-25", "name": "Access Enforcement", "description": "Mechanisms exist to enforce Logical Access Control (LAC) permissions that conform to the principle of \"least privilege.\"", "justification": "Access Enforcement (IAC-25) provides access control enforcement that compensates for the absence of Data Rights Management (DRM) (DCH-39) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the data-handling focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CRY-07", "name": "Encrypting Data At Rest", "description": "Cryptographic mechanisms exist to prevent the unauthorized disclosure of data at rest.", "justification": "Encrypting Data At Rest (CRY-07) provides cryptographic protection that compensates for the absence of Data Rights Management (DRM) (DCH-39) by ensuring data confidentiality and integrity through alternative technical means. Given the data-handling focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "DCH-40", "risk_if_not_implemented": "Without Data Loss Prevention (DLP), sensitive and/or regulated data may be exfiltrated, leaked or transferred outside authorized boundaries without detection. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Intellectual Property / Trade Secret Loss (R-EX-9), Loss of Confidentiality (R-IP-2), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Technical / Mechanical Failure (MT-10), Fraud, Corruption and/or Intentional Criminal Conduct (MT-14).", "compensating_control_1": { "control_id": "MON-19", "name": "Monitoring For Information Disclosure", "description": "Mechanisms exist to monitor for evidence of unauthorized exfiltration or disclosure of non-public information.", "justification": "Monitoring For Information Disclosure (MON-19) provides detective monitoring capability that compensates for the absence of Data Loss Prevention (DLP) (DCH-40) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "IAC-25", "name": "Access Enforcement", "description": "Mechanisms exist to enforce Logical Access Control (LAC) permissions that conform to the principle of \"least privilege.\"", "justification": "Access Enforcement (IAC-25) provides access control enforcement that compensates for the absence of Data Loss Prevention (DLP) (DCH-40) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "DCH-41", "risk_if_not_implemented": "Without Control Assurance Automation (CAA) Aggregated Telemetry, automated control assurance results may be manipulated, misattributed or lose integrity, causing misplaced confidence in control effectiveness. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss of Confidentiality (R-IP-2), and most likely increases susceptibility to Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "MON-05", "name": "Centralized Collection of Event Logs & Security-Relevant Telemetry", "description": "Mechanisms exist to utilize a Security Incident Event Manager (SIEM), or similar automated tool, to support the centralized collection of event logs and security-relevant telemetry.", "justification": "Centralized Collection of Event Logs & Security-Relevant Telemetry (MON-05) provides detective monitoring capability that compensates for the absence of Control Assurance Automation (CAA) Aggregated Telemetry (DCH-41) by identifying unauthorized, anomalous or non-compliant activity that the primary control would have prevented. Given the data-handling focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "MON-08", "name": "Correlate Monitoring Information", "description": "Automated mechanisms exist to correlate both technical and non-technical information from across the enterprise by a Security Incident Event Manager (SIEM) or similar automated tool, to enhance organization-wide situational awareness.", "justification": "Correlate Monitoring Information (MON-08) provides detective monitoring capability that compensates for the absence of Control Assurance Automation (CAA) Aggregated Telemetry (DCH-41) by identifying unauthorized, anomalous or non-compliant activity that the primary control would have prevented. Given the data-handling focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "EMB-03", "risk_if_not_implemented": "Without Separate Operating Environments For Embedded Technologies, embedded and IoT technologies may operate with unknown, insecure or unmonitored configurations, creating exploitable footholds. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Access (R-AC-4), System / Data Compromise (Technical Vector) (R-BC-4), System / Service Compromise (R-EX-7), OT Safety / Process Availability Failure (R-OT-1), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9), Technical / Mechanical Failure (MT-10), Operational Technology (OT) / Industrial Control System (ICS) Attack (MT-30).", "compensating_control_1": { "control_id": "NET-06", "name": "Network Segmentation (macrosegmentation)", "description": "Mechanisms exist to implement network segmentation within network architectures to isolate Technology Assets, Applications and/or Services (TAAS) from other network resources.", "justification": "Network Segmentation (macrosegmentation) (NET-06) provides network-level access restriction that compensates for the absence of Separate Operating Environments For Embedded Technologies (EMB-03) by limiting attacker reach and lateral movement opportunities across the environment. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "SEA-07", "name": "System Partitioning", "description": "Mechanisms exist to partition systems so that partitions reside in separate physical domains or environments.", "justification": "System Partitioning (SEA-07) provides network-level access restriction that compensates for the absence of Separate Operating Environments For Embedded Technologies (EMB-03) by limiting attacker reach and lateral movement opportunities across the environment. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "EMB-04", "risk_if_not_implemented": "Without Embedded Technology Inventory Management, embedded and IoT technologies may operate with unknown, insecure or unmonitored configurations, creating exploitable footholds. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss, Theft or Damage of Assets (R-AM-1), Exposure from Unaddressed Vulnerabilities (R-EX-6), Unaddressed Security / Compliance Exposure (R-GV-2), Undetected / Delayed Detection of Adverse Activity (R-SA-1), and most likely increases susceptibility to Human Error (MT-9), Technical / Mechanical Failure (MT-10), Data Quality Degradation / Data Poisoning (MT-12), Workforce Shortage / Loss of Critical Skills / Labor Disruption (MT-25).", "compensating_control_1": { "control_id": "AST-04", "name": "Asset Inventories", "description": "Mechanisms exist to perform inventories of Technology Assets, Applications, Services and/or Data (TAASD) that:\n(1) Accurately reflects the current TAASD in use; \n(2) Identifies authorized software products, including business justification details;\n(3) Is at the level of granularity deemed necessary for tracking and reporting;\n(4) Includes organization-defined information deemed necessary to achieve effective property accountability; and\n(5) Is available for review and audit by designated organizational personnel.", "justification": "Asset Inventories (AST-04) provides asset and inventory visibility that compensates for the absence of Embedded Technology Inventory Management (EMB-04) by providing the foundational asset knowledge needed to manage risks associated with the primary control. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "AST-09", "name": "Asset Discovery", "description": "Automated mechanisms exist to perform asset discovery to identify Technology Assets, Applications and/or Services (TAAS) connected to organizational networks, including assets not present in existing inventories.", "justification": "Asset Discovery (AST-09) provides asset and inventory visibility that compensates for the absence of Embedded Technology Inventory Management (EMB-04) by providing the foundational asset knowledge needed to manage risks associated with the primary control. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "EMB-05", "risk_if_not_implemented": "Without Internet of Things (IOT), embedded and IoT technologies may operate with unknown, insecure or unmonitored configurations, creating exploitable footholds. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Exposure from Unaddressed Vulnerabilities (R-EX-6), Unaddressed Security / Compliance Exposure (R-GV-2), Uncontrolled Internal Security / Privacy Exposure (R-GV-4), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Workforce Shortage / Loss of Critical Skills / Labor Disruption (MT-25).", "compensating_control_1": { "control_id": "NET-06", "name": "Network Segmentation (macrosegmentation)", "description": "Mechanisms exist to implement network segmentation within network architectures to isolate Technology Assets, Applications and/or Services (TAAS) from other network resources.", "justification": "Network Segmentation (macrosegmentation) (NET-06) provides network-level access restriction that compensates for the absence of Internet of Things (IOT) (EMB-05) by limiting attacker reach and lateral movement opportunities across the environment. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CFG-04", "name": "Secure Baseline Configurations", "description": "Mechanisms exist to develop, document and maintain secure baseline configurations for Technology Assets, Applications and/or Services (TAAS) that are consistent with industry-accepted hardening standards.", "justification": "Secure Baseline Configurations (CFG-04) provides configuration hardening that compensates for the absence of Internet of Things (IOT) (EMB-05) by eliminating unnecessary services and enforcing secure settings to reduce inherent exposure. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "EMB-06", "risk_if_not_implemented": "Without Operational Technology (OT), Operational Technology (OT) and embedded systems may fail unsafely or be manipulated, endangering personnel, physical assets and process availability. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Exposure from Unaddressed Vulnerabilities (R-EX-6), Unaddressed Security / Compliance Exposure (R-GV-2), Uncontrolled Internal Security / Privacy Exposure (R-GV-4), OT Safety / Process Availability Failure (R-OT-1), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Workforce Shortage / Loss of Critical Skills / Labor Disruption (MT-25), Operational Technology (OT) / Industrial Control System (ICS) Attack (MT-30).", "compensating_control_1": { "control_id": "NET-06", "name": "Network Segmentation (macrosegmentation)", "description": "Mechanisms exist to implement network segmentation within network architectures to isolate Technology Assets, Applications and/or Services (TAAS) from other network resources.", "justification": "Network Segmentation (macrosegmentation) (NET-06) provides network-level access restriction that compensates for the absence of Operational Technology (OT) (EMB-06) by limiting attacker reach and lateral movement opportunities across the environment. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CFG-04", "name": "Secure Baseline Configurations", "description": "Mechanisms exist to develop, document and maintain secure baseline configurations for Technology Assets, Applications and/or Services (TAAS) that are consistent with industry-accepted hardening standards.", "justification": "Secure Baseline Configurations (CFG-04) provides configuration hardening that compensates for the absence of Operational Technology (OT) (EMB-06) by eliminating unnecessary services and enforcing secure settings to reduce inherent exposure. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "EMB-07", "risk_if_not_implemented": "Without Interface Security, embedded and IoT technologies may operate with unknown, insecure or unmonitored configurations, creating exploitable footholds. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to R-AC-3, R-AC-4, R-AM-2, R-BC-5, R-SC-5, R-OT-1, and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Physical Crime (MT-5), Product Defect / Design Failure (MT-23), Operational Technology (OT) / Industrial Control System (ICS) Attack (MT-30).", "compensating_control_1": { "control_id": "NET-03", "name": "Boundary Protection", "description": "Mechanisms exist to monitor and control communications at the external network boundary and at key internal boundaries within the network.", "justification": "Boundary Protection (NET-03) provides network-level access restriction that compensates for the absence of Interface Security (EMB-07) by limiting attacker reach and lateral movement opportunities across the environment. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CFG-04", "name": "Secure Baseline Configurations", "description": "Mechanisms exist to develop, document and maintain secure baseline configurations for Technology Assets, Applications and/or Services (TAAS) that are consistent with industry-accepted hardening standards.", "justification": "Secure Baseline Configurations (CFG-04) provides configuration hardening that compensates for the absence of Interface Security (EMB-07) by eliminating unnecessary services and enforcing secure settings to reduce inherent exposure. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "EMB-08", "risk_if_not_implemented": "Without Embedded Technology Configuration Monitoring, embedded and IoT technologies may operate with unknown, insecure or unmonitored configurations, creating exploitable footholds. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss of Accountability / Attribution (R-AC-1), Loss of Investigative / Evidentiary Capability (R-IR-1), Undetected / Delayed Detection of Adverse Activity (R-SA-1), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Technical / Mechanical Failure (MT-10), Operational Technology (OT) / Industrial Control System (ICS) Attack (MT-30).", "compensating_control_1": { "control_id": "MON-02", "name": "Continuous Monitoring", "description": "Mechanisms exist to facilitate the implementation of enterprise-wide monitoring controls.", "justification": "Continuous Monitoring (MON-02) provides detective monitoring capability that compensates for the absence of Embedded Technology Configuration Monitoring (EMB-08) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CFG-08.2", "name": "Integrity Assurance & Enforcement (IAE)", "description": "Automated mechanisms exist to:\n(1) Identify unauthorized deviations from an approved secure baseline configuration; and\n(2) Implement automated resiliency actions to remediate the unauthorized change.", "justification": "Integrity Assurance & Enforcement (IAE) (CFG-08.2) provides configuration hardening that compensates for the absence of Embedded Technology Configuration Monitoring (EMB-08) by eliminating unnecessary services and enforcing secure settings to reduce inherent exposure. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "EMB-09", "risk_if_not_implemented": "Without Prevent Alterations, embedded and IoT technologies may operate with unknown, insecure or unmonitored configurations, creating exploitable footholds. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Modification / Loss of System Integrity (R-AM-2), System / Data Compromise (Technical Vector) (R-BC-4), System / Service Compromise (R-EX-7), OT Safety / Process Availability Failure (R-OT-1), Loss of Authenticity / Provenance (R-IP-5), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Technical / Mechanical Failure (MT-10), Operational Technology (OT) / Industrial Control System (ICS) Attack (MT-30).", "compensating_control_1": { "control_id": "CFG-08.2", "name": "Integrity Assurance & Enforcement (IAE)", "description": "Automated mechanisms exist to:\n(1) Identify unauthorized deviations from an approved secure baseline configuration; and\n(2) Implement automated resiliency actions to remediate the unauthorized change.", "justification": "Integrity Assurance & Enforcement (IAE) (CFG-08.2) provides configuration hardening that compensates for the absence of Prevent Alterations (EMB-09) by eliminating unnecessary services and enforcing secure settings to reduce inherent exposure. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "MON-02", "name": "Continuous Monitoring", "description": "Mechanisms exist to facilitate the implementation of enterprise-wide monitoring controls.", "justification": "Continuous Monitoring (MON-02) provides detective monitoring capability that compensates for the absence of Prevent Alterations (EMB-09) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "EMB-10", "risk_if_not_implemented": "Without Embedded Technology Maintenance, embedded and IoT technologies may operate with unknown, insecure or unmonitored configurations, creating exploitable footholds. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Modification / Loss of System Integrity (R-AM-2), Exposure from Unaddressed Vulnerabilities (R-EX-6), Loss of Authenticity / Provenance (R-IP-5), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9), Technical / Mechanical Failure (MT-10), Supplier Financial Distress / Insolvency (MT-24), Workforce Shortage / Loss of Critical Skills / Labor Disruption (MT-25).", "compensating_control_1": { "control_id": "MNT-02", "name": "Maintenance Operations", "description": "Mechanisms exist to develop, disseminate, review & update procedures to facilitate the implementation of maintenance controls across the enterprise.", "justification": "Maintenance Operations (MNT-02) provides overlapping security capability that compensates for the absence of Embedded Technology Maintenance (EMB-10) by addressing related risk objectives through an alternative control mechanism aligned with Technology applicability. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CFG-02", "name": "Configuration Management Program", "description": "Mechanisms exist to facilitate the implementation of configuration management controls.", "justification": "Configuration Management Program (CFG-02) provides policy-level governance that compensates for the absence of Embedded Technology Maintenance (EMB-10) by establishing documented expectations, accountability structures, and organizational guardrails. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "EMB-11", "risk_if_not_implemented": "Without Resilience To Outages, critical business processes and services may not withstand or recover from disruption, causing extended outages and data loss. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Business / Service Interruption (R-BC-1), Recovery Failure / Unacceptable Recovery Delay (R-OR-1), OT Safety / Process Availability Failure (R-OT-1), Loss of Data / Service Availability (R-IP-4), and most likely increases susceptibility to natural threats NT-2, NT-3, NT-4, NT-5, NT-6, NT-8, NT-10, NT-11, NT-12, NT-13, NT-14; Utility Service Disruption (MT-7), Human Error (MT-9), Technical / Mechanical Failure (MT-10), Infrastructure Failure / Degradation (MT-27).", "compensating_control_1": { "control_id": "BCD-02", "name": "Business Continuity Management System (BCMS)", "description": "Mechanisms exist to operate a Business Continuity Management System (BCMS) to achieve resilient Technology Assets, Applications, Services and/or Data (TAASD) during:\n(1) Routine operations; and\n(2) Adverse conditions.", "justification": "Business Continuity Management System (BCMS) (BCD-02) provides resilience and recovery capability that compensates for the absence of Resilience To Outages (EMB-11) by ensuring the organization can restore operations and data when the primary control is absent. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CAP-02", "name": "Capacity & Performance Management", "description": "Mechanisms exist to facilitate the implementation of capacity management controls to ensure optimal system performance to meet expected and anticipated future capacity requirements.", "justification": "Capacity & Performance Management (CAP-02) provides overlapping security capability that compensates for the absence of Resilience To Outages (EMB-11) by addressing related risk objectives through an alternative control mechanism aligned with Technology applicability. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "EMB-12", "risk_if_not_implemented": "Without Power Level Monitoring, malicious, anomalous or unauthorized activity may go undetected or be detected too late to prevent or limit harm. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Undetected / Delayed Detection of Adverse Activity (R-SA-1), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Technical / Mechanical Failure (MT-10), Data Quality Degradation / Data Poisoning (MT-12).", "compensating_control_1": { "control_id": "MON-02", "name": "Continuous Monitoring", "description": "Mechanisms exist to facilitate the implementation of enterprise-wide monitoring controls.", "justification": "Continuous Monitoring (MON-02) provides detective monitoring capability that compensates for the absence of Power Level Monitoring (EMB-12) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "PES-20", "name": "Supporting Utilities", "description": "Facility security mechanisms exist to protect power equipment and power cabling for the system from damage and destruction.", "justification": "Supporting Utilities (PES-20) provides overlapping security capability that compensates for the absence of Power Level Monitoring (EMB-12) by addressing related risk objectives through an alternative control mechanism aligned with Technology applicability. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "EMB-13", "risk_if_not_implemented": "Without Embedded Technology Reviews, embedded and IoT technologies may operate with unknown, insecure or unmonitored configurations, creating exploitable footholds. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Exposure from Unaddressed Vulnerabilities (R-EX-6), Lack of oversight of internal controls (R-GV-6), Inability to Demonstrate Due Diligence / Due Care (R-GV-9), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Workforce Shortage / Loss of Critical Skills / Labor Disruption (MT-25).", "compensating_control_1": { "control_id": "CPL-05", "name": "Conformity Monitoring", "description": "Mechanisms exist to validate that Technology Assets, Applications, Services and/or Data (TAASD) conform to the organization's security, compliance and/or resilience policies, standards and other applicable requirements.", "justification": "Conformity Monitoring (CPL-05) provides periodic assessment and assurance that compensates for the absence of Embedded Technology Reviews (EMB-13) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "MON-02", "name": "Continuous Monitoring", "description": "Mechanisms exist to facilitate the implementation of enterprise-wide monitoring controls.", "justification": "Continuous Monitoring (MON-02) provides detective monitoring capability that compensates for the absence of Embedded Technology Reviews (EMB-13) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "EMB-14", "risk_if_not_implemented": "Without Message Queuing Telemetry Transport (MQTT) Security, embedded and IoT technologies may operate with unknown, insecure or unmonitored configurations, creating exploitable footholds. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Access (R-AC-4), Loss of Confidentiality (R-IP-2), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Technical / Mechanical Failure (MT-10), Operational Technology (OT) / Industrial Control System (ICS) Attack (MT-30).", "compensating_control_1": { "control_id": "CRY-05", "name": "Encrypting Data In Transit", "description": "Cryptographic mechanisms exist to prevent the unauthorized disclosure of data in transit.", "justification": "Encrypting Data In Transit (CRY-05) provides cryptographic protection that compensates for the absence of Message Queuing Telemetry Transport (MQTT) Security (EMB-14) by ensuring data confidentiality and integrity through alternative technical means. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "IAC-25", "name": "Access Enforcement", "description": "Mechanisms exist to enforce Logical Access Control (LAC) permissions that conform to the principle of \"least privilege.\"", "justification": "Access Enforcement (IAC-25) provides access control enforcement that compensates for the absence of Message Queuing Telemetry Transport (MQTT) Security (EMB-14) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "EMB-15", "risk_if_not_implemented": "Without Remote Management of Embedded Technologies, embedded and IoT technologies may operate with unknown, insecure or unmonitored configurations, creating exploitable footholds. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Access (R-AC-4), Identity Compromise / Impersonation (R-AC-5), Unauthorized Modification / Loss of System Integrity (R-AM-2), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Technical / Mechanical Failure (MT-10), Operational Technology (OT) / Industrial Control System (ICS) Attack (MT-30).", "compensating_control_1": { "control_id": "NET-26", "name": "Remote Access", "description": "Mechanisms exist to define, control and review organization-approved, secure remote access methods.", "justification": "Remote Access (NET-26) provides network-level access restriction that compensates for the absence of Remote Management of Embedded Technologies (EMB-15) by limiting attacker reach and lateral movement opportunities across the environment. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "IAC-37", "name": "Multi-Factor Authentication (MFA)", "description": "Automated mechanisms exist to enforce Multi-Factor Authentication (MFA) for:\n(1) Remote network access; \n(2) Third-party Technology Assets, Applications and/or Services (TAAS); and/ or\n(3) Non-console access to critical TAAS that store, transmit and/or process sensitive and/or regulated data.", "justification": "Multi-Factor Authentication (MFA) (IAC-37) provides access control enforcement that compensates for the absence of Remote Management of Embedded Technologies (EMB-15) by restricting system and data access through alternative identity and access management mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "EMB-16", "risk_if_not_implemented": "Without Restrict Communications, embedded and IoT technologies may operate with unknown, insecure or unmonitored configurations, creating exploitable footholds. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Access (R-AC-4), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Technical / Mechanical Failure (MT-10), Operational Technology (OT) / Industrial Control System (ICS) Attack (MT-30).", "compensating_control_1": { "control_id": "NET-03", "name": "Boundary Protection", "description": "Mechanisms exist to monitor and control communications at the external network boundary and at key internal boundaries within the network.", "justification": "Boundary Protection (NET-03) provides network-level access restriction that compensates for the absence of Restrict Communications (EMB-16) by limiting attacker reach and lateral movement opportunities across the environment. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CFG-03", "name": "Least Functionality", "description": "Mechanisms exist to configure Technology Assets, Applications and/or Services (TAAS) to provide only essential capabilities by specifically prohibiting or restricting the use of ports, protocols, and/or services.", "justification": "Least Functionality (CFG-03) provides configuration hardening that compensates for the absence of Restrict Communications (EMB-16) by eliminating unnecessary services and enforcing secure settings to reduce inherent exposure. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "EMB-17", "risk_if_not_implemented": "Without Authorized Communications, embedded and IoT technologies may operate with unknown, insecure or unmonitored configurations, creating exploitable footholds. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Access (R-AC-4), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Technical / Mechanical Failure (MT-10), Operational Technology (OT) / Industrial Control System (ICS) Attack (MT-30).", "compensating_control_1": { "control_id": "IAC-25", "name": "Access Enforcement", "description": "Mechanisms exist to enforce Logical Access Control (LAC) permissions that conform to the principle of \"least privilege.\"", "justification": "Access Enforcement (IAC-25) provides access control enforcement that compensates for the absence of Authorized Communications (EMB-17) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "NET-04", "name": "Data Flow Enforcement – Access Control Lists (ACLs)", "description": "Mechanisms exist to implement and govern Access Control Lists (ACLs) to provide data flow enforcement that explicitly restrict network traffic to only what is authorized.", "justification": "Data Flow Enforcement – Access Control Lists (ACLs) (NET-04) provides access control enforcement that compensates for the absence of Authorized Communications (EMB-17) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "EMB-18", "risk_if_not_implemented": "Without Operating Environment Certification, embedded and IoT technologies may operate with unknown, insecure or unmonitored configurations, creating exploitable footholds. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss of Authorization / Certification / License (R-EX-11), and most likely increases susceptibility to Human Error (MT-9).", "compensating_control_1": { "control_id": "CPL-02", "name": "Statutory, Regulatory & Contractual Compliance", "description": "Mechanisms exist to facilitate the identification and implementation of relevant statutory, regulatory and contractual controls.", "justification": "Statutory, Regulatory & Contractual Compliance (CPL-02) provides overlapping security capability that compensates for the absence of Operating Environment Certification (EMB-18) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "IAO-04", "name": "Control Validation Testing (CVT)", "description": "Mechanisms exist to formally assess the security, compliance and resilience controls in Technology Assets, Applications and/or Services (TAAS) through Information Assurance Program (IAP) activities to determine the extent to which the controls are implemented correctly, operating as intended and producing the desired outcome with respect to meeting expected requirements.", "justification": "Control Validation Testing (CVT) (IAO-04) provides periodic assessment and assurance that compensates for the absence of Operating Environment Certification (EMB-18) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "EMB-19", "risk_if_not_implemented": "Without Safety Assessment, Operational Technology (OT) and embedded systems may fail unsafely or be manipulated, endangering personnel, physical assets and process availability. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Harm from Unauthorized / Unintended Product or Service Use (R-SC-5), and most likely increases susceptibility to Human Error (MT-9).", "compensating_control_1": { "control_id": "RSK-13", "name": "Risk Assessment", "description": "Mechanisms exist to conduct recurring assessments of risk that includes the likelihood and magnitude of harm, from unauthorized access, use, disclosure, disruption, modification or destruction of the organization's Technology Assets, Applications, Services and/or Data (TAASD).", "justification": "Risk Assessment (RSK-13) provides periodic assessment and assurance that compensates for the absence of Safety Assessment (EMB-19) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CPL-05", "name": "Conformity Monitoring", "description": "Mechanisms exist to validate that Technology Assets, Applications, Services and/or Data (TAASD) conform to the organization's security, compliance and/or resilience policies, standards and other applicable requirements.", "justification": "Conformity Monitoring (CPL-05) provides periodic assessment and assurance that compensates for the absence of Safety Assessment (EMB-19) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "EMB-20", "risk_if_not_implemented": "Without Certificate-Based Authentication, data in transit and at rest may be exposed through weak, misconfigured or compromised cryptographic protections. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Access (R-AC-4), Identity Compromise / Impersonation (R-AC-5), Loss of Authenticity / Provenance (R-IP-5), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Technical / Mechanical Failure (MT-10), Operational Technology (OT) / Industrial Control System (ICS) Attack (MT-30), Cryptographic Compromise / Cryptanalytic Capability Advancement (MT-31).", "compensating_control_1": { "control_id": "IAC-38", "name": "Cryptographic Module Authentication", "description": "Automated mechanisms exist to enable Technology Assets, Applications and/or Services (TAAS) to authenticate to a cryptographic module.", "justification": "Cryptographic Module Authentication (IAC-38) provides cryptographic protection that compensates for the absence of Certificate-Based Authentication (EMB-20) by ensuring data confidentiality and integrity through alternative technical means. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "IAC-37", "name": "Multi-Factor Authentication (MFA)", "description": "Automated mechanisms exist to enforce Multi-Factor Authentication (MFA) for:\n(1) Remote network access; \n(2) Third-party Technology Assets, Applications and/or Services (TAAS); and/ or\n(3) Non-console access to critical TAAS that store, transmit and/or process sensitive and/or regulated data.", "justification": "Multi-Factor Authentication (MFA) (IAC-37) provides access control enforcement that compensates for the absence of Certificate-Based Authentication (EMB-20) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "EMB-21", "risk_if_not_implemented": "Without Chip-To-Cloud Security, embedded and IoT technologies may operate with unknown, insecure or unmonitored configurations, creating exploitable footholds. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Modification / Loss of System Integrity (R-AM-2), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Technical / Mechanical Failure (MT-10), Operational Technology (OT) / Industrial Control System (ICS) Attack (MT-30).", "compensating_control_1": { "control_id": "CRY-02", "name": "Use of Cryptographic Controls", "description": "Mechanisms exist to facilitate the implementation of cryptographic protections controls using known public standards and trusted cryptographic technologies.", "justification": "Use of Cryptographic Controls (CRY-02) provides cryptographic protection that compensates for the absence of Chip-To-Cloud Security (EMB-21) by ensuring data confidentiality and integrity through alternative technical means. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "NET-03", "name": "Boundary Protection", "description": "Mechanisms exist to monitor and control communications at the external network boundary and at key internal boundaries within the network.", "justification": "Boundary Protection (NET-03) provides network-level access restriction that compensates for the absence of Chip-To-Cloud Security (EMB-21) by limiting attacker reach and lateral movement opportunities across the environment. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "EMB-22", "risk_if_not_implemented": "Without Real-Time Operating System (RTOS) Security, embedded and IoT technologies may operate with unknown, insecure or unmonitored configurations, creating exploitable footholds. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Modification / Loss of System Integrity (R-AM-2), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9), Technical / Mechanical Failure (MT-10), Operational Technology (OT) / Industrial Control System (ICS) Attack (MT-30).", "compensating_control_1": { "control_id": "CFG-04", "name": "Secure Baseline Configurations", "description": "Mechanisms exist to develop, document and maintain secure baseline configurations for Technology Assets, Applications and/or Services (TAAS) that are consistent with industry-accepted hardening standards.", "justification": "Secure Baseline Configurations (CFG-04) provides configuration hardening that compensates for the absence of Real-Time Operating System (RTOS) Security (EMB-22) by eliminating unnecessary services and enforcing secure settings to reduce inherent exposure. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "VPM-08", "name": "Software & Firmware Patching", "description": "Mechanisms exist to conduct software patching for all deployed Technology Assets, Applications and/or Services (TAAS), including firmware.", "justification": "Software & Firmware Patching (VPM-08) provides vulnerability management that compensates for the absence of Real-Time Operating System (RTOS) Security (EMB-22) by reducing the exploitable attack surface by addressing known weaknesses before they are leveraged. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "EMB-23", "risk_if_not_implemented": "Without Safe Operations, Operational Technology (OT) and embedded systems may fail unsafely or be manipulated, endangering personnel, physical assets and process availability. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to R-SA-1, R-AI-3, R-AI-5, R-OT-1, R-SF-1, R-SF-2, and most likely increases susceptibility to Technical / Mechanical Failure (MT-10), Data Quality Degradation / Data Poisoning (MT-12), Artificial Intelligence & Autonomous Technologies (AAT) System Failure or Unintended Behavior (MT-13), Operational Technology (OT) / Industrial Control System (ICS) Attack (MT-30).", "compensating_control_1": { "control_id": "EMB-19", "name": "Safety Assessment", "description": "Mechanisms exist to evaluate the safety aspects of embedded technologies via a fault tree analysis, or similar method, to determine possible consequences of misuse, misconfiguration and/or failure.", "justification": "Safety Assessment (EMB-23) provides periodic assessment and assurance that compensates for the absence of Safe Operations (EMB-23) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "RSK-13", "name": "Risk Assessment", "description": "Mechanisms exist to conduct recurring assessments of risk that includes the likelihood and magnitude of harm, from unauthorized access, use, disclosure, disruption, modification or destruction of the organization's Technology Assets, Applications, Services and/or Data (TAASD).", "justification": "Risk Assessment (RSK-13) provides periodic assessment and assurance that compensates for the absence of Safe Operations (EMB-23) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "EMB-24", "risk_if_not_implemented": "Without Proximity Sensor, embedded and IoT technologies may operate with unknown, insecure or unmonitored configurations, creating exploitable footholds. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Undetected / Delayed Detection of Adverse Activity (R-SA-1), Unauthorized / Harmful Autonomous Action (R-AI-3), OT Safety / Process Availability Failure (R-OT-1), Injury / Loss of Life (R-SF-1), Physical / Environmental Damage (R-SF-2), and most likely increases susceptibility to Technical / Mechanical Failure (MT-10), Data Quality Degradation / Data Poisoning (MT-12), Artificial Intelligence & Autonomous Technologies (AAT) System Failure or Unintended Behavior (MT-13), Operational Technology (OT) / Industrial Control System (ICS) Attack (MT-30).", "compensating_control_1": { "control_id": "PES-08", "name": "Physical Access Control", "description": "Physical access control mechanisms exist to enforce physical access authorizations for all physical access points (including designated entry/exit points) to facilities (excluding those areas within the facility officially designated as publicly accessible).", "justification": "Physical Access Control (PES-08) provides access control enforcement that compensates for the absence of Proximity Sensor (EMB-24) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "MON-02", "name": "Continuous Monitoring", "description": "Mechanisms exist to facilitate the implementation of enterprise-wide monitoring controls.", "justification": "Continuous Monitoring (MON-02) provides detective monitoring capability that compensates for the absence of Proximity Sensor (EMB-24) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "EMB-25", "risk_if_not_implemented": "Without Safety Instrumented System (SIS), Operational Technology (OT) and embedded systems may fail unsafely or be manipulated, endangering personnel, physical assets and process availability. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Undetected / Delayed Detection of Adverse Activity (R-SA-1), OT Safety / Process Availability Failure (R-OT-1), Injury / Loss of Life (R-SF-1), Physical / Environmental Damage (R-SF-2), and most likely increases susceptibility to Technical / Mechanical Failure (MT-10), Data Quality Degradation / Data Poisoning (MT-12), Operational Technology (OT) / Industrial Control System (ICS) Attack (MT-30).", "compensating_control_1": { "control_id": "EMB-23", "name": "Safe Operations", "description": "Mechanisms exist to continuously validate autonomous systems that trigger an automatic state change when safe operation is no longer assured.", "justification": "Safe Operations (EMB-23) provides safety assurance that compensates for the absence of Safety Instrumented System (SIS) (EMB-25) by providing alternative safety controls that reduce the likelihood and impact of unsafe conditions. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "EMB-19", "name": "Safety Assessment", "description": "Mechanisms exist to evaluate the safety aspects of embedded technologies via a fault tree analysis, or similar method, to determine possible consequences of misuse, misconfiguration and/or failure.", "justification": "Safety Assessment (EMB-19) provides periodic assessment and verification that compensates for the absence of Safety Instrumented System (SIS) (EMB-25) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "EMB-26", "risk_if_not_implemented": "Without Safety Instrumented Function (SIF), Operational Technology (OT) and embedded systems may fail unsafely or be manipulated, endangering personnel, physical assets and process availability. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Undetected / Delayed Detection of Adverse Activity (R-SA-1), OT Safety / Process Availability Failure (R-OT-1), Injury / Loss of Life (R-SF-1), Physical / Environmental Damage (R-SF-2), and most likely increases susceptibility to Utility Service Disruption (MT-7), Human Error (MT-9), Technical / Mechanical Failure (MT-10), Operational Technology (OT) / Industrial Control System (ICS) Attack (MT-30).", "compensating_control_1": { "control_id": "EMB-25", "name": "Safety Instrumented System (SIS)", "description": "Automated mechanisms exist to monitor and control hazardous processes to reduce the potential negative consequences of hazardous events.", "justification": "Safety Instrumented System (SIS) (EMB-25) provides safety assurance that compensates for the absence of Safety Instrumented Function (SIF) (EMB-26) by providing alternative safety controls that reduce the likelihood and impact of unsafe conditions. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "EMB-23", "name": "Safe Operations", "description": "Mechanisms exist to continuously validate autonomous systems that trigger an automatic state change when safe operation is no longer assured.", "justification": "Safe Operations (EMB-23) provides safety assurance that compensates for the absence of Safety Instrumented Function (SIF) (EMB-26) by providing alternative safety controls that reduce the likelihood and impact of unsafe conditions. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "EMB-27", "risk_if_not_implemented": "Without Safety Integrity Level (SIL), Operational Technology (OT) and embedded systems may fail unsafely or be manipulated, endangering personnel, physical assets and process availability. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unaddressed Security / Compliance Exposure (R-GV-2), and most likely increases susceptibility to Human Error (MT-9).", "compensating_control_1": { "control_id": "EMB-19", "name": "Safety Assessment", "description": "Mechanisms exist to evaluate the safety aspects of embedded technologies via a fault tree analysis, or similar method, to determine possible consequences of misuse, misconfiguration and/or failure.", "justification": "Safety Assessment (EMB-19) provides periodic assessment and verification that compensates for the absence of Safety Integrity Level (SIL) (EMB-27) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "EMB-25", "name": "Safety Instrumented System (SIS)", "description": "Automated mechanisms exist to monitor and control hazardous processes to reduce the potential negative consequences of hazardous events.", "justification": "Safety Instrumented System (SIS) (EMB-25) provides safety assurance that compensates for the absence of Safety Integrity Level (SIL) (EMB-27) by providing alternative safety controls that reduce the likelihood and impact of unsafe conditions. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "END-03", "risk_if_not_implemented": "Without Endpoint Protection Mechanisms, Technology Assets, Applications and/or Services (TAAS) may operate with insecure, unauthorized or drifted configurations that expand the attack surface. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Modification / Loss of System Integrity (R-AM-2), System / Data Compromise (Technical Vector) (R-BC-4), System / Service Compromise (R-EX-7), Loss of Confidentiality (R-IP-2), Loss of Data Integrity (R-IP-3), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "CFG-04", "name": "Secure Baseline Configurations", "description": "Mechanisms exist to develop, document and maintain secure baseline configurations for Technology Assets, Applications and/or Services (TAAS) that are consistent with industry-accepted hardening standards.", "justification": "Secure Baseline Configurations (CFG-04) provides configuration hardening that compensates for the absence of Endpoint Protection Measures (END-03) by eliminating unnecessary services and enforcing secure settings to reduce inherent exposure. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "VPM-02", "name": "Vulnerability & Patch Management Program (VPMP)", "description": "Mechanisms exist to facilitate the implementation and monitoring of risk-based vulnerability management capabilities.", "justification": "Vulnerability & Patch Management Program (VPMP) (VPM-02) provides policy-level governance that compensates for the absence of Endpoint Protection Measures (END-03) by establishing documented expectations, accountability structures, and organizational guardrails. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "END-03.1", "risk_if_not_implemented": "Without Centralized Management of Endpoint Protection Mechanisms, Technology Assets, Applications and/or Services (TAAS) may operate with insecure, unauthorized or drifted configurations that expand the attack surface. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Undetected / Delayed Detection of Adverse Activity (R-SA-1), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "CFG-04", "name": "Secure Baseline Configurations", "description": "Mechanisms exist to develop, document and maintain secure baseline configurations for Technology Assets, Applications and/or Services (TAAS) that are consistent with industry-accepted hardening standards.", "justification": "Secure Baseline Configurations (CFG-04) provides configuration hardening that compensates for the absence of Centralized Management of Antimalware Technologies (END-04.3) by eliminating unnecessary services and enforcing secure settings to reduce inherent exposure. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "END-04", "name": "Malicious Code Protection (Antimalware)", "description": "Mechanisms exist to utilize antimalware, or similar technologies, to detect and eradicate malicious code.", "justification": "Malicious Code Protection (Antimalware) (END-04) provides overlapping security capability that compensates for the absence of Centralized Management of Antimalware Technologies (END-04.3) by addressing related risk objectives through an alternative control mechanism aligned with Technology applicability. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "END-03.2", "risk_if_not_implemented": "Without Automatic Endpoint Protection Mechanism Updates, Technology Assets, Applications and/or Services (TAAS) may operate with insecure, unauthorized or drifted configurations that expand the attack surface. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Exposure from Unaddressed Vulnerabilities (R-EX-6), and most likely increases susceptibility to Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "VPM-08", "name": "Software & Firmware Patching", "description": "Mechanisms exist to conduct software patching for all deployed Technology Assets, Applications and/or Services (TAAS), including firmware.", "justification": "Software & Firmware Patching (VPM-08) provides vulnerability management that compensates for the absence of Automatic Antimalware Signature Updates (END-04.1) by reducing the exploitable attack surface by addressing known weaknesses before they are leveraged. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CFG-04", "name": "Secure Baseline Configurations", "description": "Mechanisms exist to develop, document and maintain secure baseline configurations for Technology Assets, Applications and/or Services (TAAS) that are consistent with industry-accepted hardening standards.", "justification": "Secure Baseline Configurations (CFG-04) provides configuration hardening that compensates for the absence of Automatic Antimalware Signature Updates (END-04.1) by eliminating unnecessary services and enforcing secure settings to reduce inherent exposure. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "END-03.3", "risk_if_not_implemented": "Without Evolving Endpoint Protection Threats, Technology Assets, Applications and/or Services (TAAS) may operate with insecure, unauthorized or drifted configurations that expand the attack surface. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unaddressed Security / Compliance Exposure (R-GV-2), and most likely increases susceptibility to Human Error (MT-9).", "compensating_control_1": { "control_id": "MON-02", "name": "Continuous Monitoring", "description": "Mechanisms exist to facilitate the implementation of enterprise-wide monitoring controls.", "justification": "Continuous Monitoring (MON-02) provides detective monitoring capability that compensates for the absence of Evolving Malware Threats (END-03.3) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CFG-04", "name": "Secure Baseline Configurations", "description": "Mechanisms exist to develop, document and maintain secure baseline configurations for Technology Assets, Applications and/or Services (TAAS) that are consistent with industry-accepted hardening standards.", "justification": "Secure Baseline Configurations (CFG-04) provides configuration hardening that compensates for the absence of Evolving Malware Threats (END-03.3) by eliminating unnecessary services and enforcing secure settings to reduce inherent exposure. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "END-03.4", "risk_if_not_implemented": "Without Binary or Machine-Executable Code, applications may be built and deployed with exploitable design and coding weaknesses that adversaries can leverage. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss of Authenticity / Provenance (R-IP-5), and most likely increases susceptibility to Human Error (MT-9), Counterfeit / Non-Conforming Products (MT-20).", "compensating_control_1": { "control_id": "MON-28", "name": "File Activity Monitoring (FAM)", "description": "Automated mechanisms exist to monitor sensitive and/or regulated data in Technology Assets, Applications and/or Services (TAAS) and data repositories.", "justification": "File Activity Monitoring (FAM) (MON-28) provides detective monitoring capability that compensates for the absence of Binary or Machine-Executable Code (END-03.4) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "END-11", "name": "Endpoint File Integrity Monitoring (FIM)", "description": "Mechanisms exist to utilize File Integrity Monitor (FIM), or similar technologies, to detect and report on unauthorized changes to selected files and configuration settings.", "justification": "Endpoint File Integrity Monitoring (FIM) (END-11) provides detective monitoring capability that compensates for the absence of Binary or Machine-Executable Code (END-03.4) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "END-04.1", "risk_if_not_implemented": "Without Always On Antimalware Protection, Technology Assets, Applications and/or Services (TAAS) may operate with insecure, unauthorized or drifted configurations that expand the attack surface. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to System / Data Compromise (Technical Vector) (R-BC-4), System / Service Compromise (R-EX-7), Undetected / Delayed Detection of Adverse Activity (R-SA-1), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Dysfunctional Management Practices (MT-8), Human Error (MT-9), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "VPM-08", "name": "Software & Firmware Patching", "description": "Mechanisms exist to conduct software patching for all deployed Technology Assets, Applications and/or Services (TAAS), including firmware.", "justification": "Software & Firmware Patching (VPM-08) provides vulnerability management that compensates for the absence of Always On Protection (END-04.1) by reducing the exploitable attack surface by addressing known weaknesses before they are leveraged. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "MON-02", "name": "Continuous Monitoring", "description": "Mechanisms exist to facilitate the implementation of enterprise-wide monitoring controls.", "justification": "Continuous Monitoring (MON-02) provides detective monitoring capability that compensates for the absence of Always On Protection (END-04.1) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "END-04.2", "risk_if_not_implemented": "Without Heuristic / Nonsignature-Based Malware Detection, malicious, anomalous or unauthorized activity may go undetected or be detected too late to prevent or limit harm. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to System / Data Compromise (Technical Vector) (R-BC-4), System / Service Compromise (R-EX-7), Undetected / Delayed Detection of Adverse Activity (R-SA-1), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "VPM-08", "name": "Software & Firmware Patching", "description": "Mechanisms exist to conduct software patching for all deployed Technology Assets, Applications and/or Services (TAAS), including firmware.", "justification": "Software & Firmware Patching (VPM-08) provides vulnerability management that compensates for the absence of Heuristic / Nonsignature-Based Detection (END-04.2) by reducing the exploitable attack surface by addressing known weaknesses before they are leveraged. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "END-04", "name": "Malicious Code Protection (Antimalware)", "description": "Mechanisms exist to utilize antimalware, or similar technologies, to detect and eradicate malicious code.", "justification": "Malicious Code Protection (Antimalware) (END-04) provides overlapping security capability that compensates for the absence of Heuristic / Nonsignature-Based Detection (END-04.2) by addressing related risk objectives through an alternative control mechanism aligned with Technology applicability. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "END-05", "risk_if_not_implemented": "Without Antimalware Protection Mechanism Testing, Technology Assets, Applications and/or Services (TAAS) may operate with insecure, unauthorized or drifted configurations that expand the attack surface. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Lack of oversight of internal controls (R-GV-6), Unreliable Assurance / Decision Information (R-GV-10), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9).", "compensating_control_1": { "control_id": "END-04", "name": "Malicious Code Protection (Antimalware)", "description": "Mechanisms exist to utilize antimalware, or similar technologies, to detect and eradicate malicious code.", "justification": "Malicious Code Protection (Antimalware) (END-04) provides overlapping security capability that compensates for the absence of Malware Protection Mechanism Testing (END-05) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "MON-02", "name": "Continuous Monitoring", "description": "Mechanisms exist to facilitate the implementation of enterprise-wide monitoring controls.", "justification": "Continuous Monitoring (MON-02) provides detective monitoring capability that compensates for the absence of Malware Protection Mechanism Testing (END-05) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "END-06", "risk_if_not_implemented": "Without Documented Endpoint Security Protection Measures, Technology Assets, Applications and/or Services (TAAS) may operate with insecure, unauthorized or drifted configurations that expand the attack surface. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unaddressed Security / Compliance Exposure (R-GV-2), Inability to Demonstrate Due Diligence / Due Care (R-GV-9), and most likely increases susceptibility to Human Error (MT-9).", "compensating_control_1": { "control_id": "MON-02", "name": "Continuous Monitoring", "description": "Mechanisms exist to facilitate the implementation of enterprise-wide monitoring controls.", "justification": "Continuous Monitoring (MON-02) provides detective monitoring capability that compensates for the absence of Documented Protection Measures (END-06) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "END-04", "name": "Malicious Code Protection (Antimalware)", "description": "Mechanisms exist to utilize antimalware, or similar technologies, to detect and eradicate malicious code.", "justification": "Malicious Code Protection (Antimalware) (END-04) provides overlapping security capability that compensates for the absence of Documented Protection Measures (END-06) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "END-07", "risk_if_not_implemented": "Without Software Firewall, adversaries may move laterally, exfiltrate data or reach systems that should have been isolated from untrusted networks. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Access (R-AC-4), System / Data Compromise (Technical Vector) (R-BC-4), System / Service Compromise (R-EX-7), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "NET-03", "name": "Boundary Protection", "description": "Mechanisms exist to monitor and control communications at the external network boundary and at key internal boundaries within the network.", "justification": "Boundary Protection (NET-03) provides network-level access restriction that compensates for the absence of Software Firewall (END-07) by limiting attacker reach and lateral movement opportunities across the environment. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CFG-04", "name": "Secure Baseline Configurations", "description": "Mechanisms exist to develop, document and maintain secure baseline configurations for Technology Assets, Applications and/or Services (TAAS) that are consistent with industry-accepted hardening standards.", "justification": "Secure Baseline Configurations (CFG-04) provides configuration hardening that compensates for the absence of Software Firewall (END-07) by eliminating unnecessary services and enforcing secure settings to reduce inherent exposure. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "END-08", "risk_if_not_implemented": "Without Unified Endpoint Device Management (UEDM), Technology Assets, Applications and/or Services (TAAS) may operate with insecure, unauthorized or drifted configurations that expand the attack surface. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Modification / Loss of System Integrity (R-AM-2), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "CFG-04", "name": "Secure Baseline Configurations", "description": "Mechanisms exist to develop, document and maintain secure baseline configurations for Technology Assets, Applications and/or Services (TAAS) that are consistent with industry-accepted hardening standards.", "justification": "Secure Baseline Configurations (CFG-04) provides configuration hardening that compensates for the absence of Unified Endpoint Device Management (UEDM) (END-08) by eliminating unnecessary services and enforcing secure settings to reduce inherent exposure. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "MON-02", "name": "Continuous Monitoring", "description": "Mechanisms exist to facilitate the implementation of enterprise-wide monitoring controls.", "justification": "Continuous Monitoring (MON-02) provides detective monitoring capability that compensates for the absence of Unified Endpoint Device Management (UEDM) (END-08) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "END-09", "risk_if_not_implemented": "Without Endpoint Detection & Response (EDR), malicious, anomalous or unauthorized activity may go undetected or be detected too late to prevent or limit harm. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss of Investigative / Evidentiary Capability (R-IR-1), Delayed Containment / Increased Incident Impact (R-IR-2), Undetected / Delayed Detection of Adverse Activity (R-SA-1), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "MON-28", "name": "File Activity Monitoring (FAM)", "description": "Automated mechanisms exist to monitor sensitive and/or regulated data in Technology Assets, Applications and/or Services (TAAS) and data repositories.", "justification": "File Activity Monitoring (FAM) (MON-28) provides detective monitoring capability that compensates for the absence of Endpoint Detection & Response (EDR) (END-09) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CRY-14", "name": "Cryptographic Hash", "description": "Mechanisms exist to utilize hash algorithms to generate a hash value that can be used to validate the integrity of data and/or software.", "justification": "Cryptographic Hash (CRY-14) provides cryptographic protection that compensates for the absence of Endpoint Detection & Response (EDR) (END-09) by ensuring data confidentiality and integrity through alternative technical means. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "END-10", "risk_if_not_implemented": "Without Extended Detection & Response (XDR), malicious, anomalous or unauthorized activity may go undetected or be detected too late to prevent or limit harm. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss of Investigative / Evidentiary Capability (R-IR-1), Delayed Containment / Increased Incident Impact (R-IR-2), Undetected / Delayed Detection of Adverse Activity (R-SA-1), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "END-11", "name": "Endpoint File Integrity Monitoring (FIM)", "description": "Mechanisms exist to utilize File Integrity Monitor (FIM), or similar technologies, to detect and report on unauthorized changes to selected files and configuration settings.", "justification": "Endpoint File Integrity Monitoring (FIM) (END-11) provides detective monitoring capability that compensates for the absence of Extended Detection & Response (XDR) (END-10) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CRY-14", "name": "Cryptographic Hash", "description": "Mechanisms exist to utilize hash algorithms to generate a hash value that can be used to validate the integrity of data and/or software.", "justification": "Cryptographic Hash (CRY-14) provides cryptographic protection that compensates for the absence of Extended Detection & Response (XDR) (END-10) by ensuring data confidentiality and integrity through alternative technical means. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "END-11", "risk_if_not_implemented": "Without Endpoint File Integrity Monitoring (FIM), malicious, anomalous or unauthorized activity may go undetected or be detected too late to prevent or limit harm. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Modification / Loss of System Integrity (R-AM-2), Undetected / Delayed Detection of Adverse Activity (R-SA-1), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "MON-02", "name": "Continuous Monitoring", "description": "Mechanisms exist to facilitate the implementation of enterprise-wide monitoring controls.", "justification": "Continuous Monitoring (MON-02) provides detective monitoring capability that compensates for the absence of Endpoint File Integrity Monitoring (FIM) (END-11) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CRY-14", "name": "Cryptographic Hash", "description": "Mechanisms exist to utilize hash algorithms to generate a hash value that can be used to validate the integrity of data and/or software.", "justification": "Cryptographic Hash (CRY-14) provides cryptographic protection that compensates for the absence of Endpoint File Integrity Monitoring (FIM) (END-11) by ensuring data confidentiality and integrity through alternative technical means. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "END-11.1", "risk_if_not_implemented": "Without Endpoint Integrity Checks, Technology Assets, Applications and/or Services (TAAS) may operate with insecure, unauthorized or drifted configurations that expand the attack surface. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Modification / Loss of System Integrity (R-AM-2), Loss of Authenticity / Provenance (R-IP-5), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "CRY-14", "name": "Cryptographic Hash", "description": "Mechanisms exist to utilize hash algorithms to generate a hash value that can be used to validate the integrity of data and/or software.", "justification": "Cryptographic Hash (CRY-14) provides cryptographic protection that compensates for the absence of Integrity Checks (END-11.1) by ensuring data confidentiality and integrity through alternative technical means. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "MON-28", "name": "File Activity Monitoring (FAM)", "description": "Automated mechanisms exist to monitor sensitive and/or regulated data in Technology Assets, Applications and/or Services (TAAS) and data repositories.", "justification": "File Activity Monitoring (FAM) (MON-28) provides detective monitoring capability that compensates for the absence of Integrity Checks (END-11.1) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "END-11.2", "risk_if_not_implemented": "Without Automated Notifications of Integrity Violations, Technology Assets, Applications and/or Services (TAAS) may operate with insecure, unauthorized or drifted configurations that expand the attack surface. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Delayed Containment / Increased Incident Impact (R-IR-2), Undetected / Delayed Detection of Adverse Activity (R-SA-1), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "CRY-14", "name": "Cryptographic Hash", "description": "Mechanisms exist to utilize hash algorithms to generate a hash value that can be used to validate the integrity of data and/or software.", "justification": "Cryptographic Hash (CRY-14) provides cryptographic protection that compensates for the absence of Automated Notifications of Integrity Violations (END-11.2) by ensuring data confidentiality and integrity through alternative technical means. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "END-11", "name": "Endpoint File Integrity Monitoring (FIM)", "description": "Mechanisms exist to utilize File Integrity Monitor (FIM), or similar technologies, to detect and report on unauthorized changes to selected files and configuration settings.", "justification": "Endpoint File Integrity Monitoring (FIM) (END-11) provides detective monitoring capability that compensates for the absence of Automated Notifications of Integrity Violations (END-11.2) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "END-11.3", "risk_if_not_implemented": "Without Automated Response to Integrity Violations, Technology Assets, Applications and/or Services (TAAS) may operate with insecure, unauthorized or drifted configurations that expand the attack surface. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Modification / Loss of System Integrity (R-AM-2), Delayed Containment / Increased Incident Impact (R-IR-2), Incident Persistence / Recurrence (R-IR-3), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "MON-02", "name": "Continuous Monitoring", "description": "Mechanisms exist to facilitate the implementation of enterprise-wide monitoring controls.", "justification": "Continuous Monitoring (MON-02) provides detective monitoring capability that compensates for the absence of Automated Response to Integrity Violations (END-11.3) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "END-11", "name": "Endpoint File Integrity Monitoring (FIM)", "description": "Mechanisms exist to utilize File Integrity Monitor (FIM), or similar technologies, to detect and report on unauthorized changes to selected files and configuration settings.", "justification": "Endpoint File Integrity Monitoring (FIM) (END-11) provides detective monitoring capability that compensates for the absence of Automated Response to Integrity Violations (END-11.3) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "END-11.4", "risk_if_not_implemented": "Without Boot Process Integrity, Technology Assets, Applications and/or Services (TAAS) may operate with insecure, unauthorized or drifted configurations that expand the attack surface. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Modification / Loss of System Integrity (R-AM-2), Undetected / Delayed Detection of Adverse Activity (R-SA-1), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "END-11", "name": "Endpoint File Integrity Monitoring (FIM)", "description": "Mechanisms exist to utilize File Integrity Monitor (FIM), or similar technologies, to detect and report on unauthorized changes to selected files and configuration settings.", "justification": "Endpoint File Integrity Monitoring (FIM) (END-11) provides detective monitoring capability that compensates for the absence of Boot Process Integrity (END-11.4) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "MON-02", "name": "Continuous Monitoring", "description": "Mechanisms exist to facilitate the implementation of enterprise-wide monitoring controls.", "justification": "Continuous Monitoring (MON-02) provides detective monitoring capability that compensates for the absence of Boot Process Integrity (END-11.4) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "END-11.5", "risk_if_not_implemented": "Without Protection of Boot Firmware, embedded and IoT technologies may operate with unknown, insecure or unmonitored configurations, creating exploitable footholds. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Modification / Loss of System Integrity (R-AM-2), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "CRY-14", "name": "Cryptographic Hash", "description": "Mechanisms exist to utilize hash algorithms to generate a hash value that can be used to validate the integrity of data and/or software.", "justification": "Cryptographic Hash (CRY-14) provides cryptographic protection that compensates for the absence of Protection of Boot Firmware (END-11.5) by ensuring data confidentiality and integrity through alternative technical means. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "MON-02", "name": "Continuous Monitoring", "description": "Mechanisms exist to facilitate the implementation of enterprise-wide monitoring controls.", "justification": "Continuous Monitoring (MON-02) provides detective monitoring capability that compensates for the absence of Protection of Boot Firmware (END-11.5) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "END-12", "risk_if_not_implemented": "Without Host Intrusion Detection and Prevention Systems (HIDS / HIPS), malicious, anomalous or unauthorized activity may go undetected or be detected too late to prevent or limit harm. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to System / Data Compromise (Technical Vector) (R-BC-4), System / Service Compromise (R-EX-7), Undetected / Delayed Detection of Adverse Activity (R-SA-1), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "MON-02", "name": "Continuous Monitoring", "description": "Mechanisms exist to facilitate the implementation of enterprise-wide monitoring controls.", "justification": "Continuous Monitoring (MON-02) provides detective monitoring capability that compensates for the absence of Host Intrusion Detection and Prevention Systems (HIDS / HIPS) (END-12) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "END-04", "name": "Malicious Code Protection (Antimalware)", "description": "Mechanisms exist to utilize antimalware, or similar technologies, to detect and eradicate malicious code.", "justification": "Malicious Code Protection (Antimalware) (END-04) provides overlapping security capability that compensates for the absence of Host Intrusion Detection and Prevention Systems (HIDS / HIPS) (END-12) by addressing related risk objectives through an alternative control mechanism aligned with Technology applicability. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "END-13", "risk_if_not_implemented": "Without Mobile Code, applications may be built and deployed with exploitable design and coding weaknesses that adversaries can leverage. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to System / Data Compromise (Technical Vector) (R-BC-4), and most likely increases susceptibility to Malicious Cyber Activity (MT-2).", "compensating_control_1": { "control_id": "CFG-03", "name": "Least Functionality", "description": "Mechanisms exist to configure Technology Assets, Applications and/or Services (TAAS) to provide only essential capabilities by specifically prohibiting or restricting the use of ports, protocols, and/or services.", "justification": "Least Functionality (CFG-03) provides configuration hardening that compensates for the absence of Mobile Code (END-13) by eliminating unnecessary services and enforcing secure settings to reduce inherent exposure. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "IAC-30", "name": "Least Privilege", "description": "Mechanisms exist to utilize the concept of least privilege, allowing only authorized access to processes necessary to accomplish assigned tasks in accordance with organizational business functions.", "justification": "Least Privilege (IAC-30) provides access control enforcement that compensates for the absence of Mobile Code (END-13) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "END-14", "risk_if_not_implemented": "Without Collaborative Computing Devices, Technology Assets, Applications and/or Services (TAAS) may operate with insecure, unauthorized or drifted configurations that expand the attack surface. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss of Confidentiality (R-IP-2), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9).", "compensating_control_1": { "control_id": "PES-10", "name": "Physical Security of Offices, Rooms & Facilities", "description": "Mechanisms exist to identify systems, equipment and respective operating environments that require limited physical access so that appropriate physical access controls are designed and implemented for offices, rooms and facilities.", "justification": "Physical Security of Offices, Rooms & Facilities (PES-10) provides physical access control that compensates for the absence of Collaborative Computing Devices (END-14) by preventing unauthorized physical interaction with systems and infrastructure. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CFG-03", "name": "Least Functionality", "description": "Mechanisms exist to configure Technology Assets, Applications and/or Services (TAAS) to provide only essential capabilities by specifically prohibiting or restricting the use of ports, protocols, and/or services.", "justification": "Least Functionality (CFG-03) provides configuration hardening that compensates for the absence of Collaborative Computing Devices (END-14) by eliminating unnecessary services and enforcing secure settings to reduce inherent exposure. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "END-14.1", "risk_if_not_implemented": "Without Collaborative Computing Capability Disabling / Removal In Secure Work Areas, Technology Assets, Applications and/or Services (TAAS) may operate with insecure, unauthorized or drifted configurations that expand the attack surface. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss of Confidentiality (R-IP-2), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9).", "compensating_control_1": { "control_id": "CFG-03", "name": "Least Functionality", "description": "Mechanisms exist to configure Technology Assets, Applications and/or Services (TAAS) to provide only essential capabilities by specifically prohibiting or restricting the use of ports, protocols, and/or services.", "justification": "Least Functionality (CFG-03) provides configuration hardening that compensates for the absence of Disabling / Removal In Secure Work Areas (END-14.1) by eliminating unnecessary services and enforcing secure settings to reduce inherent exposure. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "PES-10", "name": "Physical Security of Offices, Rooms & Facilities", "description": "Mechanisms exist to identify systems, equipment and respective operating environments that require limited physical access so that appropriate physical access controls are designed and implemented for offices, rooms and facilities.", "justification": "Physical Security of Offices, Rooms & Facilities (PES-10) provides physical access control that compensates for the absence of Disabling / Removal In Secure Work Areas (END-14.1) by preventing unauthorized physical interaction with systems and infrastructure. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "END-14.2", "risk_if_not_implemented": "Without Explicitly Indicate Current Participants, Technology Assets, Applications and/or Services (TAAS) may operate with insecure, unauthorized or drifted configurations that expand the attack surface. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Undetected / Delayed Detection of Adverse Activity (R-SA-1), and most likely increases susceptibility to Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "PES-10", "name": "Physical Security of Offices, Rooms & Facilities", "description": "Mechanisms exist to identify systems, equipment and respective operating environments that require limited physical access so that appropriate physical access controls are designed and implemented for offices, rooms and facilities.", "justification": "Physical Security of Offices, Rooms & Facilities (PES-10) provides physical access control that compensates for the absence of Explicitly Indicate Current Participants (END-14.2) by preventing unauthorized physical interaction with systems and infrastructure. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "END-14", "name": "Collaborative Computing Devices", "description": "Mechanisms exist to unplug or prohibit the remote activation of collaborative computing devices with the following exceptions: \n(1) Networked whiteboards; \n(2) Video teleconference cameras; and \n(3) Teleconference microphones.", "justification": "Collaborative Computing Devices (END-14) provides overlapping security capability that compensates for the absence of Explicitly Indicate Current Participants (END-14.2) by addressing related risk objectives through an alternative control mechanism aligned with Technology applicability. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "END-14.3", "risk_if_not_implemented": "Without Participant Identity Verification, unauthorized individuals, devices or services may gain access to Technology Assets, Applications, Services, Data and/or Facilities (TAASDF). Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Access (R-AC-4), Identity Compromise / Impersonation (R-AC-5), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9).", "compensating_control_1": { "control_id": "CFG-03", "name": "Least Functionality", "description": "Mechanisms exist to configure Technology Assets, Applications and/or Services (TAAS) to provide only essential capabilities by specifically prohibiting or restricting the use of ports, protocols, and/or services.", "justification": "Least Functionality (CFG-03) provides configuration hardening that compensates for the absence of Participant Identity Verification (END-14.3) by eliminating unnecessary services and enforcing secure settings to reduce inherent exposure. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "END-14", "name": "Collaborative Computing Devices", "description": "Mechanisms exist to unplug or prohibit the remote activation of collaborative computing devices with the following exceptions: \n(1) Networked whiteboards; \n(2) Video teleconference cameras; and \n(3) Teleconference microphones.", "justification": "Collaborative Computing Devices (END-14) provides overlapping security capability that compensates for the absence of Participant Identity Verification (END-14.3) by addressing related risk objectives through an alternative control mechanism aligned with Technology applicability. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "END-14.4", "risk_if_not_implemented": "Without Participant Connection Management, Technology Assets, Applications and/or Services (TAAS) may operate with insecure, unauthorized or drifted configurations that expand the attack surface. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Access (R-AC-4), and most likely increases susceptibility to Human Error (MT-9).", "compensating_control_1": { "control_id": "PES-10", "name": "Physical Security of Offices, Rooms & Facilities", "description": "Mechanisms exist to identify systems, equipment and respective operating environments that require limited physical access so that appropriate physical access controls are designed and implemented for offices, rooms and facilities.", "justification": "Physical Security of Offices, Rooms & Facilities (PES-10) provides physical access control that compensates for the absence of Participant Connection Management (END-14.4) by preventing unauthorized physical interaction with systems and infrastructure. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CFG-03", "name": "Least Functionality", "description": "Mechanisms exist to configure Technology Assets, Applications and/or Services (TAAS) to provide only essential capabilities by specifically prohibiting or restricting the use of ports, protocols, and/or services.", "justification": "Least Functionality (CFG-03) provides configuration hardening that compensates for the absence of Participant Connection Management (END-14.4) by eliminating unnecessary services and enforcing secure settings to reduce inherent exposure. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "END-14.5", "risk_if_not_implemented": "Without Malicious Link & File Protections, Technology Assets, Applications and/or Services (TAAS) may operate with insecure, unauthorized or drifted configurations that expand the attack surface. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to System / Data Compromise (Technical Vector) (R-BC-4), Undetected / Delayed Detection of Adverse Activity (R-SA-1), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "END-14", "name": "Collaborative Computing Devices", "description": "Mechanisms exist to unplug or prohibit the remote activation of collaborative computing devices with the following exceptions: \n(1) Networked whiteboards; \n(2) Video teleconference cameras; and \n(3) Teleconference microphones.", "justification": "Collaborative Computing Devices (END-14) provides overlapping security capability that compensates for the absence of Malicious Link & File Protections (END-14.5) by addressing related risk objectives through an alternative control mechanism aligned with Technology applicability. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "PES-10", "name": "Physical Security of Offices, Rooms & Facilities", "description": "Mechanisms exist to identify systems, equipment and respective operating environments that require limited physical access so that appropriate physical access controls are designed and implemented for offices, rooms and facilities.", "justification": "Physical Security of Offices, Rooms & Facilities (PES-10) provides physical access control that compensates for the absence of Malicious Link & File Protections (END-14.5) by preventing unauthorized physical interaction with systems and infrastructure. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "END-14.6", "risk_if_not_implemented": "Without Explicit Indication Of Use, Technology Assets, Applications and/or Services (TAAS) may operate with insecure, unauthorized or drifted configurations that expand the attack surface. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Undetected / Delayed Detection of Adverse Activity (R-SA-1), and most likely increases susceptibility to Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "CFG-03", "name": "Least Functionality", "description": "Mechanisms exist to configure Technology Assets, Applications and/or Services (TAAS) to provide only essential capabilities by specifically prohibiting or restricting the use of ports, protocols, and/or services.", "justification": "Least Functionality (CFG-03) provides configuration hardening that compensates for the absence of Explicit Indication Of Use (END-14.6) by eliminating unnecessary services and enforcing secure settings to reduce inherent exposure. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "PES-10", "name": "Physical Security of Offices, Rooms & Facilities", "description": "Mechanisms exist to identify systems, equipment and respective operating environments that require limited physical access so that appropriate physical access controls are designed and implemented for offices, rooms and facilities.", "justification": "Physical Security of Offices, Rooms & Facilities (PES-10) provides physical access control that compensates for the absence of Explicit Indication Of Use (END-14.6) by preventing unauthorized physical interaction with systems and infrastructure. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "HRS-03", "risk_if_not_implemented": "Without Position Categorization, trusted insiders may misuse access or act on conflicts of interest without detection or deterrence. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unaddressed Security / Compliance Exposure (R-GV-2), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Workforce Shortage / Loss of Critical Skills / Labor Disruption (MT-25).", "compensating_control_1": { "control_id": "HRS-04", "name": "Defined Roles & Responsibilities", "description": "Mechanisms exist to define cybersecurity roles & responsibilities for all personnel.", "justification": "Defined Roles & Responsibilities (HRS-04) provides overlapping security capability that compensates for the absence of Position Categorization (HRS-03) by addressing related risk objectives through an alternative control mechanism aligned with People applicability. Given the people-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "IAC-06", "name": "Role-Based Access Control (RBAC)", "description": "Mechanisms exist to enforce Role-Based Access Control (RBAC) for Technology Assets, Applications, Services and/or Data (TAASD) to restrict access to individuals assigned specific roles with legitimate business needs.", "justification": "Role-Based Access Control (RBAC) (IAC-06) provides access control enforcement that compensates for the absence of Position Categorization (HRS-03) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the people-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "HRS-03.2", "risk_if_not_implemented": "Without Competency Requirements for Security, Compliance & Resilience-Related Positions, trusted insiders may misuse access or act on conflicts of interest without detection or deterrence. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss of Critical Knowledge / Capability (R-PE-1), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Workforce Shortage / Loss of Critical Skills / Labor Disruption (MT-25).", "compensating_control_1": { "control_id": "GOV-05", "name": "Assigned Security, Compliance & Resilience Responsibilities", "description": "Mechanisms exist to assign one or more qualified individuals with the mission and resources to centrally-manage, coordinate, develop, implement and maintain an enterprise-wide Security, Compliance & Resilience Program (SCRP).", "justification": "Assigned Security, Compliance & Resilience Responsibilities (GOV-05) provides resilience and recovery capability that compensates for the absence of Competency Requirements for Security-Related Positions (HRS-03.2) by ensuring the organization can restore operations and data when the primary control is absent. Given the people-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "HRS-04", "name": "Defined Roles & Responsibilities", "description": "Mechanisms exist to define cybersecurity roles & responsibilities for all personnel.", "justification": "Defined Roles & Responsibilities (HRS-04) provides overlapping security capability that compensates for the absence of Competency Requirements for Security-Related Positions (HRS-03.2) by addressing related risk objectives through an alternative control mechanism aligned with People applicability. Given the people-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "HRS-04.1", "risk_if_not_implemented": "Without Assigned Roles & Responsibilities Awareness, personnel are more likely to make unsafe decisions, fall victim to social engineering, mishandle data or violate requirements. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unperformed / Unowned Control Responsibilities (R-GV-3), Lack of a security-minded workforce (R-SA-2), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Workforce Shortage / Loss of Critical Skills / Labor Disruption (MT-25).", "compensating_control_1": { "control_id": "IAC-06", "name": "Role-Based Access Control (RBAC)", "description": "Mechanisms exist to enforce Role-Based Access Control (RBAC) for Technology Assets, Applications, Services and/or Data (TAASD) to restrict access to individuals assigned specific roles with legitimate business needs.", "justification": "Role-Based Access Control (RBAC) (IAC-06) provides access control enforcement that compensates for the absence of User Awareness (HRS-04.1) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the people-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "GOV-05", "name": "Assigned Security, Compliance & Resilience Responsibilities", "description": "Mechanisms exist to assign one or more qualified individuals with the mission and resources to centrally-manage, coordinate, develop, implement and maintain an enterprise-wide Security, Compliance & Resilience Program (SCRP).", "justification": "Assigned Security, Compliance & Resilience Responsibilities (GOV-05) provides resilience and recovery capability that compensates for the absence of User Awareness (HRS-04.1) by ensuring the organization can restore operations and data when the primary control is absent. Given the people-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "HRS-05.1", "risk_if_not_implemented": "Without Roles With Special Protection Measures, trusted insiders may misuse access or act on conflicts of interest without detection or deterrence. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to System / Data Compromise (Non-Technical Vector) (R-BC-5), Loss of Confidentiality (R-IP-2), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Fraud, Corruption and/or Intentional Criminal Conduct (MT-14), Conflict of Interest (COI) / Undue Influence / Insider Misconduct (MT-15), Workforce Shortage / Loss of Critical Skills / Labor Disruption (MT-25).", "compensating_control_1": { "control_id": "HRS-02", "name": "Human Resources Security Management", "description": "Mechanisms exist to facilitate the implementation of personnel security controls.", "justification": "Human Resources Security Management (HRS-02) provides overlapping security capability that compensates for the absence of Roles With Special Protection Measures (HRS-05.1) by addressing related risk objectives through an alternative control mechanism aligned with People applicability. Given the people-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CPL-02", "name": "Statutory, Regulatory & Contractual Compliance", "description": "Mechanisms exist to facilitate the identification and implementation of relevant statutory, regulatory and contractual controls.", "justification": "Statutory, Regulatory & Contractual Compliance (CPL-02) provides overlapping security capability that compensates for the absence of Roles With Special Protection Measures (HRS-05.1) by addressing related risk objectives through an alternative control mechanism aligned with People applicability. Given the people-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "HRS-05.2", "risk_if_not_implemented": "Without Citizenship Requirements, trusted insiders may misuse access or act on conflicts of interest without detection or deterrence. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Regulatory / Legal / Contractual Financial Liability (R-EX-5), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11), Fraud, Corruption and/or Intentional Criminal Conduct (MT-14), Workforce Shortage / Loss of Critical Skills / Labor Disruption (MT-25).", "compensating_control_1": { "control_id": "HRS-05", "name": "Personnel Screening", "description": "Mechanisms exist to manage personnel security risk by screening individuals prior to authorizing access.", "justification": "Personnel Screening (HRS-05) provides overlapping security capability that compensates for the absence of Citizenship Requirements (HRS-05.2) by addressing related risk objectives through an alternative control mechanism aligned with People applicability. Given the people-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "TPM-13", "name": "Third-Party Personnel Security", "description": "Mechanisms exist to control personnel security requirements including security roles and responsibilities for third-party providers.", "justification": "Third-Party Personnel Security (TPM-13) provides third-party oversight that compensates for the absence of Citizenship Requirements (HRS-05.2) by extending security obligations contractually and monitoring third-party risk in lieu of direct control. Given the people-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "HRS-06.2", "risk_if_not_implemented": "Without Social Media & Social Networking Restrictions, adversaries may move laterally, exfiltrate data or reach systems that should have been isolated from untrusted networks. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss of Confidentiality (R-IP-2), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9).", "compensating_control_1": { "control_id": "HRS-07", "name": "Access Agreements", "description": "Mechanisms exist to require internal and third-party users to sign appropriate access agreements prior to being granted access.", "justification": "Access Agreements (HRS-07) provides access control enforcement that compensates for the absence of Social Media & Social Networking Restrictions (HRS-06.2) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the people-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "HRS-06", "name": "Terms of Employment", "description": "Mechanisms exist to require all employees and contractors to apply cybersecurity and data protection principles in their daily work to enable secure, compliant and resilient capabilities.", "justification": "Terms of Employment (HRS-06) provides overlapping security capability that compensates for the absence of Social Media & Social Networking Restrictions (HRS-06.2) by addressing related risk objectives through an alternative control mechanism aligned with People applicability. Given the people-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "HRS-06.4", "risk_if_not_implemented": "Without Use of Critical Technologies, trusted insiders may misuse access or act on conflicts of interest without detection or deterrence. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Harm from Unauthorized / Unintended Product or Service Use (R-SC-5), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9).", "compensating_control_1": { "control_id": "GOV-04", "name": "Publishing Security, Compliance & Resilience Documentation", "description": "Mechanisms exist to establish, maintain and disseminate policies, standards and procedures necessary for secure, compliant and resilient capabilities.", "justification": "Publishing Security, Compliance & Resilience Documentation (GOV-04) provides resilience and recovery capability that compensates for the absence of Use of Critical Technologies (HRS-06.4) by ensuring the organization can restore operations and data when the primary control is absent. Given the people-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "HRS-07", "name": "Access Agreements", "description": "Mechanisms exist to require internal and third-party users to sign appropriate access agreements prior to being granted access.", "justification": "Access Agreements (HRS-07) provides access control enforcement that compensates for the absence of Use of Critical Technologies (HRS-06.4) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the people-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "HRS-06.5", "risk_if_not_implemented": "Without Use of Mobile Devices, mobile and portable devices may expose organizational data through loss, theft, insecure configuration or unauthorized use. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss of Confidentiality (R-IP-2), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9).", "compensating_control_1": { "control_id": "HRS-06", "name": "Terms of Employment", "description": "Mechanisms exist to require all employees and contractors to apply cybersecurity and data protection principles in their daily work to enable secure, compliant and resilient capabilities.", "justification": "Terms of Employment (HRS-06) provides overlapping security capability that compensates for the absence of Use of Mobile Devices (HRS-06.5) by addressing related risk objectives through an alternative control mechanism aligned with People applicability. Given the people-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "HRS-07", "name": "Access Agreements", "description": "Mechanisms exist to require internal and third-party users to sign appropriate access agreements prior to being granted access.", "justification": "Access Agreements (HRS-07) provides access control enforcement that compensates for the absence of Use of Mobile Devices (HRS-06.5) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the people-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "HRS-06.6", "risk_if_not_implemented": "Without Security-Minded Dress Code, applications may be built and deployed with exploitable design and coding weaknesses that adversaries can leverage. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss, Theft or Damage of Assets (R-AM-1), Loss of Confidentiality (R-IP-2), and most likely increases susceptibility to Physical Crime (MT-5), Dysfunctional Management Practices (MT-8), Human Error (MT-9), Fraud, Corruption and/or Intentional Criminal Conduct (MT-14).", "compensating_control_1": { "control_id": "HRS-07", "name": "Access Agreements", "description": "Mechanisms exist to require internal and third-party users to sign appropriate access agreements prior to being granted access.", "justification": "Access Agreements (HRS-07) provides access control enforcement that compensates for the absence of Security-Minded Dress Code (HRS-06.6) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the people-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "GOV-04", "name": "Publishing Security, Compliance & Resilience Documentation", "description": "Mechanisms exist to establish, maintain and disseminate policies, standards and procedures necessary for secure, compliant and resilient capabilities.", "justification": "Publishing Security, Compliance & Resilience Documentation (GOV-04) provides resilience and recovery capability that compensates for the absence of Security-Minded Dress Code (HRS-06.6) by ensuring the organization can restore operations and data when the primary control is absent. Given the people-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "HRS-08", "risk_if_not_implemented": "Without Onboarding, Transferring & Offboarding Personnel, trusted insiders may misuse access or act on conflicts of interest without detection or deterrence. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Excessive or Unauthorized Privilege (R-AC-2), Unauthorized Access (R-AC-4), Unperformed / Unowned Control Responsibilities (R-GV-3), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Workforce Shortage / Loss of Critical Skills / Labor Disruption (MT-25).", "compensating_control_1": { "control_id": "HRS-05", "name": "Personnel Screening", "description": "Mechanisms exist to manage personnel security risk by screening individuals prior to authorizing access.", "justification": "Personnel Screening (HRS-05) provides overlapping security capability that compensates for the absence of Onboarding, Transferring & Offboarding Personnel (HRS-08) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "SAT-04", "name": "Security, Compliance & Resilience Awareness Training", "description": "Mechanisms exist to provide all employees and contractors appropriate security, compliance and resilience awareness education and training that is relevant for their job function.", "justification": "Security, Compliance & Resilience Awareness Training (SAT-04) provides personnel training and awareness that compensates for the absence of Onboarding, Transferring & Offboarding Personnel (HRS-08) by reducing human-factor risk by equipping personnel to recognize and respond to relevant threats. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "HRS-08.1", "risk_if_not_implemented": "Without Formal Indoctrination, trusted insiders may misuse access or act on conflicts of interest without detection or deterrence. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Lack of a security-minded workforce (R-SA-2), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Workforce Shortage / Loss of Critical Skills / Labor Disruption (MT-25).", "compensating_control_1": { "control_id": "CPL-02", "name": "Statutory, Regulatory & Contractual Compliance", "description": "Mechanisms exist to facilitate the identification and implementation of relevant statutory, regulatory and contractual controls.", "justification": "Statutory, Regulatory & Contractual Compliance (CPL-02) provides overlapping security capability that compensates for the absence of Formal Indoctrination (HRS-08.1) by addressing related risk objectives through an alternative control mechanism aligned with People applicability. Given the people-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "HRS-05", "name": "Personnel Screening", "description": "Mechanisms exist to manage personnel security risk by screening individuals prior to authorizing access.", "justification": "Personnel Screening (HRS-05) provides overlapping security capability that compensates for the absence of Formal Indoctrination (HRS-08.1) by addressing related risk objectives through an alternative control mechanism aligned with People applicability. Given the people-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "HRS-08.2", "risk_if_not_implemented": "Without Policy Familiarization & Acknowledgement, essential knowledge and skills may be unavailable when needed, degrading the organization's ability to operate and protect itself. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Inability to Demonstrate Due Diligence / Due Care (R-GV-9), Lack of a security-minded workforce (R-SA-2), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Workforce Shortage / Loss of Critical Skills / Labor Disruption (MT-25).", "compensating_control_1": { "control_id": "GOV-04", "name": "Publishing Security, Compliance & Resilience Documentation", "description": "Mechanisms exist to establish, maintain and disseminate policies, standards and procedures necessary for secure, compliant and resilient capabilities.", "justification": "Publishing Security, Compliance & Resilience Documentation (GOV-04) provides resilience and recovery capability that compensates for the absence of Policy Familiarization & Acknowledgement (HRS-08.2) by ensuring the organization can restore operations and data when the primary control is absent. Given the people-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "HRS-06", "name": "Terms of Employment", "description": "Mechanisms exist to require all employees and contractors to apply cybersecurity and data protection principles in their daily work to enable secure, compliant and resilient capabilities.", "justification": "Terms of Employment (HRS-06) provides overlapping security capability that compensates for the absence of Policy Familiarization & Acknowledgement (HRS-08.2) by addressing related risk objectives through an alternative control mechanism aligned with People applicability. Given the people-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "HRS-08.3", "risk_if_not_implemented": "Without Post-Employment Requirements Awareness, personnel are more likely to make unsafe decisions, fall victim to social engineering, mishandle data or violate requirements. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Lack of a security-minded workforce (R-SA-2), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11), Workforce Shortage / Loss of Critical Skills / Labor Disruption (MT-25).", "compensating_control_1": { "control_id": "IAC-04", "name": "User Provisioning & De-Provisioning", "description": "Mechanisms exist to utilize a formal user registration and de-registration process that governs the assignment of access rights.", "justification": "User Provisioning & De-Provisioning (IAC-04) provides access control enforcement that compensates for the absence of Post-Employment Requirements Awareness (HRS-08.3) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the people-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "HRS-07", "name": "Access Agreements", "description": "Mechanisms exist to require internal and third-party users to sign appropriate access agreements prior to being granted access.", "justification": "Access Agreements (HRS-07) provides access control enforcement that compensates for the absence of Post-Employment Requirements Awareness (HRS-08.3) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the people-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "HRS-08.4", "risk_if_not_implemented": "Without Post-Employment Requirements Notification, trusted insiders may misuse access or act on conflicts of interest without detection or deterrence. Based on the risk and threat mapping for this control, no risk is rated Likely; risks rated Possible include Loss of Accountability / Attribution (R-AC-1), System / Data Compromise (Non-Technical Vector) (R-BC-5), Reputational Harm / Loss of Stakeholder Trust (R-EX-4), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11), Workforce Shortage / Loss of Critical Skills / Labor Disruption (MT-25).", "compensating_control_1": { "control_id": "IAC-04", "name": "User Provisioning & De-Provisioning", "description": "Mechanisms exist to utilize a formal user registration and de-registration process that governs the assignment of access rights.", "justification": "User Provisioning & De-Provisioning (IAC-04) provides access control enforcement that compensates for the absence of Post-Employment Requirements Notification (HRS-08.4) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the people-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "HRS-12", "name": "Personnel Termination", "description": "Mechanisms exist to govern the termination of individual employment.", "justification": "Personnel Termination (HRS-12) provides overlapping security capability that compensates for the absence of Post-Employment Requirements Notification (HRS-08.4) by addressing related risk objectives through an alternative control mechanism aligned with People applicability. Given the people-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "HRS-09", "risk_if_not_implemented": "Without Probationary Periods, trusted insiders may misuse access or act on conflicts of interest without detection or deterrence. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Undetected / Delayed Detection of Adverse Activity (R-SA-1), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Workforce Shortage / Loss of Critical Skills / Labor Disruption (MT-25).", "compensating_control_1": { "control_id": "HRS-03", "name": "Position Categorization", "description": "Mechanisms exist to manage personnel security risk by assigning a risk designation to all positions and establishing screening criteria for individuals filling those positions.", "justification": "Position Categorization (HRS-03) provides overlapping security capability that compensates for the absence of Probationary Periods (HRS-09) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "IAC-06", "name": "Role-Based Access Control (RBAC)", "description": "Mechanisms exist to enforce Role-Based Access Control (RBAC) for Technology Assets, Applications, Services and/or Data (TAASD) to restrict access to individuals assigned specific roles with legitimate business needs.", "justification": "Role-Based Access Control (RBAC) (IAC-06) provides access control enforcement that compensates for the absence of Probationary Periods (HRS-09) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "HRS-10", "risk_if_not_implemented": "Without Personnel Sanctions, trusted insiders may misuse access or act on conflicts of interest without detection or deterrence. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unperformed / Unowned Control Responsibilities (R-GV-3), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Conflict of Interest (COI) / Undue Influence / Insider Misconduct (MT-15).", "compensating_control_1": { "control_id": "CPL-07.3", "name": "Audit Planning Activities", "description": "Mechanisms exist to thoughtfully plan audits by including input from operational risk and compliance partners to minimize the impact of audit-related activities on business operations.", "justification": "Audit Planning Activities (CPL-07.3) provides detective monitoring capability that compensates for the absence of Personnel Sanctions (HRS-10) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the people-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "HRS-02", "name": "Human Resources Security Management", "description": "Mechanisms exist to facilitate the implementation of personnel security controls.", "justification": "Human Resources Security Management (HRS-02) provides overlapping security capability that compensates for the absence of Personnel Sanctions (HRS-10) by addressing related risk objectives through an alternative control mechanism aligned with People applicability. Given the people-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "HRS-10.1", "risk_if_not_implemented": "Without Workplace Investigations, trusted insiders may misuse access or act on conflicts of interest without detection or deterrence. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss of Investigative / Evidentiary Capability (R-IR-1), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Conflict of Interest (COI) / Undue Influence / Insider Misconduct (MT-15).", "compensating_control_1": { "control_id": "HRS-02", "name": "Human Resources Security Management", "description": "Mechanisms exist to facilitate the implementation of personnel security controls.", "justification": "Human Resources Security Management (HRS-02) provides overlapping security capability that compensates for the absence of Workplace Investigations (HRS-10.1) by addressing related risk objectives through an alternative control mechanism aligned with People applicability. Given the people-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CPL-07.3", "name": "Audit Planning Activities", "description": "Mechanisms exist to thoughtfully plan audits by including input from operational risk and compliance partners to minimize the impact of audit-related activities on business operations.", "justification": "Audit Planning Activities (CPL-07.3) provides detective monitoring capability that compensates for the absence of Workplace Investigations (HRS-10.1) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the people-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "HRS-10.2", "risk_if_not_implemented": "Without Updating Disciplinary Processes, trusted insiders may misuse access or act on conflicts of interest without detection or deterrence. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Lack of oversight of internal controls (R-GV-6), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11).", "compensating_control_1": { "control_id": "CPL-07.3", "name": "Audit Planning Activities", "description": "Mechanisms exist to thoughtfully plan audits by including input from operational risk and compliance partners to minimize the impact of audit-related activities on business operations.", "justification": "Audit Planning Activities (CPL-07.3) provides detective monitoring capability that compensates for the absence of Updating Disciplinary Processes (HRS-10.2) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "HRS-10", "name": "Personnel Sanctions", "description": "Mechanisms exist to sanction personnel failing to comply with established security policies, standards and procedures.", "justification": "Personnel Sanctions (HRS-10) provides overlapping security capability that compensates for the absence of Updating Disciplinary Processes (HRS-10.2) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "HRS-10.3", "risk_if_not_implemented": "Without Preventative Access Restriction, trusted insiders may misuse access or act on conflicts of interest without detection or deterrence. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Excessive or Unauthorized Privilege (R-AC-2), Unauthorized Access (R-AC-4), System / Data Compromise (Non-Technical Vector) (R-BC-5), Loss of Confidentiality (R-IP-2), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Conflict of Interest (COI) / Undue Influence / Insider Misconduct (MT-15).", "compensating_control_1": { "control_id": "HRS-10", "name": "Personnel Sanctions", "description": "Mechanisms exist to sanction personnel failing to comply with established security policies, standards and procedures.", "justification": "Personnel Sanctions (HRS-10) provides overlapping security capability that compensates for the absence of Preventative Access Restriction (HRS-10.3) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CPL-07.3", "name": "Audit Planning Activities", "description": "Mechanisms exist to thoughtfully plan audits by including input from operational risk and compliance partners to minimize the impact of audit-related activities on business operations.", "justification": "Audit Planning Activities (CPL-07.3) provides detective monitoring capability that compensates for the absence of Preventative Access Restriction (HRS-10.3) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "HRS-11", "risk_if_not_implemented": "Without Personnel Transfer, trusted insiders may misuse access or act on conflicts of interest without detection or deterrence. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Excessive or Unauthorized Privilege (R-AC-2), Unauthorized Access (R-AC-4), and most likely increases susceptibility to Human Error (MT-9).", "compensating_control_1": { "control_id": "IAC-04", "name": "User Provisioning & De-Provisioning", "description": "Mechanisms exist to utilize a formal user registration and de-registration process that governs the assignment of access rights.", "justification": "User Provisioning & De-Provisioning (IAC-04) provides access control enforcement that compensates for the absence of Personnel Transfer (HRS-11) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the people-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "IAC-12", "name": "Periodic Review of Individual & Service Account Privileges", "description": "Mechanisms exist to periodically-review the privileges assigned to individuals and service accounts to validate the need for such privileges and reassign or remove unnecessary privileges, as necessary.", "justification": "Periodic Review of Individual & Service Account Privileges (IAC-12) provides periodic assessment and assurance that compensates for the absence of Personnel Transfer (HRS-11) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the people-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "HRS-12", "risk_if_not_implemented": "Without Personnel Termination, trusted insiders may misuse access or act on conflicts of interest without detection or deterrence. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Excessive or Unauthorized Privilege (R-AC-2), Unauthorized Access (R-AC-4), and most likely increases susceptibility to Human Error (MT-9).", "compensating_control_1": { "control_id": "IAC-04", "name": "User Provisioning & De-Provisioning", "description": "Mechanisms exist to utilize a formal user registration and de-registration process that governs the assignment of access rights.", "justification": "User Provisioning & De-Provisioning (IAC-04) provides access control enforcement that compensates for the absence of Personnel Termination (HRS-12) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the people-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "IAC-08", "name": "Account Management", "description": "Mechanisms exist to:\n(1) Define authorized system account types;\n(2) Define prohibited system account types; and\n(3) Proactively govern individual, group, system, service, application, guest and temporary accounts.", "justification": "Account Management (IAC-08) provides access control enforcement that compensates for the absence of Personnel Termination (HRS-12) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the people-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "HRS-12.1", "risk_if_not_implemented": "Without Automated Employment Status Notifications, trusted insiders may misuse access or act on conflicts of interest without detection or deterrence. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Access (R-AC-4), Unperformed / Unowned Control Responsibilities (R-GV-3), and most likely increases susceptibility to Technical / Mechanical Failure (MT-10), Data Quality Degradation / Data Poisoning (MT-12).", "compensating_control_1": { "control_id": "IAC-08", "name": "Account Management", "description": "Mechanisms exist to:\n(1) Define authorized system account types;\n(2) Define prohibited system account types; and\n(3) Proactively govern individual, group, system, service, application, guest and temporary accounts.", "justification": "Account Management (IAC-08) provides access control enforcement that compensates for the absence of Automated Employment Status Notifications (HRS-12.1) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "HRS-12", "name": "Personnel Termination", "description": "Mechanisms exist to govern the termination of individual employment.", "justification": "Personnel Termination (HRS-12) provides overlapping security capability that compensates for the absence of Automated Employment Status Notifications (HRS-12.1) by addressing related risk objectives through an alternative control mechanism aligned with Technology applicability. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "HRS-12.2", "risk_if_not_implemented": "Without Asset Collection, trusted insiders may misuse access or act on conflicts of interest without detection or deterrence. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss, Theft or Damage of Assets (R-AM-1), and most likely increases susceptibility to Human Error (MT-9).", "compensating_control_1": { "control_id": "IAC-04", "name": "User Provisioning & De-Provisioning", "description": "Mechanisms exist to utilize a formal user registration and de-registration process that governs the assignment of access rights.", "justification": "User Provisioning & De-Provisioning (IAC-04) provides access control enforcement that compensates for the absence of Asset Collection (HRS-12.2) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the people-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "IAC-12", "name": "Periodic Review of Individual & Service Account Privileges", "description": "Mechanisms exist to periodically-review the privileges assigned to individuals and service accounts to validate the need for such privileges and reassign or remove unnecessary privileges, as necessary.", "justification": "Periodic Review of Individual & Service Account Privileges (IAC-12) provides periodic assessment and assurance that compensates for the absence of Asset Collection (HRS-12.2) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the people-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "HRS-12.3", "risk_if_not_implemented": "Without High-Risk Terminations, trusted insiders may misuse access or act on conflicts of interest without detection or deterrence. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Access (R-AC-4), System / Data Compromise (Non-Technical Vector) (R-BC-5), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Conflict of Interest (COI) / Undue Influence / Insider Misconduct (MT-15).", "compensating_control_1": { "control_id": "IAC-08", "name": "Account Management", "description": "Mechanisms exist to:\n(1) Define authorized system account types;\n(2) Define prohibited system account types; and\n(3) Proactively govern individual, group, system, service, application, guest and temporary accounts.", "justification": "Account Management (IAC-08) provides access control enforcement that compensates for the absence of High-Risk Terminations (HRS-12.3) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the people-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "IAC-04", "name": "User Provisioning & De-Provisioning", "description": "Mechanisms exist to utilize a formal user registration and de-registration process that governs the assignment of access rights.", "justification": "User Provisioning & De-Provisioning (IAC-04) provides access control enforcement that compensates for the absence of High-Risk Terminations (HRS-12.3) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the people-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "HRS-14", "risk_if_not_implemented": "Without Separation of Duties (SoD), trusted insiders may misuse access or act on conflicts of interest without detection or deterrence. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Excessive or Unauthorized Privilege (R-AC-2), Fraud / Theft / Direct Financial Loss (R-EX-10), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Fraud, Corruption and/or Intentional Criminal Conduct (MT-14), Conflict of Interest (COI) / Undue Influence / Insider Misconduct (MT-15), Workforce Shortage / Loss of Critical Skills / Labor Disruption (MT-25).", "compensating_control_1": { "control_id": "IAC-30", "name": "Least Privilege", "description": "Mechanisms exist to utilize the concept of least privilege, allowing only authorized access to processes necessary to accomplish assigned tasks in accordance with organizational business functions.", "justification": "Least Privilege (IAC-30) provides access control enforcement that compensates for the absence of Separation of Duties (SoD) (HRS-14) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the people-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "IAC-06", "name": "Role-Based Access Control (RBAC)", "description": "Mechanisms exist to enforce Role-Based Access Control (RBAC) for Technology Assets, Applications, Services and/or Data (TAASD) to restrict access to individuals assigned specific roles with legitimate business needs.", "justification": "Role-Based Access Control (RBAC) (IAC-06) provides access control enforcement that compensates for the absence of Separation of Duties (SoD) (HRS-14) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the people-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "HRS-15", "risk_if_not_implemented": "Without Incompatible Roles, trusted insiders may misuse access or act on conflicts of interest without detection or deterrence. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Excessive or Unauthorized Privilege (R-AC-2), Unauthorized Modification / Loss of System Integrity (R-AM-2), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Fraud, Corruption and/or Intentional Criminal Conduct (MT-14), Conflict of Interest (COI) / Undue Influence / Insider Misconduct (MT-15).", "compensating_control_1": { "control_id": "HRS-14", "name": "Separation of Duties (SoD)", "description": "Mechanisms exist to implement and maintain Separation of Duties (SoD) to prevent potential inappropriate activity without collusion.", "justification": "Separation of Duties (SoD) (HRS-14) provides overlapping security capability that compensates for the absence of Incompatible Roles (HRS-15) by addressing related risk objectives through an alternative control mechanism aligned with People applicability. Given the people-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "IAC-30", "name": "Least Privilege", "description": "Mechanisms exist to utilize the concept of least privilege, allowing only authorized access to processes necessary to accomplish assigned tasks in accordance with organizational business functions.", "justification": "Least Privilege (IAC-30) provides access control enforcement that compensates for the absence of Incompatible Roles (HRS-15) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the people-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "HRS-16", "risk_if_not_implemented": "Without Identify Critical Skills & Gaps, essential knowledge and skills may be unavailable when needed, degrading the organization's ability to operate and protect itself. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss of Critical Knowledge / Capability (R-PE-1), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Workforce Shortage / Loss of Critical Skills / Labor Disruption (MT-25).", "compensating_control_1": { "control_id": "SAT-05", "name": "Role-Based Security, Compliance & Resilience Training", "description": "Mechanisms exist to provide role-based security, compliance and resilience-related training: \n(1) Before authorizing access to the system or performing assigned duties; \n(2) When required by system changes; and \n(3) Annually thereafter.", "justification": "Role-Based Security, Compliance & Resilience Training (SAT-05) provides personnel training and awareness that compensates for the absence of Identify Critical Skills & Gaps (HRS-16) by reducing human-factor risk by equipping personnel to recognize and respond to relevant threats. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "GOV-05", "name": "Assigned Security, Compliance & Resilience Responsibilities", "description": "Mechanisms exist to assign one or more qualified individuals with the mission and resources to centrally-manage, coordinate, develop, implement and maintain an enterprise-wide Security, Compliance & Resilience Program (SCRP).", "justification": "Assigned Security, Compliance & Resilience Responsibilities (GOV-05) provides resilience and recovery capability that compensates for the absence of Identify Critical Skills & Gaps (HRS-16) by ensuring the organization can restore operations and data when the primary control is absent. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "HRS-16.1", "risk_if_not_implemented": "Without Remediate Identified Skills Deficiencies, essential knowledge and skills may be unavailable when needed, degrading the organization's ability to operate and protect itself. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss of Critical Knowledge / Capability (R-PE-1), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Workforce Shortage / Loss of Critical Skills / Labor Disruption (MT-25).", "compensating_control_1": { "control_id": "GOV-05", "name": "Assigned Security, Compliance & Resilience Responsibilities", "description": "Mechanisms exist to assign one or more qualified individuals with the mission and resources to centrally-manage, coordinate, develop, implement and maintain an enterprise-wide Security, Compliance & Resilience Program (SCRP).", "justification": "Assigned Security, Compliance & Resilience Responsibilities (GOV-05) provides resilience and recovery capability that compensates for the absence of Remediate Identified Skills Deficiencies (HRS-16.1) by ensuring the organization can restore operations and data when the primary control is absent. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "SAT-05", "name": "Role-Based Security, Compliance & Resilience Training", "description": "Mechanisms exist to provide role-based security, compliance and resilience-related training: \n(1) Before authorizing access to the system or performing assigned duties; \n(2) When required by system changes; and \n(3) Annually thereafter.", "justification": "Role-Based Security, Compliance & Resilience Training (SAT-05) provides personnel training and awareness that compensates for the absence of Remediate Identified Skills Deficiencies (HRS-16.1) by reducing human-factor risk by equipping personnel to recognize and respond to relevant threats. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "HRS-16.2", "risk_if_not_implemented": "Without Identify Vital Security, Compliance & Resilience Staff, trusted insiders may misuse access or act on conflicts of interest without detection or deterrence. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss of Critical Knowledge / Capability (R-PE-1), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Workforce Shortage / Loss of Critical Skills / Labor Disruption (MT-25).", "compensating_control_1": { "control_id": "SAT-05", "name": "Role-Based Security, Compliance & Resilience Training", "description": "Mechanisms exist to provide role-based security, compliance and resilience-related training: \n(1) Before authorizing access to the system or performing assigned duties; \n(2) When required by system changes; and \n(3) Annually thereafter.", "justification": "Role-Based Security, Compliance & Resilience Training (SAT-05) provides personnel training and awareness that compensates for the absence of Identify Vital Security, Compliance & Resilience Staff (HRS-16.2) by reducing human-factor risk by equipping personnel to recognize and respond to relevant threats. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "HRS-16", "name": "Identify Critical Skills & Gaps", "description": "Mechanisms exist to evaluate the critical security, compliance and resilience skills needed to support the organization's mission and identify gaps that exist.", "justification": "Identify Critical Skills & Gaps (HRS-16) provides overlapping security capability that compensates for the absence of Identify Vital Security, Compliance & Resilience Staff (HRS-16.2) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "HRS-16.3", "risk_if_not_implemented": "Without Establish Redundancy for Vital Security, Compliance & Resilience Staff, data, software and system images cannot be reliably restored within required recovery objectives following a disruption. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Concentration / Single-Point Dependency Failure (R-OR-2), Loss of Critical Knowledge / Capability (R-PE-1), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Workforce Shortage / Loss of Critical Skills / Labor Disruption (MT-25).", "compensating_control_1": { "control_id": "GOV-05", "name": "Assigned Security, Compliance & Resilience Responsibilities", "description": "Mechanisms exist to assign one or more qualified individuals with the mission and resources to centrally-manage, coordinate, develop, implement and maintain an enterprise-wide Security, Compliance & Resilience Program (SCRP).", "justification": "Assigned Security, Compliance & Resilience Responsibilities (GOV-05) provides resilience and recovery capability that compensates for the absence of Establish Redundancy for Vital Security, Compliance & Resilience Staff (HRS-16.3) by ensuring the organization can restore operations and data when the primary control is absent. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "HRS-16", "name": "Identify Critical Skills & Gaps", "description": "Mechanisms exist to evaluate the critical security, compliance and resilience skills needed to support the organization's mission and identify gaps that exist.", "justification": "Identify Critical Skills & Gaps (HRS-16) provides overlapping security capability that compensates for the absence of Establish Redundancy for Vital Security, Compliance & Resilience Staff (HRS-16.3) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "HRS-16.4", "risk_if_not_implemented": "Without Perform Succession Planning, essential knowledge and skills may be unavailable when needed, degrading the organization's ability to operate and protect itself. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss of Critical Knowledge / Capability (R-PE-1), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Workforce Shortage / Loss of Critical Skills / Labor Disruption (MT-25).", "compensating_control_1": { "control_id": "SAT-05", "name": "Role-Based Security, Compliance & Resilience Training", "description": "Mechanisms exist to provide role-based security, compliance and resilience-related training: \n(1) Before authorizing access to the system or performing assigned duties; \n(2) When required by system changes; and \n(3) Annually thereafter.", "justification": "Role-Based Security, Compliance & Resilience Training (SAT-05) provides personnel training and awareness that compensates for the absence of Perform Succession Planning (HRS-16.4) by reducing human-factor risk by equipping personnel to recognize and respond to relevant threats. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "GOV-05", "name": "Assigned Security, Compliance & Resilience Responsibilities", "description": "Mechanisms exist to assign one or more qualified individuals with the mission and resources to centrally-manage, coordinate, develop, implement and maintain an enterprise-wide Security, Compliance & Resilience Program (SCRP).", "justification": "Assigned Security, Compliance & Resilience Responsibilities (GOV-05) provides resilience and recovery capability that compensates for the absence of Perform Succession Planning (HRS-16.4) by ensuring the organization can restore operations and data when the primary control is absent. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "HRS-17", "risk_if_not_implemented": "Without Identifying Authorized Work Locations, trusted insiders may misuse access or act on conflicts of interest without detection or deterrence. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unaddressed Security / Compliance Exposure (R-GV-2), and most likely increases susceptibility to Human Error (MT-9).", "compensating_control_1": { "control_id": "PES-02", "name": "Physical & Environmental Protections", "description": "Mechanisms exist to facilitate the operation of physical and environmental protection controls.", "justification": "Physical & Environmental Protections (PES-02) provides physical access control that compensates for the absence of Identifying Authorized Work Locations (HRS-17) by preventing unauthorized physical interaction with systems and infrastructure. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "NET-26", "name": "Remote Access", "description": "Mechanisms exist to define, control and review organization-approved, secure remote access methods.", "justification": "Remote Access (NET-26) provides access control enforcement that compensates for the absence of Identifying Authorized Work Locations (HRS-17) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "HRS-17.1", "risk_if_not_implemented": "Without Communicating Authorized Work Locations, trusted insiders may misuse access or act on conflicts of interest without detection or deterrence. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Lack of a security-minded workforce (R-SA-2), and most likely increases susceptibility to Human Error (MT-9).", "compensating_control_1": { "control_id": "NET-26", "name": "Remote Access", "description": "Mechanisms exist to define, control and review organization-approved, secure remote access methods.", "justification": "Remote Access (NET-26) provides access control enforcement that compensates for the absence of Communicating Authorized Work Locations (HRS-17.1) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "PES-02", "name": "Physical & Environmental Protections", "description": "Mechanisms exist to facilitate the operation of physical and environmental protection controls.", "justification": "Physical & Environmental Protections (PES-02) provides physical access control that compensates for the absence of Communicating Authorized Work Locations (HRS-17.1) by preventing unauthorized physical interaction with systems and infrastructure. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "HRS-18", "risk_if_not_implemented": "Without Reporting Suspicious Activities, trusted insiders may misuse access or act on conflicts of interest without detection or deterrence. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Undetected / Delayed Detection of Adverse Activity (R-SA-1), Lack of a security-minded workforce (R-SA-2), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Conflict of Interest (COI) / Undue Influence / Insider Misconduct (MT-15).", "compensating_control_1": { "control_id": "MON-16", "name": "Anomalous Behavior", "description": "Mechanisms exist to utilize User & Entity Behavior Analytics (UEBA) and/or User Activity Monitoring (UAM) solutions to detect and respond to anomalous behavior that could indicate account compromise or other malicious activities.", "justification": "Anomalous Behavior (MON-16) provides detective monitoring capability that compensates for the absence of Reporting Suspicious Activities (HRS-18) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "IRO-08", "name": "Incident Response Plan (IRP)", "description": "Mechanisms exist to maintain and make available a current and viable Incident Response Plan (IRP) to all stakeholders.", "justification": "Incident Response Plan (IRP) (IRO-08) provides incident response capability that compensates for the absence of Reporting Suspicious Activities (HRS-18) by enabling timely detection, containment, and recovery from security events in the absence of the primary control. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "IAC-03", "risk_if_not_implemented": "Without Authenticate, Authorize and Audit (AAA), credentials may be phished, replayed, guessed or stolen, allowing unauthorized actors to authenticate as trusted identities. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to R-AC-1, R-AC-2, R-AC-3, R-AC-4, R-AC-5, R-GV-5, and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "IAC-32", "name": "Identification & Authentication for Organizational Users", "description": "Mechanisms exist to uniquely identify and centrally Authenticate, Authorize and Audit (AAA) organizational users and processes acting on behalf of organizational users.", "justification": "Identification & Authentication for Organizational Users (IAC-32) provides access control enforcement that compensates for the absence of Authenticate, Authorize and Audit (AAA) (IAC-03) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "MON-18.1", "name": "Session Audit", "description": "Mechanisms exist to provide session audit capabilities that can: \n(1) Capture and log all content related to a user session; and\n(2) Remotely view all content related to an established user session in real time.", "justification": "Session Audit (MON-18.1) provides detective monitoring capability that compensates for the absence of Authenticate, Authorize and Audit (AAA) (IAC-03) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "IAC-03.1", "risk_if_not_implemented": "Without Replay-Resistant Authentication, credentials may be phished, replayed, guessed or stolen, allowing unauthorized actors to authenticate as trusted identities. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Access (R-AC-4), Identity Compromise / Impersonation (R-AC-5), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Technical / Mechanical Failure (MT-10), Cryptographic Compromise / Cryptanalytic Capability Advancement (MT-31).", "compensating_control_1": { "control_id": "IAC-38", "name": "Cryptographic Module Authentication", "description": "Automated mechanisms exist to enable Technology Assets, Applications and/or Services (TAAS) to authenticate to a cryptographic module.", "justification": "Cryptographic Module Authentication (IAC-38) provides cryptographic protection that compensates for the absence of Replay-Resistant Authentication (IAC-03.1) by ensuring data confidentiality and integrity through alternative technical means. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "IAC-37", "name": "Multi-Factor Authentication (MFA)", "description": "Automated mechanisms exist to enforce Multi-Factor Authentication (MFA) for:\n(1) Remote network access; \n(2) Third-party Technology Assets, Applications and/or Services (TAAS); and/ or\n(3) Non-console access to critical TAAS that store, transmit and/or process sensitive and/or regulated data.", "justification": "Multi-Factor Authentication (MFA) (IAC-37) provides access control enforcement that compensates for the absence of Replay-Resistant Authentication (IAC-03.1) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "IAC-03.2", "risk_if_not_implemented": "Without Retain Access Records, unauthorized individuals, devices or services may gain access to Technology Assets, Applications, Services, Data and/or Facilities (TAASDF). Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss of Accountability / Attribution (R-AC-1), Inability to Demonstrate Due Diligence / Due Care (R-GV-9), Loss of Investigative / Evidentiary Capability (R-IR-1), and most likely increases susceptibility to Human Error (MT-9), Data Quality Degradation / Data Poisoning (MT-12).", "compensating_control_1": { "control_id": "IAC-08", "name": "Account Management", "description": "Mechanisms exist to:\n(1) Define authorized system account types;\n(2) Define prohibited system account types; and\n(3) Proactively govern individual, group, system, service, application, guest and temporary accounts.", "justification": "Account Management (IAC-08) provides access control enforcement that compensates for the absence of Retain Access Records (IAC-03.2) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the data-handling focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "IAC-12", "name": "Periodic Review of Individual & Service Account Privileges", "description": "Mechanisms exist to periodically-review the privileges assigned to individuals and service accounts to validate the need for such privileges and reassign or remove unnecessary privileges, as necessary.", "justification": "Periodic Review of Individual & Service Account Privileges (IAC-12) provides periodic assessment and assurance that compensates for the absence of Retain Access Records (IAC-03.2) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the data-handling focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "IAC-03.3", "risk_if_not_implemented": "Without Identity Providers (IdP) & Authorization Servers, unauthorized individuals, devices or services may gain access to Technology Assets, Applications, Services, Data and/or Facilities (TAASDF). Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss of Accountability / Attribution (R-AC-1), Excessive or Unauthorized Privilege (R-AC-2), Unauthorized Privilege Elevation (R-AC-3), Unauthorized Access (R-AC-4), Identity Compromise / Impersonation (R-AC-5), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "IAC-32", "name": "Identification & Authentication for Organizational Users", "description": "Mechanisms exist to uniquely identify and centrally Authenticate, Authorize and Audit (AAA) organizational users and processes acting on behalf of organizational users.", "justification": "Identification & Authentication for Organizational Users (IAC-32) provides access control enforcement that compensates for the absence of Identity Providers (IdP) & Authorization Servers (IAC-03.3) by restricting system and data access through alternative identity and access management mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "IAC-06", "name": "Role-Based Access Control (RBAC)", "description": "Mechanisms exist to enforce Role-Based Access Control (RBAC) for Technology Assets, Applications, Services and/or Data (TAASD) to restrict access to individuals assigned specific roles with legitimate business needs.", "justification": "Role-Based Access Control (RBAC) (IAC-06) provides access control enforcement that compensates for the absence of Identity Providers (IdP) & Authorization Servers (IAC-03.3) by restricting system and data access through alternative identity and access management mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "IAC-05.1", "risk_if_not_implemented": "Without In-Person or Trusted Third-Party Registration, supplier and External Service Provider (ESP) weaknesses, incidents or failures may propagate into the organization's environment unmanaged. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Access (R-AC-4), Identity Compromise / Impersonation (R-AC-5), and most likely increases susceptibility to Pandemic (Disease) Outbreaks (NT-7); Human Error (MT-9), Fraud, Corruption and/or Intentional Criminal Conduct (MT-14), Workforce Shortage / Loss of Critical Skills / Labor Disruption (MT-25).", "compensating_control_1": { "control_id": "CRY-10", "name": "Cryptographic Key Management", "description": "Mechanisms exist to facilitate cryptographic key management controls to protect the confidentiality, integrity and availability of keys.", "justification": "Cryptographic Key Management (CRY-10) provides cryptographic protection that compensates for the absence of In-Person or Trusted Third-Party Registration (IAC-05.1) by ensuring data confidentiality and integrity through alternative technical means. Given the people-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "IAC-14", "name": "Authenticator Management", "description": "Mechanisms exist to:\n(1) Securely manage authenticators for users and devices; and\n(2) Ensure the strength of authentication is appropriate to the classification of the data being accessed.", "justification": "Authenticator Management (IAC-14) provides access control enforcement that compensates for the absence of In-Person or Trusted Third-Party Registration (IAC-05.1) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the people-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "IAC-05.2", "risk_if_not_implemented": "Without Identity Evidence, required evidence, logs and chain-of-custody integrity may be unavailable or unreliable when needed for investigation or legal proceedings. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Access (R-AC-4), Identity Compromise / Impersonation (R-AC-5), and most likely increases susceptibility to Human Error (MT-9), Fraud, Corruption and/or Intentional Criminal Conduct (MT-14).", "compensating_control_1": { "control_id": "IAC-37", "name": "Multi-Factor Authentication (MFA)", "description": "Automated mechanisms exist to enforce Multi-Factor Authentication (MFA) for:\n(1) Remote network access; \n(2) Third-party Technology Assets, Applications and/or Services (TAAS); and/ or\n(3) Non-console access to critical TAAS that store, transmit and/or process sensitive and/or regulated data.", "justification": "Multi-Factor Authentication (MFA) (IAC-37) provides access control enforcement that compensates for the absence of Identity Evidence (IAC-05.2) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "IAC-05", "name": "Identity Proofing (Identity Verification)", "description": "Mechanisms exist to verify the identity of a user before issuing authenticators or modifying access permissions.", "justification": "Identity Proofing (Identity Verification) (IAC-05) provides access control enforcement that compensates for the absence of Identity Evidence (IAC-05.2) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "IAC-05.3", "risk_if_not_implemented": "Without Identity Evidence Validation & Verification, required evidence, logs and chain-of-custody integrity may be unavailable or unreliable when needed for investigation or legal proceedings. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Access (R-AC-4), Identity Compromise / Impersonation (R-AC-5), and most likely increases susceptibility to Human Error (MT-9), Fraud, Corruption and/or Intentional Criminal Conduct (MT-14).", "compensating_control_1": { "control_id": "IAC-32", "name": "Identification & Authentication for Organizational Users", "description": "Mechanisms exist to uniquely identify and centrally Authenticate, Authorize and Audit (AAA) organizational users and processes acting on behalf of organizational users.", "justification": "Identification & Authentication for Organizational Users (IAC-32) provides access control enforcement that compensates for the absence of Identity Evidence Validation & Verification (IAC-05.3) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "IAC-05", "name": "Identity Proofing (Identity Verification)", "description": "Mechanisms exist to verify the identity of a user before issuing authenticators or modifying access permissions.", "justification": "Identity Proofing (Identity Verification) (IAC-05) provides access control enforcement that compensates for the absence of Identity Evidence Validation & Verification (IAC-05.3) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "IAC-05.4", "risk_if_not_implemented": "Without In-Person Validation & Verification, unauthorized individuals, devices or services may gain access to Technology Assets, Applications, Services, Data and/or Facilities (TAASDF). Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Access (R-AC-4), Identity Compromise / Impersonation (R-AC-5), and most likely increases susceptibility to Pandemic (Disease) Outbreaks (NT-7); Human Error (MT-9), Fraud, Corruption and/or Intentional Criminal Conduct (MT-14), Workforce Shortage / Loss of Critical Skills / Labor Disruption (MT-25).", "compensating_control_1": { "control_id": "IAC-37", "name": "Multi-Factor Authentication (MFA)", "description": "Automated mechanisms exist to enforce Multi-Factor Authentication (MFA) for:\n(1) Remote network access; \n(2) Third-party Technology Assets, Applications and/or Services (TAAS); and/ or\n(3) Non-console access to critical TAAS that store, transmit and/or process sensitive and/or regulated data.", "justification": "Multi-Factor Authentication (MFA) (IAC-37) provides access control enforcement that compensates for the absence of In-Person Validation & Verification (IAC-05.4) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "IAC-32", "name": "Identification & Authentication for Organizational Users", "description": "Mechanisms exist to uniquely identify and centrally Authenticate, Authorize and Audit (AAA) organizational users and processes acting on behalf of organizational users.", "justification": "Identification & Authentication for Organizational Users (IAC-32) provides access control enforcement that compensates for the absence of In-Person Validation & Verification (IAC-05.4) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "IAC-05.5", "risk_if_not_implemented": "Without Address Confirmation, unauthorized individuals, devices or services may gain access to Technology Assets, Applications, Services, Data and/or Facilities (TAASDF). Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Identity Compromise / Impersonation (R-AC-5), and most likely increases susceptibility to Human Error (MT-9), Fraud, Corruption and/or Intentional Criminal Conduct (MT-14).", "compensating_control_1": { "control_id": "IAC-32", "name": "Identification & Authentication for Organizational Users", "description": "Mechanisms exist to uniquely identify and centrally Authenticate, Authorize and Audit (AAA) organizational users and processes acting on behalf of organizational users.", "justification": "Identification & Authentication for Organizational Users (IAC-32) provides access control enforcement that compensates for the absence of Address Confirmation (IAC-05.5) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "IAC-37", "name": "Multi-Factor Authentication (MFA)", "description": "Automated mechanisms exist to enforce Multi-Factor Authentication (MFA) for:\n(1) Remote network access; \n(2) Third-party Technology Assets, Applications and/or Services (TAAS); and/ or\n(3) Non-console access to critical TAAS that store, transmit and/or process sensitive and/or regulated data.", "justification": "Multi-Factor Authentication (MFA) (IAC-37) provides access control enforcement that compensates for the absence of Address Confirmation (IAC-05.5) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "IAC-06", "risk_if_not_implemented": "Without Role-Based Access Control (RBAC), users, services and processes may obtain or retain access beyond authorized need, enabling misuse or escalation. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Excessive or Unauthorized Privilege (R-AC-2), Unauthorized Privilege Elevation (R-AC-3), Unauthorized Access (R-AC-4), Loss of Confidentiality (R-IP-2), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9).", "compensating_control_1": { "control_id": "HRS-14", "name": "Separation of Duties (SoD)", "description": "Mechanisms exist to implement and maintain Separation of Duties (SoD) to prevent potential inappropriate activity without collusion.", "justification": "Separation of Duties (SoD) (HRS-14) provides overlapping security capability that compensates for the absence of Role-Based Access Control (RBAC) (IAC-06) by addressing related risk objectives through an alternative control mechanism aligned with Technology applicability. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "IAC-30", "name": "Least Privilege", "description": "Mechanisms exist to utilize the concept of least privilege, allowing only authorized access to processes necessary to accomplish assigned tasks in accordance with organizational business functions.", "justification": "Least Privilege (IAC-30) provides access control enforcement that compensates for the absence of Role-Based Access Control (RBAC) (IAC-06) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "IAC-07", "risk_if_not_implemented": "Without Attribute-Based Access Control (ABAC), users, services and processes may obtain or retain access beyond authorized need, enabling misuse or escalation. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Excessive or Unauthorized Privilege (R-AC-2), Unauthorized Access (R-AC-4), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9), Data Quality Degradation / Data Poisoning (MT-12).", "compensating_control_1": { "control_id": "IAC-06", "name": "Role-Based Access Control (RBAC)", "description": "Mechanisms exist to enforce Role-Based Access Control (RBAC) for Technology Assets, Applications, Services and/or Data (TAASD) to restrict access to individuals assigned specific roles with legitimate business needs.", "justification": "Role-Based Access Control (RBAC) (IAC-06) provides access control enforcement that compensates for the absence of Attribute-Based Access Control (ABAC) (IAC-29) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "IAC-25", "name": "Access Enforcement", "description": "Mechanisms exist to enforce Logical Access Control (LAC) permissions that conform to the principle of \"least privilege.\"", "justification": "Access Enforcement (IAC-25) provides access control enforcement that compensates for the absence of Attribute-Based Access Control (ABAC) (IAC-29) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "IAC-07.1", "risk_if_not_implemented": "Without Real-Time Access Decisions, unauthorized individuals, devices or services may gain access to Technology Assets, Applications, Services, Data and/or Facilities (TAASDF). Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Excessive or Unauthorized Privilege (R-AC-2), Unauthorized Access (R-AC-4), AI Output / Decision Integrity Failure (R-AI-1), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9), Data Quality Degradation / Data Poisoning (MT-12), Artificial Intelligence & Autonomous Technologies (AAT) System Failure or Unintended Behavior (MT-13), Adversarial Artificial Intelligence (AI) Attack (MT-29).", "compensating_control_1": { "control_id": "IAC-25", "name": "Access Enforcement", "description": "Mechanisms exist to enforce Logical Access Control (LAC) permissions that conform to the principle of \"least privilege.\"", "justification": "Access Enforcement (IAC-25) provides access control enforcement that compensates for the absence of Real-Time Access Decisions (IAC-07.1) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "IAC-06", "name": "Role-Based Access Control (RBAC)", "description": "Mechanisms exist to enforce Role-Based Access Control (RBAC) for Technology Assets, Applications, Services and/or Data (TAASD) to restrict access to individuals assigned specific roles with legitimate business needs.", "justification": "Role-Based Access Control (RBAC) (IAC-06) provides access control enforcement that compensates for the absence of Real-Time Access Decisions (IAC-07.1) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "IAC-07.2", "risk_if_not_implemented": "Without Access Profile Rules, unauthorized individuals, devices or services may gain access to Technology Assets, Applications, Services, Data and/or Facilities (TAASDF). Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Excessive or Unauthorized Privilege (R-AC-2), Unauthorized Access (R-AC-4), and most likely increases susceptibility to Human Error (MT-9).", "compensating_control_1": { "control_id": "IAC-06", "name": "Role-Based Access Control (RBAC)", "description": "Mechanisms exist to enforce Role-Based Access Control (RBAC) for Technology Assets, Applications, Services and/or Data (TAASD) to restrict access to individuals assigned specific roles with legitimate business needs.", "justification": "Role-Based Access Control (RBAC) (IAC-06) provides access control enforcement that compensates for the absence of Access Profile Rules (IAC-07.2) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "IAC-07", "name": "Attribute-Based Access Control (ABAC)", "description": "Automated mechanisms exist to enforce Attribute-Based Access Control (ABAC) through policy-driven, dynamic authorizations to:\n(1) Enforce usage conditions for users and/or role; and\n(2) Support the secure sharing of information.", "justification": "Attribute-Based Access Control (ABAC) (IAC-07) provides access control enforcement that compensates for the absence of Access Profile Rules (IAC-07.2) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "IAC-08.1", "risk_if_not_implemented": "Without Automated System Account Management (Directory Services), unauthorized individuals, devices or services may gain access to Technology Assets, Applications, Services, Data and/or Facilities (TAASDF). Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Excessive or Unauthorized Privilege (R-AC-2), Unauthorized Access (R-AC-4), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9).", "compensating_control_1": { "control_id": "IAC-04", "name": "User Provisioning & De-Provisioning", "description": "Mechanisms exist to utilize a formal user registration and de-registration process that governs the assignment of access rights.", "justification": "User Provisioning & De-Provisioning (IAC-04) provides access control enforcement that compensates for the absence of Automated System Account Management (Directory Services) (IAC-08.1) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "IAC-12", "name": "Periodic Review of Individual & Service Account Privileges", "description": "Mechanisms exist to periodically-review the privileges assigned to individuals and service accounts to validate the need for such privileges and reassign or remove unnecessary privileges, as necessary.", "justification": "Periodic Review of Individual & Service Account Privileges (IAC-12) provides periodic assessment and assurance that compensates for the absence of Automated System Account Management (Directory Services) (IAC-08.1) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "IAC-08.2", "risk_if_not_implemented": "Without Authorized Accounts, unauthorized individuals, devices or services may gain access to Technology Assets, Applications, Services, Data and/or Facilities (TAASDF). Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Excessive or Unauthorized Privilege (R-AC-2), Unauthorized Access (R-AC-4), and most likely increases susceptibility to Human Error (MT-9).", "compensating_control_1": { "control_id": "IAC-30", "name": "Least Privilege", "description": "Mechanisms exist to utilize the concept of least privilege, allowing only authorized access to processes necessary to accomplish assigned tasks in accordance with organizational business functions.", "justification": "Least Privilege (IAC-30) provides access control enforcement that compensates for the absence of Authorized System Accounts (IAC-08.2) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "MON-18.1", "name": "Session Audit", "description": "Mechanisms exist to provide session audit capabilities that can: \n(1) Capture and log all content related to a user session; and\n(2) Remotely view all content related to an established user session in real time.", "justification": "Session Audit (MON-18.1) provides detective monitoring capability that compensates for the absence of Authorized System Accounts (IAC-08.2) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "IAC-08.6", "risk_if_not_implemented": "Without Automated Audit Actions, the organization may fail to meet statutory, regulatory or contractual obligations, or be unable to demonstrate conformity when required. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss of Accountability / Attribution (R-AC-1), Loss of Investigative / Evidentiary Capability (R-IR-1), Undetected / Delayed Detection of Adverse Activity (R-SA-1), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9).", "compensating_control_1": { "control_id": "MON-18.1", "name": "Session Audit", "description": "Mechanisms exist to provide session audit capabilities that can: \n(1) Capture and log all content related to a user session; and\n(2) Remotely view all content related to an established user session in real time.", "justification": "Session Audit (MON-18.1) provides detective monitoring capability that compensates for the absence of Automated Audit Actions (IAC-08.6) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "IAC-08", "name": "Account Management", "description": "Mechanisms exist to:\n(1) Define authorized system account types;\n(2) Define prohibited system account types; and\n(3) Proactively govern individual, group, system, service, application, guest and temporary accounts.", "justification": "Account Management (IAC-08) provides access control enforcement that compensates for the absence of Automated Audit Actions (IAC-08.6) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "IAC-08.7", "risk_if_not_implemented": "Without Account Separation Between Infrastructure Environments, unauthorized individuals, devices or services may gain access to Technology Assets, Applications, Services, Data and/or Facilities (TAASDF). Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Excessive or Unauthorized Privilege (R-AC-2), Unauthorized Access (R-AC-4), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9).", "compensating_control_1": { "control_id": "NET-06", "name": "Network Segmentation (macrosegmentation)", "description": "Mechanisms exist to implement network segmentation within network architectures to isolate Technology Assets, Applications and/or Services (TAAS) from other network resources.", "justification": "Network Segmentation (macrosegmentation) (NET-06) provides network-level access restriction that compensates for the absence of Account Separation Between Infrastructure Environments (IAC-08.7) by limiting attacker reach and lateral movement opportunities across the environment. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "IAC-10", "name": "Privileged Account Management (PAM)", "description": "Mechanisms exist to restrict and control privileged access rights for users and Technology Assets, Applications and/or Services (TAAS).", "justification": "Privileged Account Management (PAM) (IAC-10) provides access control enforcement that compensates for the absence of Account Separation Between Infrastructure Environments (IAC-08.7) by restricting system and data access through alternative identity and access management mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "IAC-08.8", "risk_if_not_implemented": "Without Multiple System Accounts, unauthorized individuals, devices or services may gain access to Technology Assets, Applications, Services, Data and/or Facilities (TAASDF). Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Access (R-AC-4), Identity Compromise / Impersonation (R-AC-5), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9).", "compensating_control_1": { "control_id": "CRY-10", "name": "Cryptographic Key Management", "description": "Mechanisms exist to facilitate cryptographic key management controls to protect the confidentiality, integrity and availability of keys.", "justification": "Cryptographic Key Management (CRY-10) provides cryptographic protection that compensates for the absence of Multiple System Accounts (IAC-08.8) by ensuring data confidentiality and integrity through alternative technical means. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CFG-04.1", "name": "Account Lockout", "description": "Mechanisms exist to enforce a limit for consecutive invalid login attempts by a user during an organization-defined time period and automatically locks the account when the maximum number of unsuccessful attempts is exceeded.", "justification": "Account Lockout (CFG-04.1) provides access control enforcement that compensates for the absence of Multiple System Accounts (IAC-08.8) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "IAC-10.2", "risk_if_not_implemented": "Without Privileged Account Separation, users, services and processes may obtain or retain access beyond authorized need, enabling misuse or escalation. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Excessive or Unauthorized Privilege (R-AC-2), Unauthorized Access (R-AC-4), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9).", "compensating_control_1": { "control_id": "MON-18.1", "name": "Session Audit", "description": "Mechanisms exist to provide session audit capabilities that can: \n(1) Capture and log all content related to a user session; and\n(2) Remotely view all content related to an established user session in real time.", "justification": "Session Audit (MON-18.1) provides detective monitoring capability that compensates for the absence of Privileged Account Separation (IAC-10.2) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "IAC-12", "name": "Periodic Review of Individual & Service Account Privileges", "description": "Mechanisms exist to periodically-review the privileges assigned to individuals and service accounts to validate the need for such privileges and reassign or remove unnecessary privileges, as necessary.", "justification": "Periodic Review of Individual & Service Account Privileges (IAC-12) provides periodic assessment and assurance that compensates for the absence of Privileged Account Separation (IAC-10.2) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "IAC-10.3", "risk_if_not_implemented": "Without Dedicated Privileged Account, users, services and processes may obtain or retain access beyond authorized need, enabling misuse or escalation. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Excessive or Unauthorized Privilege (R-AC-2), Unauthorized Access (R-AC-4), Identity Compromise / Impersonation (R-AC-5), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9).", "compensating_control_1": { "control_id": "HRS-14", "name": "Separation of Duties (SoD)", "description": "Mechanisms exist to implement and maintain Separation of Duties (SoD) to prevent potential inappropriate activity without collusion.", "justification": "Separation of Duties (SoD) (HRS-14) provides overlapping security capability that compensates for the absence of Dedicated Privileged Account (IAC-10.3) by addressing related risk objectives through an alternative control mechanism aligned with People applicability. Given the people-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "IAC-10", "name": "Privileged Account Management (PAM)", "description": "Mechanisms exist to restrict and control privileged access rights for users and Technology Assets, Applications and/or Services (TAAS).", "justification": "Privileged Account Management (PAM) (IAC-10) provides access control enforcement that compensates for the absence of Dedicated Privileged Account (IAC-10.3) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the people-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "IAC-10.4", "risk_if_not_implemented": "Without Privileged Command Execution, users, services and processes may obtain or retain access beyond authorized need, enabling misuse or escalation. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Excessive or Unauthorized Privilege (R-AC-2), Unauthorized Privilege Elevation (R-AC-3), Unauthorized Access (R-AC-4), Identity Compromise / Impersonation (R-AC-5), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9).", "compensating_control_1": { "control_id": "IAC-30", "name": "Least Privilege", "description": "Mechanisms exist to utilize the concept of least privilege, allowing only authorized access to processes necessary to accomplish assigned tasks in accordance with organizational business functions.", "justification": "Least Privilege (IAC-30) provides access control enforcement that compensates for the absence of Privileged Command Execution (IAC-10.4) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "IAC-10", "name": "Privileged Account Management (PAM)", "description": "Mechanisms exist to restrict and control privileged access rights for users and Technology Assets, Applications and/or Services (TAAS).", "justification": "Privileged Account Management (PAM) (IAC-10) provides access control enforcement that compensates for the absence of Privileged Command Execution (IAC-10.4) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "IAC-10.5", "risk_if_not_implemented": "Without Manual Override, unauthorized individuals, devices or services may gain access to Technology Assets, Applications, Services, Data and/or Facilities (TAASDF). Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Excessive or Unauthorized Privilege (R-AC-2), Unauthorized Privilege Elevation (R-AC-3), Unauthorized Access (R-AC-4), and most likely increases susceptibility to Human Error (MT-9).", "compensating_control_1": { "control_id": "IAC-10", "name": "Privileged Account Management (PAM)", "description": "Mechanisms exist to restrict and control privileged access rights for users and Technology Assets, Applications and/or Services (TAAS).", "justification": "Privileged Account Management (PAM) (IAC-10) provides access control enforcement that compensates for the absence of Manual Override (IAC-10.5) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "IAC-30", "name": "Least Privilege", "description": "Mechanisms exist to utilize the concept of least privilege, allowing only authorized access to processes necessary to accomplish assigned tasks in accordance with organizational business functions.", "justification": "Least Privilege (IAC-30) provides access control enforcement that compensates for the absence of Manual Override (IAC-10.5) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "IAC-11", "risk_if_not_implemented": "Without Emergency Accounts, unauthorized individuals, devices or services may gain access to Technology Assets, Applications, Services, Data and/or Facilities (TAASDF). Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss of Accountability / Attribution (R-AC-1), Excessive or Unauthorized Privilege (R-AC-2), Unauthorized Access (R-AC-4), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9).", "compensating_control_1": { "control_id": "IAC-12", "name": "Periodic Review of Individual & Service Account Privileges", "description": "Mechanisms exist to periodically-review the privileges assigned to individuals and service accounts to validate the need for such privileges and reassign or remove unnecessary privileges, as necessary.", "justification": "Periodic Review of Individual & Service Account Privileges (IAC-12) provides periodic assessment and assurance that compensates for the absence of Emergency Accounts (IAC-11) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "IAC-04", "name": "User Provisioning & De-Provisioning", "description": "Mechanisms exist to utilize a formal user registration and de-registration process that governs the assignment of access rights.", "justification": "User Provisioning & De-Provisioning (IAC-04) provides access control enforcement that compensates for the absence of Emergency Accounts (IAC-11) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "IAC-11.1", "risk_if_not_implemented": "Without Removal of Temporary / Emergency Accounts, unauthorized individuals, devices or services may gain access to Technology Assets, Applications, Services, Data and/or Facilities (TAASDF). Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Excessive or Unauthorized Privilege (R-AC-2), Unauthorized Access (R-AC-4), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "MON-18.1", "name": "Session Audit", "description": "Mechanisms exist to provide session audit capabilities that can: \n(1) Capture and log all content related to a user session; and\n(2) Remotely view all content related to an established user session in real time.", "justification": "Session Audit (MON-18.1) provides detective monitoring capability that compensates for the absence of Removal of Temporary / Emergency Accounts (IAC-11.1) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "IAC-12", "name": "Periodic Review of Individual & Service Account Privileges", "description": "Mechanisms exist to periodically-review the privileges assigned to individuals and service accounts to validate the need for such privileges and reassign or remove unnecessary privileges, as necessary.", "justification": "Periodic Review of Individual & Service Account Privileges (IAC-12) provides periodic assessment and assurance that compensates for the absence of Removal of Temporary / Emergency Accounts (IAC-11.1) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "IAC-13", "risk_if_not_implemented": "Without User Identity (ID) Management, unauthorized individuals, devices or services may gain access to Technology Assets, Applications, Services, Data and/or Facilities (TAASDF). Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss of Accountability / Attribution (R-AC-1), Unauthorized Access (R-AC-4), Identity Compromise / Impersonation (R-AC-5), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9).", "compensating_control_1": { "control_id": "IAC-32", "name": "Identification & Authentication for Organizational Users", "description": "Mechanisms exist to uniquely identify and centrally Authenticate, Authorize and Audit (AAA) organizational users and processes acting on behalf of organizational users.", "justification": "Identification & Authentication for Organizational Users (IAC-32) provides access control enforcement that compensates for the absence of User Identity (ID) Management (IAC-13) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "IAC-14", "name": "Authenticator Management", "description": "Mechanisms exist to:\n(1) Securely manage authenticators for users and devices; and\n(2) Ensure the strength of authentication is appropriate to the classification of the data being accessed.", "justification": "Authenticator Management (IAC-14) provides access control enforcement that compensates for the absence of User Identity (ID) Management (IAC-13) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "IAC-13.1", "risk_if_not_implemented": "Without Standardized Identifier Management (User Names), unauthorized individuals, devices or services may gain access to Technology Assets, Applications, Services, Data and/or Facilities (TAASDF). Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss of Accountability / Attribution (R-AC-1), and most likely increases susceptibility to Human Error (MT-9).", "compensating_control_1": { "control_id": "IAC-14", "name": "Authenticator Management", "description": "Mechanisms exist to:\n(1) Securely manage authenticators for users and devices; and\n(2) Ensure the strength of authentication is appropriate to the classification of the data being accessed.", "justification": "Authenticator Management (IAC-14) provides access control enforcement that compensates for the absence of Identifier Management (User Names) (IAC-13.1) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "IAC-32", "name": "Identification & Authentication for Organizational Users", "description": "Mechanisms exist to uniquely identify and centrally Authenticate, Authorize and Audit (AAA) organizational users and processes acting on behalf of organizational users.", "justification": "Identification & Authentication for Organizational Users (IAC-32) provides access control enforcement that compensates for the absence of Identifier Management (User Names) (IAC-13.1) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "IAC-13.2", "risk_if_not_implemented": "Without Employment Status Identification, unauthorized individuals, devices or services may gain access to Technology Assets, Applications, Services, Data and/or Facilities (TAASDF). Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss of Accountability / Attribution (R-AC-1), and most likely increases susceptibility to Human Error (MT-9), Data Quality Degradation / Data Poisoning (MT-12).", "compensating_control_1": { "control_id": "IAC-14", "name": "Authenticator Management", "description": "Mechanisms exist to:\n(1) Securely manage authenticators for users and devices; and\n(2) Ensure the strength of authentication is appropriate to the classification of the data being accessed.", "justification": "Authenticator Management (IAC-14) provides access control enforcement that compensates for the absence of Identity User Status (IAC-13.2) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "IAC-13.1", "name": "Standardized Identifier Management (User Names)", "description": "Mechanisms exist to govern naming standards for usernames and Technology Assets, Applications and/or Services (TAAS).", "justification": "Standardized Identifier Management (User Names) (IAC-13.1) provides overlapping security capability that compensates for the absence of Identity User Status (IAC-13.2) by addressing related risk objectives through an alternative control mechanism aligned with Technology applicability. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "IAC-13.3", "risk_if_not_implemented": "Without Citizenship Identification, unauthorized individuals, devices or services may gain access to Technology Assets, Applications, Services, Data and/or Facilities (TAASDF). Based on the risk and threat mapping for this control, no risk is rated Likely; risks rated Possible include Excessive or Unauthorized Privilege (R-AC-2), Unauthorized Access (R-AC-4), Regulatory / Legal / Contractual Financial Liability (R-EX-5), and most likely increases susceptibility to Human Error (MT-9), Data Quality Degradation / Data Poisoning (MT-12), Foreign Ownership, Control, or Influence (FOCI) (MT-17).", "compensating_control_1": { "control_id": "TPM-13", "name": "Third-Party Personnel Security", "description": "Mechanisms exist to control personnel security requirements including security roles and responsibilities for third-party providers.", "justification": "Third-Party Personnel Security (TPM-13) provides third-party oversight that compensates for the absence of Citizenship Identification (IAC-13.3) by extending security obligations contractually and monitoring third-party risk in lieu of direct control. Given the people-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "HRS-05", "name": "Personnel Screening", "description": "Mechanisms exist to manage personnel security risk by screening individuals prior to authorizing access.", "justification": "Personnel Screening (HRS-05) provides overlapping security capability that compensates for the absence of Citizenship Identification (IAC-13.3) by addressing related risk objectives through an alternative control mechanism aligned with People applicability. Given the people-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "IAC-13.4", "risk_if_not_implemented": "Without Dynamic Management, unauthorized individuals, devices or services may gain access to Technology Assets, Applications, Services, Data and/or Facilities (TAASDF). Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss of Accountability / Attribution (R-AC-1), and most likely increases susceptibility to Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "IAC-32", "name": "Identification & Authentication for Organizational Users", "description": "Mechanisms exist to uniquely identify and centrally Authenticate, Authorize and Audit (AAA) organizational users and processes acting on behalf of organizational users.", "justification": "Identification & Authentication for Organizational Users (IAC-32) provides access control enforcement that compensates for the absence of Dynamic Management (IAC-13.4) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "IAC-13.1", "name": "Standardized Identifier Management (User Names)", "description": "Mechanisms exist to govern naming standards for usernames and Technology Assets, Applications and/or Services (TAAS).", "justification": "Standardized Identifier Management (User Names) (IAC-13.1) provides overlapping security capability that compensates for the absence of Dynamic Management (IAC-13.4) by addressing related risk objectives through an alternative control mechanism aligned with Technology applicability. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "IAC-13.5", "risk_if_not_implemented": "Without Cross-Organization Management, unauthorized individuals, devices or services may gain access to Technology Assets, Applications, Services, Data and/or Facilities (TAASDF). Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss of Accountability / Attribution (R-AC-1). No threat is rated Likely for this control; threats rated Possible include Malicious Cyber Activity (MT-2), Dysfunctional Management Practices (MT-8), Human Error (MT-9).", "compensating_control_1": { "control_id": "IAC-14", "name": "Authenticator Management", "description": "Mechanisms exist to:\n(1) Securely manage authenticators for users and devices; and\n(2) Ensure the strength of authentication is appropriate to the classification of the data being accessed.", "justification": "Authenticator Management (IAC-14) provides access control enforcement that compensates for the absence of Cross-Organization Management (IAC-13.5) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "IAC-32", "name": "Identification & Authentication for Organizational Users", "description": "Mechanisms exist to uniquely identify and centrally Authenticate, Authorize and Audit (AAA) organizational users and processes acting on behalf of organizational users.", "justification": "Identification & Authentication for Organizational Users (IAC-32) provides access control enforcement that compensates for the absence of Cross-Organization Management (IAC-13.5) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "IAC-13.6", "risk_if_not_implemented": "Without Privileged Account Identifiers, users, services and processes may obtain or retain access beyond authorized need, enabling misuse or escalation. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss of Accountability / Attribution (R-AC-1), and most likely increases susceptibility to Human Error (MT-9).", "compensating_control_1": { "control_id": "IAC-13.1", "name": "Standardized Identifier Management (User Names)", "description": "Mechanisms exist to govern naming standards for usernames and Technology Assets, Applications and/or Services (TAAS).", "justification": "Standardized Identifier Management (User Names) (IAC-13.1) provides overlapping security capability that compensates for the absence of Privileged Account Identifiers (IAC-13.6) by addressing related risk objectives through an alternative control mechanism aligned with Technology applicability. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "IAC-14", "name": "Authenticator Management", "description": "Mechanisms exist to:\n(1) Securely manage authenticators for users and devices; and\n(2) Ensure the strength of authentication is appropriate to the classification of the data being accessed.", "justification": "Authenticator Management (IAC-14) provides access control enforcement that compensates for the absence of Privileged Account Identifiers (IAC-13.6) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "IAC-13.7", "risk_if_not_implemented": "Without Pairwise Pseudonymous Identifiers (PPID), unauthorized individuals, devices or services may gain access to Technology Assets, Applications, Services, Data and/or Facilities (TAASDF). Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Privacy Harm / Unauthorized Processing (R-IP-6). No threat is rated Likely for this control; threats rated Possible include Malicious Cyber Activity (MT-2), Human Error (MT-9), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "IAC-32", "name": "Identification & Authentication for Organizational Users", "description": "Mechanisms exist to uniquely identify and centrally Authenticate, Authorize and Audit (AAA) organizational users and processes acting on behalf of organizational users.", "justification": "Identification & Authentication for Organizational Users (IAC-32) provides access control enforcement that compensates for the absence of Pairwise Pseudonymous Identifiers (PPID) (IAC-13.7) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "IAC-14", "name": "Authenticator Management", "description": "Mechanisms exist to:\n(1) Securely manage authenticators for users and devices; and\n(2) Ensure the strength of authentication is appropriate to the classification of the data being accessed.", "justification": "Authenticator Management (IAC-14) provides access control enforcement that compensates for the absence of Pairwise Pseudonymous Identifiers (PPID) (IAC-13.7) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "IAC-14.1", "risk_if_not_implemented": "Without Events Requiring Authenticator Change, credentials may be phished, replayed, guessed or stolen, allowing unauthorized actors to authenticate as trusted identities. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Identity Compromise / Impersonation (R-AC-5), Incident Persistence / Recurrence (R-IR-3), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9).", "compensating_control_1": { "control_id": "IAC-37", "name": "Multi-Factor Authentication (MFA)", "description": "Automated mechanisms exist to enforce Multi-Factor Authentication (MFA) for:\n(1) Remote network access; \n(2) Third-party Technology Assets, Applications and/or Services (TAAS); and/ or\n(3) Non-console access to critical TAAS that store, transmit and/or process sensitive and/or regulated data.", "justification": "Multi-Factor Authentication (MFA) (IAC-37) provides access control enforcement that compensates for the absence of Events Requiring Authenticator Change (IAC-14.1) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CFG-04.1", "name": "Account Lockout", "description": "Mechanisms exist to enforce a limit for consecutive invalid login attempts by a user during an organization-defined time period and automatically locks the account when the maximum number of unsuccessful attempts is exceeded.", "justification": "Account Lockout (CFG-04.1) provides access control enforcement that compensates for the absence of Events Requiring Authenticator Change (IAC-14.1) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "IAC-14.5", "risk_if_not_implemented": "Without Expiration of Cached Authenticators, credentials may be phished, replayed, guessed or stolen, allowing unauthorized actors to authenticate as trusted identities. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Access (R-AC-4), Identity Compromise / Impersonation (R-AC-5), and most likely increases susceptibility to Malicious Cyber Activity (MT-2).", "compensating_control_1": { "control_id": "CFG-04.1", "name": "Account Lockout", "description": "Mechanisms exist to enforce a limit for consecutive invalid login attempts by a user during an organization-defined time period and automatically locks the account when the maximum number of unsuccessful attempts is exceeded.", "justification": "Account Lockout (CFG-04.1) provides access control enforcement that compensates for the absence of Expiration of Cached Authenticators (IAC-14.5) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "IAC-14", "name": "Authenticator Management", "description": "Mechanisms exist to:\n(1) Securely manage authenticators for users and devices; and\n(2) Ensure the strength of authentication is appropriate to the classification of the data being accessed.", "justification": "Authenticator Management (IAC-14) provides access control enforcement that compensates for the absence of Expiration of Cached Authenticators (IAC-14.5) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "IAC-15", "risk_if_not_implemented": "Without Password-Based Authentication, credentials may be phished, replayed, guessed or stolen, allowing unauthorized actors to authenticate as trusted identities. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Access (R-AC-4), Identity Compromise / Impersonation (R-AC-5), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9).", "compensating_control_1": { "control_id": "CRY-10", "name": "Cryptographic Key Management", "description": "Mechanisms exist to facilitate cryptographic key management controls to protect the confidentiality, integrity and availability of keys.", "justification": "Cryptographic Key Management (CRY-10) provides cryptographic protection that compensates for the absence of Password-Based Authentication (IAC-15) by ensuring data confidentiality and integrity through alternative technical means. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CFG-04.1", "name": "Account Lockout", "description": "Mechanisms exist to enforce a limit for consecutive invalid login attempts by a user during an organization-defined time period and automatically locks the account when the maximum number of unsuccessful attempts is exceeded.", "justification": "Account Lockout (CFG-04.1) provides access control enforcement that compensates for the absence of Password-Based Authentication (IAC-15) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "IAC-15.1", "risk_if_not_implemented": "Without Automated Support For Password Strength, credentials may be phished, replayed, guessed or stolen, allowing unauthorized actors to authenticate as trusted identities. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Access (R-AC-4), Identity Compromise / Impersonation (R-AC-5), and most likely increases susceptibility to Malicious Cyber Activity (MT-2).", "compensating_control_1": { "control_id": "IAC-14", "name": "Authenticator Management", "description": "Mechanisms exist to:\n(1) Securely manage authenticators for users and devices; and\n(2) Ensure the strength of authentication is appropriate to the classification of the data being accessed.", "justification": "Authenticator Management (IAC-14) provides access control enforcement that compensates for the absence of Automated Support For Password Strength (IAC-15.1) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "IAC-37", "name": "Multi-Factor Authentication (MFA)", "description": "Automated mechanisms exist to enforce Multi-Factor Authentication (MFA) for:\n(1) Remote network access; \n(2) Third-party Technology Assets, Applications and/or Services (TAAS); and/ or\n(3) Non-console access to critical TAAS that store, transmit and/or process sensitive and/or regulated data.", "justification": "Multi-Factor Authentication (MFA) (IAC-37) provides access control enforcement that compensates for the absence of Automated Support For Password Strength (IAC-15.1) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "IAC-15.2", "risk_if_not_implemented": "Without Password Managers, credentials may be phished, replayed, guessed or stolen, allowing unauthorized actors to authenticate as trusted identities. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Access (R-AC-4), Identity Compromise / Impersonation (R-AC-5), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9).", "compensating_control_1": { "control_id": "IAC-14", "name": "Authenticator Management", "description": "Mechanisms exist to:\n(1) Securely manage authenticators for users and devices; and\n(2) Ensure the strength of authentication is appropriate to the classification of the data being accessed.", "justification": "Authenticator Management (IAC-14) provides access control enforcement that compensates for the absence of Password Managers (IAC-15.2) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CFG-04.1", "name": "Account Lockout", "description": "Mechanisms exist to enforce a limit for consecutive invalid login attempts by a user during an organization-defined time period and automatically locks the account when the maximum number of unsuccessful attempts is exceeded.", "justification": "Account Lockout (CFG-04.1) provides access control enforcement that compensates for the absence of Password Managers (IAC-15.2) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "IAC-16", "risk_if_not_implemented": "Without Passkeys, credentials may be phished, replayed, guessed or stolen, allowing unauthorized actors to authenticate as trusted identities. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Access (R-AC-4), Identity Compromise / Impersonation (R-AC-5), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9), Cryptographic Compromise / Cryptanalytic Capability Advancement (MT-31).", "compensating_control_1": { "control_id": "CFG-04.1", "name": "Account Lockout", "description": "Mechanisms exist to enforce a limit for consecutive invalid login attempts by a user during an organization-defined time period and automatically locks the account when the maximum number of unsuccessful attempts is exceeded.", "justification": "Account Lockout (CFG-04.1) provides access control enforcement that compensates for the absence of Passkeys (IAC-16) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CRY-10", "name": "Cryptographic Key Management", "description": "Mechanisms exist to facilitate cryptographic key management controls to protect the confidentiality, integrity and availability of keys.", "justification": "Cryptographic Key Management (CRY-10) provides cryptographic protection that compensates for the absence of Passkeys (IAC-16) by ensuring data confidentiality and integrity through alternative technical means. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "IAC-17", "risk_if_not_implemented": "Without Biometric Authentication, credentials may be phished, replayed, guessed or stolen, allowing unauthorized actors to authenticate as trusted identities. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Access (R-AC-4), Identity Compromise / Impersonation (R-AC-5), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9).", "compensating_control_1": { "control_id": "CRY-10", "name": "Cryptographic Key Management", "description": "Mechanisms exist to facilitate cryptographic key management controls to protect the confidentiality, integrity and availability of keys.", "justification": "Cryptographic Key Management (CRY-10) provides cryptographic protection that compensates for the absence of Biometric Authentication (IAC-17) by ensuring data confidentiality and integrity through alternative technical means. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "IAC-37", "name": "Multi-Factor Authentication (MFA)", "description": "Automated mechanisms exist to enforce Multi-Factor Authentication (MFA) for:\n(1) Remote network access; \n(2) Third-party Technology Assets, Applications and/or Services (TAAS); and/ or\n(3) Non-console access to critical TAAS that store, transmit and/or process sensitive and/or regulated data.", "justification": "Multi-Factor Authentication (MFA) (IAC-37) provides access control enforcement that compensates for the absence of Biometric Authentication (IAC-17) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "IAC-18", "risk_if_not_implemented": "Without PKI-Based Authentication, data in transit and at rest may be exposed through weak, misconfigured or compromised cryptographic protections. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Access (R-AC-4), Identity Compromise / Impersonation (R-AC-5), Loss of Authenticity / Provenance (R-IP-5), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Cryptographic Compromise / Cryptanalytic Capability Advancement (MT-31).", "compensating_control_1": { "control_id": "CFG-04.1", "name": "Account Lockout", "description": "Mechanisms exist to enforce a limit for consecutive invalid login attempts by a user during an organization-defined time period and automatically locks the account when the maximum number of unsuccessful attempts is exceeded.", "justification": "Account Lockout (CFG-04.1) provides access control enforcement that compensates for the absence of PKI-Based Authentication (IAC-18) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CRY-10", "name": "Cryptographic Key Management", "description": "Mechanisms exist to facilitate cryptographic key management controls to protect the confidentiality, integrity and availability of keys.", "justification": "Cryptographic Key Management (CRY-10) provides cryptographic protection that compensates for the absence of PKI-Based Authentication (IAC-18) by ensuring data confidentiality and integrity through alternative technical means. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "IAC-19", "risk_if_not_implemented": "Without Hardware Token-Based Authentication, credentials may be phished, replayed, guessed or stolen, allowing unauthorized actors to authenticate as trusted identities. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Access (R-AC-4), Identity Compromise / Impersonation (R-AC-5), and most likely increases susceptibility to Malicious Cyber Activity (MT-2).", "compensating_control_1": { "control_id": "IAC-14", "name": "Authenticator Management", "description": "Mechanisms exist to:\n(1) Securely manage authenticators for users and devices; and\n(2) Ensure the strength of authentication is appropriate to the classification of the data being accessed.", "justification": "Authenticator Management (IAC-14) provides access control enforcement that compensates for the absence of Hardware Token-Based Authentication (IAC-19) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CRY-10", "name": "Cryptographic Key Management", "description": "Mechanisms exist to facilitate cryptographic key management controls to protect the confidentiality, integrity and availability of keys.", "justification": "Cryptographic Key Management (CRY-10) provides cryptographic protection that compensates for the absence of Hardware Token-Based Authentication (IAC-19) by ensuring data confidentiality and integrity through alternative technical means. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "IAC-20", "risk_if_not_implemented": "Without Authenticator Feedback, credentials may be phished, replayed, guessed or stolen, allowing unauthorized actors to authenticate as trusted identities. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Access (R-AC-4), Identity Compromise / Impersonation (R-AC-5), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9).", "compensating_control_1": { "control_id": "CFG-04.1", "name": "Account Lockout", "description": "Mechanisms exist to enforce a limit for consecutive invalid login attempts by a user during an organization-defined time period and automatically locks the account when the maximum number of unsuccessful attempts is exceeded.", "justification": "Account Lockout (CFG-04.1) provides access control enforcement that compensates for the absence of Authenticator Feedback (IAC-20) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "MON-18.1", "name": "Session Audit", "description": "Mechanisms exist to provide session audit capabilities that can: \n(1) Capture and log all content related to a user session; and\n(2) Remotely view all content related to an established user session in real time.", "justification": "Session Audit (MON-18.1) provides detective monitoring capability that compensates for the absence of Authenticator Feedback (IAC-20) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "IAC-21.1", "risk_if_not_implemented": "Without Group Authentication, credentials may be phished, replayed, guessed or stolen, allowing unauthorized actors to authenticate as trusted identities. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss of Accountability / Attribution (R-AC-1), Unauthorized Access (R-AC-4), Identity Compromise / Impersonation (R-AC-5), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9), Fraud, Corruption and/or Intentional Criminal Conduct (MT-14).", "compensating_control_1": { "control_id": "IAC-37", "name": "Multi-Factor Authentication (MFA)", "description": "Automated mechanisms exist to enforce Multi-Factor Authentication (MFA) for:\n(1) Remote network access; \n(2) Third-party Technology Assets, Applications and/or Services (TAAS); and/ or\n(3) Non-console access to critical TAAS that store, transmit and/or process sensitive and/or regulated data.", "justification": "Multi-Factor Authentication (MFA) (IAC-37) provides access control enforcement that compensates for the absence of Group Authentication (IAC-21.1) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CFG-04.1", "name": "Account Lockout", "description": "Mechanisms exist to enforce a limit for consecutive invalid login attempts by a user during an organization-defined time period and automatically locks the account when the maximum number of unsuccessful attempts is exceeded.", "justification": "Account Lockout (CFG-04.1) provides access control enforcement that compensates for the absence of Group Authentication (IAC-21.1) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "IAC-24", "risk_if_not_implemented": "Without Reference Monitor, malicious, anomalous or unauthorized activity may go undetected or be detected too late to prevent or limit harm. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Privilege Elevation (R-AC-3), Unauthorized Access (R-AC-4), Unauthorized Modification / Loss of System Integrity (R-AM-2), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Product Defect / Design Failure (MT-23).", "compensating_control_1": { "control_id": "IAC-25", "name": "Access Enforcement", "description": "Mechanisms exist to enforce Logical Access Control (LAC) permissions that conform to the principle of \"least privilege.\"", "justification": "Access Enforcement (IAC-25) provides access control enforcement that compensates for the absence of Reference Monitor (IAC-24) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "MON-02", "name": "Continuous Monitoring", "description": "Mechanisms exist to facilitate the implementation of enterprise-wide monitoring controls.", "justification": "Continuous Monitoring (MON-02) provides detective monitoring capability that compensates for the absence of Reference Monitor (IAC-24) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "IAC-26", "risk_if_not_implemented": "Without Use of Privileged Utility Programs, users, services and processes may obtain or retain access beyond authorized need, enabling misuse or escalation. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Excessive or Unauthorized Privilege (R-AC-2), Unauthorized Privilege Elevation (R-AC-3), Unauthorized Modification / Loss of System Integrity (R-AM-2), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9), Fraud, Corruption and/or Intentional Criminal Conduct (MT-14).", "compensating_control_1": { "control_id": "IAC-30", "name": "Least Privilege", "description": "Mechanisms exist to utilize the concept of least privilege, allowing only authorized access to processes necessary to accomplish assigned tasks in accordance with organizational business functions.", "justification": "Least Privilege (IAC-30) provides access control enforcement that compensates for the absence of Use of Privileged Utility Programs (IAC-26) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "IAC-25", "name": "Access Enforcement", "description": "Mechanisms exist to enforce Logical Access Control (LAC) permissions that conform to the principle of \"least privilege.\"", "justification": "Access Enforcement (IAC-25) provides access control enforcement that compensates for the absence of Use of Privileged Utility Programs (IAC-26) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "IAC-27", "risk_if_not_implemented": "Without Dedicated Administrative Machines, users, services and processes may obtain or retain access beyond authorized need, enabling misuse or escalation. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Identity Compromise / Impersonation (R-AC-5), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9).", "compensating_control_1": { "control_id": "MON-18.1", "name": "Session Audit", "description": "Mechanisms exist to provide session audit capabilities that can: \n(1) Capture and log all content related to a user session; and\n(2) Remotely view all content related to an established user session in real time.", "justification": "Session Audit (MON-18.1) provides detective monitoring capability that compensates for the absence of Dedicated Administrative Machines (IAC-27) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "IAC-25", "name": "Access Enforcement", "description": "Mechanisms exist to enforce Logical Access Control (LAC) permissions that conform to the principle of \"least privilege.\"", "justification": "Access Enforcement (IAC-25) provides access control enforcement that compensates for the absence of Dedicated Administrative Machines (IAC-27) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "IAC-28", "risk_if_not_implemented": "Without Dual Authorization for Privileged Commands, users, services and processes may obtain or retain access beyond authorized need, enabling misuse or escalation. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Modification / Loss of System Integrity (R-AM-2), Fraud / Theft / Direct Financial Loss (R-EX-10), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Fraud, Corruption and/or Intentional Criminal Conduct (MT-14), Conflict of Interest (COI) / Undue Influence / Insider Misconduct (MT-15).", "compensating_control_1": { "control_id": "IAC-25", "name": "Access Enforcement", "description": "Mechanisms exist to enforce Logical Access Control (LAC) permissions that conform to the principle of \"least privilege.\"", "justification": "Access Enforcement (IAC-25) provides access control enforcement that compensates for the absence of Dual Authorization for Privileged Commands (IAC-28) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "IAC-30", "name": "Least Privilege", "description": "Mechanisms exist to utilize the concept of least privilege, allowing only authorized access to processes necessary to accomplish assigned tasks in accordance with organizational business functions.", "justification": "Least Privilege (IAC-30) provides access control enforcement that compensates for the absence of Dual Authorization for Privileged Commands (IAC-28) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "IAC-29", "risk_if_not_implemented": "Without Revocation of Access Authorizations, unauthorized individuals, devices or services may gain access to Technology Assets, Applications, Services, Data and/or Facilities (TAASDF). Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Excessive or Unauthorized Privilege (R-AC-2), Unauthorized Access (R-AC-4), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9).", "compensating_control_1": { "control_id": "IAC-25", "name": "Access Enforcement", "description": "Mechanisms exist to enforce Logical Access Control (LAC) permissions that conform to the principle of \"least privilege.\"", "justification": "Access Enforcement (IAC-25) provides access control enforcement that compensates for the absence of Revocation of Access Authorizations (IAC-29) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "MON-18.1", "name": "Session Audit", "description": "Mechanisms exist to provide session audit capabilities that can: \n(1) Capture and log all content related to a user session; and\n(2) Remotely view all content related to an established user session in real time.", "justification": "Session Audit (MON-18.1) provides detective monitoring capability that compensates for the absence of Revocation of Access Authorizations (IAC-29) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "IAC-30.1", "risk_if_not_implemented": "Without Prohibit Non-Privileged Users from Executing Privileged Functions, users, services and processes may obtain or retain access beyond authorized need, enabling misuse or escalation. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Excessive or Unauthorized Privilege (R-AC-2), Unauthorized Privilege Elevation (R-AC-3), Unauthorized Access (R-AC-4), Unauthorized Modification / Loss of System Integrity (R-AM-2), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9).", "compensating_control_1": { "control_id": "IAC-30", "name": "Least Privilege", "description": "Mechanisms exist to utilize the concept of least privilege, allowing only authorized access to processes necessary to accomplish assigned tasks in accordance with organizational business functions.", "justification": "Least Privilege (IAC-30) provides access control enforcement that compensates for the absence of Prohibit Non-Privileged Users from Executing Privileged Functions (IAC-30.1) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "IAC-10", "name": "Privileged Account Management (PAM)", "description": "Mechanisms exist to restrict and control privileged access rights for users and Technology Assets, Applications and/or Services (TAAS).", "justification": "Privileged Account Management (PAM) (IAC-10) provides access control enforcement that compensates for the absence of Prohibit Non-Privileged Users from Executing Privileged Functions (IAC-30.1) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "IAC-30.2", "risk_if_not_implemented": "Without Authorize Access to Security Functions, unauthorized individuals, devices or services may gain access to Technology Assets, Applications, Services, Data and/or Facilities (TAASDF). Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Excessive or Unauthorized Privilege (R-AC-2), Unauthorized Privilege Elevation (R-AC-3), Unauthorized Access (R-AC-4), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9).", "compensating_control_1": { "control_id": "HRS-14", "name": "Separation of Duties (SoD)", "description": "Mechanisms exist to implement and maintain Separation of Duties (SoD) to prevent potential inappropriate activity without collusion.", "justification": "Separation of Duties (SoD) (HRS-14) provides overlapping security capability that compensates for the absence of Authorize Access to Security Functions (IAC-30.2) by addressing related risk objectives through an alternative control mechanism aligned with Technology applicability. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "IAC-06", "name": "Role-Based Access Control (RBAC)", "description": "Mechanisms exist to enforce Role-Based Access Control (RBAC) for Technology Assets, Applications, Services and/or Data (TAASD) to restrict access to individuals assigned specific roles with legitimate business needs.", "justification": "Role-Based Access Control (RBAC) (IAC-06) provides access control enforcement that compensates for the absence of Authorize Access to Security Functions (IAC-30.2) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "IAC-30.3", "risk_if_not_implemented": "Without Non-Privileged Access for Non-Security Functions, users, services and processes may obtain or retain access beyond authorized need, enabling misuse or escalation. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Excessive or Unauthorized Privilege (R-AC-2), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9).", "compensating_control_1": { "control_id": "IAC-06", "name": "Role-Based Access Control (RBAC)", "description": "Mechanisms exist to enforce Role-Based Access Control (RBAC) for Technology Assets, Applications, Services and/or Data (TAASD) to restrict access to individuals assigned specific roles with legitimate business needs.", "justification": "Role-Based Access Control (RBAC) (IAC-06) provides access control enforcement that compensates for the absence of Non-Privileged Access for Non-Security Functions (IAC-30.3) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "IAC-12", "name": "Periodic Review of Individual & Service Account Privileges", "description": "Mechanisms exist to periodically-review the privileges assigned to individuals and service accounts to validate the need for such privileges and reassign or remove unnecessary privileges, as necessary.", "justification": "Periodic Review of Individual & Service Account Privileges (IAC-12) provides periodic assessment and assurance that compensates for the absence of Non-Privileged Access for Non-Security Functions (IAC-30.3) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "IAC-30.4", "risk_if_not_implemented": "Without Auditing Use of Privileged Functions, users, services and processes may obtain or retain access beyond authorized need, enabling misuse or escalation. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss of Accountability / Attribution (R-AC-1), Loss of Investigative / Evidentiary Capability (R-IR-1), Undetected / Delayed Detection of Adverse Activity (R-SA-1), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9).", "compensating_control_1": { "control_id": "IAC-06", "name": "Role-Based Access Control (RBAC)", "description": "Mechanisms exist to enforce Role-Based Access Control (RBAC) for Technology Assets, Applications, Services and/or Data (TAASD) to restrict access to individuals assigned specific roles with legitimate business needs.", "justification": "Role-Based Access Control (RBAC) (IAC-06) provides access control enforcement that compensates for the absence of Auditing Use of Privileged Functions (IAC-30.4) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "IAC-30", "name": "Least Privilege", "description": "Mechanisms exist to utilize the concept of least privilege, allowing only authorized access to processes necessary to accomplish assigned tasks in accordance with organizational business functions.", "justification": "Least Privilege (IAC-30) provides access control enforcement that compensates for the absence of Auditing Use of Privileged Functions (IAC-30.4) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "IAC-30.5", "risk_if_not_implemented": "Without Network Access to Privileged Commands, users, services and processes may obtain or retain access beyond authorized need, enabling misuse or escalation. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Excessive or Unauthorized Privilege (R-AC-2), Unauthorized Access (R-AC-4), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9).", "compensating_control_1": { "control_id": "HRS-14", "name": "Separation of Duties (SoD)", "description": "Mechanisms exist to implement and maintain Separation of Duties (SoD) to prevent potential inappropriate activity without collusion.", "justification": "Separation of Duties (SoD) (HRS-14) provides overlapping security capability that compensates for the absence of Network Access to Privileged Commands (IAC-30.5) by addressing related risk objectives through an alternative control mechanism aligned with Technology applicability. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "IAC-30", "name": "Least Privilege", "description": "Mechanisms exist to utilize the concept of least privilege, allowing only authorized access to processes necessary to accomplish assigned tasks in accordance with organizational business functions.", "justification": "Least Privilege (IAC-30) provides access control enforcement that compensates for the absence of Network Access to Privileged Commands (IAC-30.5) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "IAC-30.6", "risk_if_not_implemented": "Without Privilege Levels for Code Execution, users, services and processes may obtain or retain access beyond authorized need, enabling misuse or escalation. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Excessive or Unauthorized Privilege (R-AC-2), Unauthorized Privilege Elevation (R-AC-3), Unauthorized Access (R-AC-4), and most likely increases susceptibility to Malicious Cyber Activity (MT-2).", "compensating_control_1": { "control_id": "IAC-30", "name": "Least Privilege", "description": "Mechanisms exist to utilize the concept of least privilege, allowing only authorized access to processes necessary to accomplish assigned tasks in accordance with organizational business functions.", "justification": "Least Privilege (IAC-30) provides access control enforcement that compensates for the absence of Privilege Levels for Code Execution (IAC-30.6) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "HRS-14", "name": "Separation of Duties (SoD)", "description": "Mechanisms exist to implement and maintain Separation of Duties (SoD) to prevent potential inappropriate activity without collusion.", "justification": "Separation of Duties (SoD) (HRS-14) provides overlapping security capability that compensates for the absence of Privilege Levels for Code Execution (IAC-30.6) by addressing related risk objectives through an alternative control mechanism aligned with Technology applicability. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "IAC-31", "risk_if_not_implemented": "Without Permitted Actions Without Identification or Authorization, unauthorized individuals, devices or services may gain access to Technology Assets, Applications, Services, Data and/or Facilities (TAASDF). Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unaddressed Security / Compliance Exposure (R-GV-2), Inability to Demonstrate Due Diligence / Due Care (R-GV-9), and most likely increases susceptibility to Human Error (MT-9).", "compensating_control_1": { "control_id": "IAC-25", "name": "Access Enforcement", "description": "Mechanisms exist to enforce Logical Access Control (LAC) permissions that conform to the principle of \"least privilege.\"", "justification": "Access Enforcement (IAC-25) provides access control enforcement that compensates for the absence of Permitted Actions Without Identification or Authorization (IAC-31) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "NET-03", "name": "Boundary Protection", "description": "Mechanisms exist to monitor and control communications at the external network boundary and at key internal boundaries within the network.", "justification": "Boundary Protection (NET-03) provides network-level access restriction that compensates for the absence of Permitted Actions Without Identification or Authorization (IAC-31) by limiting attacker reach and lateral movement opportunities across the environment. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "IAC-32", "risk_if_not_implemented": "Without Identification & Authentication for Organizational Users, credentials may be phished, replayed, guessed or stolen, allowing unauthorized actors to authenticate as trusted identities. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss of Accountability / Attribution (R-AC-1), Unauthorized Access (R-AC-4), Identity Compromise / Impersonation (R-AC-5), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9).", "compensating_control_1": { "control_id": "IAC-37", "name": "Multi-Factor Authentication (MFA)", "description": "Automated mechanisms exist to enforce Multi-Factor Authentication (MFA) for:\n(1) Remote network access; \n(2) Third-party Technology Assets, Applications and/or Services (TAAS); and/ or\n(3) Non-console access to critical TAAS that store, transmit and/or process sensitive and/or regulated data.", "justification": "Multi-Factor Authentication (MFA) (IAC-37) provides access control enforcement that compensates for the absence of Identification & Authentication for Organizational Users (IAC-32) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "MON-18.1", "name": "Session Audit", "description": "Mechanisms exist to provide session audit capabilities that can: \n(1) Capture and log all content related to a user session; and\n(2) Remotely view all content related to an established user session in real time.", "justification": "Session Audit (MON-18.1) provides detective monitoring capability that compensates for the absence of Identification & Authentication for Organizational Users (IAC-32) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "IAC-32.1", "risk_if_not_implemented": "Without Out-of-Band Authentication (OOBA), credentials may be phished, replayed, guessed or stolen, allowing unauthorized actors to authenticate as trusted identities. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Access (R-AC-4), Identity Compromise / Impersonation (R-AC-5), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9).", "compensating_control_1": { "control_id": "MON-18.1", "name": "Session Audit", "description": "Mechanisms exist to provide session audit capabilities that can: \n(1) Capture and log all content related to a user session; and\n(2) Remotely view all content related to an established user session in real time.", "justification": "Session Audit (MON-18.1) provides detective monitoring capability that compensates for the absence of Out-of-Band Authentication (OOBA) (IAC-32.1) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "IAC-37", "name": "Multi-Factor Authentication (MFA)", "description": "Automated mechanisms exist to enforce Multi-Factor Authentication (MFA) for:\n(1) Remote network access; \n(2) Third-party Technology Assets, Applications and/or Services (TAAS); and/ or\n(3) Non-console access to critical TAAS that store, transmit and/or process sensitive and/or regulated data.", "justification": "Multi-Factor Authentication (MFA) (IAC-37) provides access control enforcement that compensates for the absence of Out-of-Band Authentication (OOBA) (IAC-32.1) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "IAC-32.2", "risk_if_not_implemented": "Without Acceptance of PIV Credentials, credentials may be phished, replayed, guessed or stolen, allowing unauthorized actors to authenticate as trusted identities. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Access (R-AC-4), Identity Compromise / Impersonation (R-AC-5), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9).", "compensating_control_1": { "control_id": "CFG-04.1", "name": "Account Lockout", "description": "Mechanisms exist to enforce a limit for consecutive invalid login attempts by a user during an organization-defined time period and automatically locks the account when the maximum number of unsuccessful attempts is exceeded.", "justification": "Account Lockout (CFG-04.1) provides access control enforcement that compensates for the absence of Acceptance of PIV Credentials (IAC-32.2) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "IAC-37", "name": "Multi-Factor Authentication (MFA)", "description": "Automated mechanisms exist to enforce Multi-Factor Authentication (MFA) for:\n(1) Remote network access; \n(2) Third-party Technology Assets, Applications and/or Services (TAAS); and/ or\n(3) Non-console access to critical TAAS that store, transmit and/or process sensitive and/or regulated data.", "justification": "Multi-Factor Authentication (MFA) (IAC-37) provides access control enforcement that compensates for the absence of Acceptance of PIV Credentials (IAC-32.2) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "IAC-33", "risk_if_not_implemented": "Without Identification & Authentication for Non-Organizational Users, credentials may be phished, replayed, guessed or stolen, allowing unauthorized actors to authenticate as trusted identities. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss of Accountability / Attribution (R-AC-1), Unauthorized Access (R-AC-4), Identity Compromise / Impersonation (R-AC-5), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9).", "compensating_control_1": { "control_id": "IAC-37", "name": "Multi-Factor Authentication (MFA)", "description": "Automated mechanisms exist to enforce Multi-Factor Authentication (MFA) for:\n(1) Remote network access; \n(2) Third-party Technology Assets, Applications and/or Services (TAAS); and/ or\n(3) Non-console access to critical TAAS that store, transmit and/or process sensitive and/or regulated data.", "justification": "Multi-Factor Authentication (MFA) (IAC-37) provides access control enforcement that compensates for the absence of Identification & Authentication for Non-Organizational Users (IAC-33) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "MON-18.1", "name": "Session Audit", "description": "Mechanisms exist to provide session audit capabilities that can: \n(1) Capture and log all content related to a user session; and\n(2) Remotely view all content related to an established user session in real time.", "justification": "Session Audit (MON-18.1) provides detective monitoring capability that compensates for the absence of Identification & Authentication for Non-Organizational Users (IAC-33) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "IAC-33.1", "risk_if_not_implemented": "Without Acceptance of Third-Party Credentials, supplier and External Service Provider (ESP) weaknesses, incidents or failures may propagate into the organization's environment unmanaged. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Access (R-AC-4), Identity Compromise / Impersonation (R-AC-5), and most likely increases susceptibility to Malicious Cyber Activity (MT-2).", "compensating_control_1": { "control_id": "IAC-37", "name": "Multi-Factor Authentication (MFA)", "description": "Automated mechanisms exist to enforce Multi-Factor Authentication (MFA) for:\n(1) Remote network access; \n(2) Third-party Technology Assets, Applications and/or Services (TAAS); and/ or\n(3) Non-console access to critical TAAS that store, transmit and/or process sensitive and/or regulated data.", "justification": "Multi-Factor Authentication (MFA) (IAC-37) provides access control enforcement that compensates for the absence of Acceptance of Third-Party Credentials (IAC-33.1) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "IAC-33", "name": "Identification & Authentication for Non-Organizational Users", "description": "Mechanisms exist to uniquely identify and centrally Authenticate, Authorize and Audit (AAA) third-party users and processes that provide services to the organization.", "justification": "Identification & Authentication for Non-Organizational Users (IAC-33) provides access control enforcement that compensates for the absence of Acceptance of Third-Party Credentials (IAC-33.1) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "IAC-33.2", "risk_if_not_implemented": "Without Acceptance of External Authenticators, credentials may be phished, replayed, guessed or stolen, allowing unauthorized actors to authenticate as trusted identities. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Access (R-AC-4), Identity Compromise / Impersonation (R-AC-5), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Statutory / Regulatory / Contractual Change (MT-11).", "compensating_control_1": { "control_id": "IAC-37", "name": "Multi-Factor Authentication (MFA)", "description": "Automated mechanisms exist to enforce Multi-Factor Authentication (MFA) for:\n(1) Remote network access; \n(2) Third-party Technology Assets, Applications and/or Services (TAAS); and/ or\n(3) Non-console access to critical TAAS that store, transmit and/or process sensitive and/or regulated data.", "justification": "Multi-Factor Authentication (MFA) (IAC-37) provides access control enforcement that compensates for the absence of Acceptance of External Authenticators (IAC-33.2) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "MON-18.1", "name": "Session Audit", "description": "Mechanisms exist to provide session audit capabilities that can: \n(1) Capture and log all content related to a user session; and\n(2) Remotely view all content related to an established user session in real time.", "justification": "Session Audit (MON-18.1) provides detective monitoring capability that compensates for the absence of Acceptance of External Authenticators (IAC-33.2) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "IAC-33.3", "risk_if_not_implemented": "Without Disassociability, unauthorized individuals, devices or services may gain access to Technology Assets, Applications, Services, Data and/or Facilities (TAASDF). Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss of Confidentiality (R-IP-2), Privacy Harm / Unauthorized Processing (R-IP-6). No threat is rated Likely for this control; threats rated Possible include Malicious Cyber Activity (MT-2), Dysfunctional Management Practices (MT-8), Human Error (MT-9).", "compensating_control_1": { "control_id": "IAC-33", "name": "Identification & Authentication for Non-Organizational Users", "description": "Mechanisms exist to uniquely identify and centrally Authenticate, Authorize and Audit (AAA) third-party users and processes that provide services to the organization.", "justification": "Identification & Authentication for Non-Organizational Users (IAC-33) provides access control enforcement that compensates for the absence of Disassociability (IAC-33.3) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "IAC-37", "name": "Multi-Factor Authentication (MFA)", "description": "Automated mechanisms exist to enforce Multi-Factor Authentication (MFA) for:\n(1) Remote network access; \n(2) Third-party Technology Assets, Applications and/or Services (TAAS); and/ or\n(3) Non-console access to critical TAAS that store, transmit and/or process sensitive and/or regulated data.", "justification": "Multi-Factor Authentication (MFA) (IAC-37) provides access control enforcement that compensates for the absence of Disassociability (IAC-33.3) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "IAC-33.4", "risk_if_not_implemented": "Without Acceptance of PIV Credentials from Other Organizations, credentials may be phished, replayed, guessed or stolen, allowing unauthorized actors to authenticate as trusted identities. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Access (R-AC-4), Identity Compromise / Impersonation (R-AC-5), and most likely increases susceptibility to Malicious Cyber Activity (MT-2).", "compensating_control_1": { "control_id": "TPM-13", "name": "Third-Party Personnel Security", "description": "Mechanisms exist to control personnel security requirements including security roles and responsibilities for third-party providers.", "justification": "Third-Party Personnel Security (TPM-13) provides third-party oversight that compensates for the absence of Acceptance of PIV Credentials from Other Organizations (IAC-33.4) by extending security obligations contractually and monitoring third-party risk in lieu of direct control. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "IAC-37", "name": "Multi-Factor Authentication (MFA)", "description": "Automated mechanisms exist to enforce Multi-Factor Authentication (MFA) for:\n(1) Remote network access; \n(2) Third-party Technology Assets, Applications and/or Services (TAAS); and/ or\n(3) Non-console access to critical TAAS that store, transmit and/or process sensitive and/or regulated data.", "justification": "Multi-Factor Authentication (MFA) (IAC-37) provides access control enforcement that compensates for the absence of Acceptance of PIV Credentials from Other Organizations (IAC-33.4) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "IAC-33.5", "risk_if_not_implemented": "Without Use of FICAM-Issued Profiles, unauthorized individuals, devices or services may gain access to Technology Assets, Applications, Services, Data and/or Facilities (TAASDF). Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Regulatory / Legal / Contractual Financial Liability (R-EX-5), Loss of Authorization / Certification / License (R-EX-11), Inability to Demonstrate Due Diligence / Due Care (R-GV-9), and most likely increases susceptibility to Statutory / Regulatory / Contractual Change (MT-11).", "compensating_control_1": { "control_id": "MON-18.1", "name": "Session Audit", "description": "Mechanisms exist to provide session audit capabilities that can: \n(1) Capture and log all content related to a user session; and\n(2) Remotely view all content related to an established user session in real time.", "justification": "Session Audit (MON-18.1) provides detective monitoring capability that compensates for the absence of Use of FICAM-Issued Profiles (IAC-33.5) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "IAC-37", "name": "Multi-Factor Authentication (MFA)", "description": "Automated mechanisms exist to enforce Multi-Factor Authentication (MFA) for:\n(1) Remote network access; \n(2) Third-party Technology Assets, Applications and/or Services (TAAS); and/ or\n(3) Non-console access to critical TAAS that store, transmit and/or process sensitive and/or regulated data.", "justification": "Multi-Factor Authentication (MFA) (IAC-37) provides access control enforcement that compensates for the absence of Use of FICAM-Issued Profiles (IAC-33.5) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "IAC-34", "risk_if_not_implemented": "Without Identification & Authentication for Devices, credentials may be phished, replayed, guessed or stolen, allowing unauthorized actors to authenticate as trusted identities. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss of Accountability / Attribution (R-AC-1), Unauthorized Access (R-AC-4), Identity Compromise / Impersonation (R-AC-5), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Technical / Mechanical Failure (MT-10), Cryptographic Compromise / Cryptanalytic Capability Advancement (MT-31).", "compensating_control_1": { "control_id": "NET-31", "name": "Network Intrusion Detection / Prevention Systems (NIDS / NIPS)", "description": "Mechanisms exist to employ Network Intrusion Detection / Prevention Systems (NIDS/NIPS) to detect and/or prevent intrusions into the network.", "justification": "Network Intrusion Detection / Prevention Systems (NIDS / NIPS) (NET-31) provides detective monitoring capability that compensates for the absence of Identification & Authentication for Devices (IAC-34) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "MON-02", "name": "Continuous Monitoring", "description": "Mechanisms exist to facilitate the implementation of enterprise-wide monitoring controls.", "justification": "Continuous Monitoring (MON-02) provides detective monitoring capability that compensates for the absence of Identification & Authentication for Devices (IAC-34) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "IAC-34.1", "risk_if_not_implemented": "Without Device Attestation, unauthorized individuals, devices or services may gain access to Technology Assets, Applications, Services, Data and/or Facilities (TAASDF). Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Access (R-AC-4), Identity Compromise / Impersonation (R-AC-5), and most likely increases susceptibility to Human Error (MT-9).", "compensating_control_1": { "control_id": "IAC-38", "name": "Cryptographic Module Authentication", "description": "Automated mechanisms exist to enable Technology Assets, Applications and/or Services (TAAS) to authenticate to a cryptographic module.", "justification": "Cryptographic Module Authentication (IAC-38) provides cryptographic protection that compensates for the absence of Device Attestation (IAC-34.1) by ensuring data confidentiality and integrity through alternative technical means. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "NET-31", "name": "Network Intrusion Detection / Prevention Systems (NIDS / NIPS)", "description": "Mechanisms exist to employ Network Intrusion Detection / Prevention Systems (NIDS/NIPS) to detect and/or prevent intrusions into the network.", "justification": "Network Intrusion Detection / Prevention Systems (NIDS / NIPS) (NET-31) provides detective monitoring capability that compensates for the absence of Device Attestation (IAC-34.1) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "IAC-34.2", "risk_if_not_implemented": "Without Device Authorization Enforcement, unauthorized individuals, devices or services may gain access to Technology Assets, Applications, Services, Data and/or Facilities (TAASDF). Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss of Accountability / Attribution (R-AC-1), Excessive or Unauthorized Privilege (R-AC-2), Unauthorized Access (R-AC-4), Identity Compromise / Impersonation (R-AC-5), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Technical / Mechanical Failure (MT-10), Cryptographic Compromise / Cryptanalytic Capability Advancement (MT-31).", "compensating_control_1": { "control_id": "MON-02", "name": "Continuous Monitoring", "description": "Mechanisms exist to facilitate the implementation of enterprise-wide monitoring controls.", "justification": "Continuous Monitoring (MON-02) provides detective monitoring capability that compensates for the absence of Device Authorization Enforcement (IAC-34.2) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "IAC-34", "name": "Identification & Authentication for Devices", "description": "Mechanisms exist to uniquely identify and centrally Authenticate, Authorize and Audit (AAA) devices before establishing a connection using bidirectional authentication that is cryptographically- based and replay resistant.", "justification": "Identification & Authentication for Devices (IAC-34) provides access control enforcement that compensates for the absence of Device Authorization Enforcement (IAC-34.2) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "IAC-35", "risk_if_not_implemented": "Without Access Control For Mobile Devices, unauthorized individuals, devices or services may gain access to Technology Assets, Applications, Services, Data and/or Facilities (TAASDF). Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Access (R-AC-4), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "IAC-25", "name": "Access Enforcement", "description": "Mechanisms exist to enforce Logical Access Control (LAC) permissions that conform to the principle of \"least privilege.\"", "justification": "Access Enforcement (IAC-25) provides access control enforcement that compensates for the absence of Access Control For Mobile Devices (IAC-35) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "NET-26", "name": "Remote Access", "description": "Mechanisms exist to define, control and review organization-approved, secure remote access methods.", "justification": "Remote Access (NET-26) provides access control enforcement that compensates for the absence of Access Control For Mobile Devices (IAC-35) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "IAC-36", "risk_if_not_implemented": "Without Identification & Authentication for Third-Party Technology Assets, Applications and/or Services (TAAS), supplier and External Service Provider (ESP) weaknesses, incidents or failures may propagate into the organization's environment unmanaged. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Access (R-AC-4), Identity Compromise / Impersonation (R-AC-5), and most likely increases susceptibility to Malicious Cyber Activity (MT-2).", "compensating_control_1": { "control_id": "TPM-14", "name": "Third-Party Contract Requirements", "description": "Mechanisms exist to require contractual requirements for applicable security, compliance and resilience requirements with third-parties, reflecting the organization's needs to protect its Technology Assets, Applications, Services and/or Data (TAASD).", "justification": "Third-Party Contract Requirements (TPM-14) provides third-party oversight that compensates for the absence of Identification & Authentication for Third-Party Technology Assets, Applications and/or Services (TAAS) (IAC-36) by extending security obligations contractually and monitoring third-party risk in lieu of direct control. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "IAC-37", "name": "Multi-Factor Authentication (MFA)", "description": "Automated mechanisms exist to enforce Multi-Factor Authentication (MFA) for:\n(1) Remote network access; \n(2) Third-party Technology Assets, Applications and/or Services (TAAS); and/ or\n(3) Non-console access to critical TAAS that store, transmit and/or process sensitive and/or regulated data.", "justification": "Multi-Factor Authentication (MFA) (IAC-37) provides access control enforcement that compensates for the absence of Identification & Authentication for Third-Party Technology Assets, Applications and/or Services (TAAS) (IAC-36) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "IAC-36.1", "risk_if_not_implemented": "Without Sharing Identification & Authentication Information, credentials may be phished, replayed, guessed or stolen, allowing unauthorized actors to authenticate as trusted identities. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss of Accountability / Attribution (R-AC-1), Unauthorized Access (R-AC-4), Lack of oversight of third-party controls (R-GV-7), and most likely increases susceptibility to Human Error (MT-9), Data Quality Degradation / Data Poisoning (MT-12).", "compensating_control_1": { "control_id": "TPM-13", "name": "Third-Party Personnel Security", "description": "Mechanisms exist to control personnel security requirements including security roles and responsibilities for third-party providers.", "justification": "Third-Party Personnel Security (TPM-13) provides third-party oversight that compensates for the absence of Sharing Identification & Authentication Information (IAC-36.1) by extending security obligations contractually and monitoring third-party risk in lieu of direct control. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "IAC-37", "name": "Multi-Factor Authentication (MFA)", "description": "Automated mechanisms exist to enforce Multi-Factor Authentication (MFA) for:\n(1) Remote network access; \n(2) Third-party Technology Assets, Applications and/or Services (TAAS); and/ or\n(3) Non-console access to critical TAAS that store, transmit and/or process sensitive and/or regulated data.", "justification": "Multi-Factor Authentication (MFA) (IAC-37) provides access control enforcement that compensates for the absence of Sharing Identification & Authentication Information (IAC-36.1) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "IAC-36.2", "risk_if_not_implemented": "Without Privileged Access by Non-Organizational Users, users, services and processes may obtain or retain access beyond authorized need, enabling misuse or escalation. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Excessive or Unauthorized Privilege (R-AC-2), Unauthorized Privilege Elevation (R-AC-3), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Dysfunctional Management Practices (MT-8), Human Error (MT-9).", "compensating_control_1": { "control_id": "IAC-37", "name": "Multi-Factor Authentication (MFA)", "description": "Automated mechanisms exist to enforce Multi-Factor Authentication (MFA) for:\n(1) Remote network access; \n(2) Third-party Technology Assets, Applications and/or Services (TAAS); and/ or\n(3) Non-console access to critical TAAS that store, transmit and/or process sensitive and/or regulated data.", "justification": "Multi-Factor Authentication (MFA) (IAC-37) provides access control enforcement that compensates for the absence of Privileged Access by Non-Organizational Users (IAC-36.2) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "TPM-14", "name": "Third-Party Contract Requirements", "description": "Mechanisms exist to require contractual requirements for applicable security, compliance and resilience requirements with third-parties, reflecting the organization's needs to protect its Technology Assets, Applications, Services and/or Data (TAASD).", "justification": "Third-Party Contract Requirements (TPM-14) provides third-party oversight that compensates for the absence of Privileged Access by Non-Organizational Users (IAC-36.2) by extending security obligations contractually and monitoring third-party risk in lieu of direct control. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "IAC-37", "risk_if_not_implemented": "Without Multi-Factor Authentication (MFA), credentials may be phished, replayed, guessed or stolen, allowing unauthorized actors to authenticate as trusted identities. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Access (R-AC-4), Identity Compromise / Impersonation (R-AC-5), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "NET-03", "name": "Boundary Protection", "description": "Mechanisms exist to monitor and control communications at the external network boundary and at key internal boundaries within the network.", "justification": "Boundary Protection (NET-03) provides network-level access restriction that compensates for the absence of Multi-Factor Authentication (MFA) (IAC-37) by limiting attacker reach and lateral movement opportunities across the environment. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "MON-16", "name": "Anomalous Behavior", "description": "Mechanisms exist to utilize User & Entity Behavior Analytics (UEBA) and/or User Activity Monitoring (UAM) solutions to detect and respond to anomalous behavior that could indicate account compromise or other malicious activities.", "justification": "Anomalous Behavior (MON-16) provides detective monitoring capability that compensates for the absence of Multi-Factor Authentication (MFA) (IAC-37) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "IAC-37.1", "risk_if_not_implemented": "Without Replay-Resistant Multi-Factor Authentication (MFA), credentials may be phished, replayed, guessed or stolen, allowing unauthorized actors to authenticate as trusted identities. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Access (R-AC-4), Identity Compromise / Impersonation (R-AC-5), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9).", "compensating_control_1": { "control_id": "IAC-37", "name": "Multi-Factor Authentication (MFA)", "description": "Automated mechanisms exist to enforce Multi-Factor Authentication (MFA) for:\n(1) Remote network access; \n(2) Third-party Technology Assets, Applications and/or Services (TAAS); and/ or\n(3) Non-console access to critical TAAS that store, transmit and/or process sensitive and/or regulated data.", "justification": "Multi-Factor Authentication (MFA) (IAC-37) provides access control enforcement that compensates for the absence of Replay-Resistant Multi-Factor Authentication (MFA) (IAC-37.1) by restricting system and data access through alternative identity and access management mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "IAC-19", "name": "Hardware Token-Based Authentication", "description": "Automated mechanisms exist to ensure organization-defined token quality requirements are satisfied for hardware token-based authentication.", "justification": "Hardware Token-Based Authentication (IAC-19) provides access control enforcement that compensates for the absence of Replay-Resistant Multi-Factor Authentication (MFA) (IAC-37.1) by restricting system and data access through alternative identity and access management mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "IAC-37.2", "risk_if_not_implemented": "Without Phishing-Resistant Multi-Factor Authentication (MFA), credentials may be phished, replayed, guessed or stolen, allowing unauthorized actors to authenticate as trusted identities. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Access (R-AC-4), Identity Compromise / Impersonation (R-AC-5), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9), Cryptographic Compromise / Cryptanalytic Capability Advancement (MT-31).", "compensating_control_1": { "control_id": "IAC-37", "name": "Multi-Factor Authentication (MFA)", "description": "Automated mechanisms exist to enforce Multi-Factor Authentication (MFA) for:\n(1) Remote network access; \n(2) Third-party Technology Assets, Applications and/or Services (TAAS); and/ or\n(3) Non-console access to critical TAAS that store, transmit and/or process sensitive and/or regulated data.", "justification": "Multi-Factor Authentication (MFA) (IAC-37) provides access control enforcement that compensates for the absence of Phishing-Resistant Multi-Factor Authentication (MFA) (IAC-37.2) by restricting system and data access through alternative identity and access management mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "IAC-16", "name": "Passkeys", "description": "Mechanisms exist to utilize passkeys, or equivalent cryptographic key pairing technologies, to authenticate users to Technology Assets, Applications and/or Services (TAAS).", "justification": "Passkeys (IAC-16) provides access control enforcement that compensates for the absence of Phishing-Resistant Multi-Factor Authentication (MFA) (IAC-37.2) by restricting system and data access through alternative identity and access management mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "IAC-37.3", "risk_if_not_implemented": "Without Out-of-Band (OOB) Multi-Factor Authentication (MFA), credentials may be phished, replayed, guessed or stolen, allowing unauthorized actors to authenticate as trusted identities. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Access (R-AC-4), Identity Compromise / Impersonation (R-AC-5), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9).", "compensating_control_1": { "control_id": "IAC-37", "name": "Multi-Factor Authentication (MFA)", "description": "Automated mechanisms exist to enforce Multi-Factor Authentication (MFA) for:\n(1) Remote network access; \n(2) Third-party Technology Assets, Applications and/or Services (TAAS); and/ or\n(3) Non-console access to critical TAAS that store, transmit and/or process sensitive and/or regulated data.", "justification": "Multi-Factor Authentication (MFA) (IAC-37) provides access control enforcement that compensates for the absence of Out-of-Band Multi-Factor Authentication (IAC-37.3) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "NET-03", "name": "Boundary Protection", "description": "Mechanisms exist to monitor and control communications at the external network boundary and at key internal boundaries within the network.", "justification": "Boundary Protection (NET-03) provides network-level access restriction that compensates for the absence of Out-of-Band Multi-Factor Authentication (IAC-37.3) by limiting attacker reach and lateral movement opportunities across the environment. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "IAC-37.4", "risk_if_not_implemented": "Without Alternative Multi-Factor Authentication (MFA), credentials may be phished, replayed, guessed or stolen, allowing unauthorized actors to authenticate as trusted identities. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Access (R-AC-4), Identity Compromise / Impersonation (R-AC-5), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9).", "compensating_control_1": { "control_id": "IAC-41", "name": "Adaptive Identification & Authentication", "description": "Mechanisms exist to allow individuals to utilize alternative methods of authentication under specific circumstances or situations.", "justification": "Adaptive Identification & Authentication (IAC-41) provides access control enforcement that compensates for the absence of Alternative Multi-Factor Authentication (IAC-37.4) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "IAC-37", "name": "Multi-Factor Authentication (MFA)", "description": "Automated mechanisms exist to enforce Multi-Factor Authentication (MFA) for:\n(1) Remote network access; \n(2) Third-party Technology Assets, Applications and/or Services (TAAS); and/ or\n(3) Non-console access to critical TAAS that store, transmit and/or process sensitive and/or regulated data.", "justification": "Multi-Factor Authentication (MFA) (IAC-37) provides access control enforcement that compensates for the absence of Alternative Multi-Factor Authentication (IAC-37.4) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "IAC-37.5", "risk_if_not_implemented": "Without Multi-Factor Authentication (MFA) For Network Access to Privileged Accounts, credentials may be phished, replayed, guessed or stolen, allowing unauthorized actors to authenticate as trusted identities. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Access (R-AC-4), Identity Compromise / Impersonation (R-AC-5), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9).", "compensating_control_1": { "control_id": "IAC-41", "name": "Adaptive Identification & Authentication", "description": "Mechanisms exist to allow individuals to utilize alternative methods of authentication under specific circumstances or situations.", "justification": "Adaptive Identification & Authentication (IAC-41) provides access control enforcement that compensates for the absence of Network Access to Privileged Accounts (IAC-37.5) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "NET-03", "name": "Boundary Protection", "description": "Mechanisms exist to monitor and control communications at the external network boundary and at key internal boundaries within the network.", "justification": "Boundary Protection (NET-03) provides network-level access restriction that compensates for the absence of Network Access to Privileged Accounts (IAC-37.5) by limiting attacker reach and lateral movement opportunities across the environment. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "IAC-37.6", "risk_if_not_implemented": "Without Multi-Factor Authentication (MFA) For Network Access to Non-Privileged Accounts, credentials may be phished, replayed, guessed or stolen, allowing unauthorized actors to authenticate as trusted identities. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Access (R-AC-4), Identity Compromise / Impersonation (R-AC-5), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9).", "compensating_control_1": { "control_id": "NET-03", "name": "Boundary Protection", "description": "Mechanisms exist to monitor and control communications at the external network boundary and at key internal boundaries within the network.", "justification": "Boundary Protection (NET-03) provides network-level access restriction that compensates for the absence of Network Access to Non-Privileged Accounts (IAC-37.6) by limiting attacker reach and lateral movement opportunities across the environment. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "IAC-37", "name": "Multi-Factor Authentication (MFA)", "description": "Automated mechanisms exist to enforce Multi-Factor Authentication (MFA) for:\n(1) Remote network access; \n(2) Third-party Technology Assets, Applications and/or Services (TAAS); and/ or\n(3) Non-console access to critical TAAS that store, transmit and/or process sensitive and/or regulated data.", "justification": "Multi-Factor Authentication (MFA) (IAC-37) provides access control enforcement that compensates for the absence of Network Access to Non-Privileged Accounts (IAC-37.6) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "IAC-37.7", "risk_if_not_implemented": "Without Multi-Factor Authentication (MFA) For Local Access to Privileged Accounts, credentials may be phished, replayed, guessed or stolen, allowing unauthorized actors to authenticate as trusted identities. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Access (R-AC-4), Identity Compromise / Impersonation (R-AC-5), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9).", "compensating_control_1": { "control_id": "MON-16", "name": "Anomalous Behavior", "description": "Mechanisms exist to utilize User & Entity Behavior Analytics (UEBA) and/or User Activity Monitoring (UAM) solutions to detect and respond to anomalous behavior that could indicate account compromise or other malicious activities.", "justification": "Anomalous Behavior (MON-16) provides detective monitoring capability that compensates for the absence of Local Access to Privileged Accounts (IAC-37.7) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "IAC-37", "name": "Multi-Factor Authentication (MFA)", "description": "Automated mechanisms exist to enforce Multi-Factor Authentication (MFA) for:\n(1) Remote network access; \n(2) Third-party Technology Assets, Applications and/or Services (TAAS); and/ or\n(3) Non-console access to critical TAAS that store, transmit and/or process sensitive and/or regulated data.", "justification": "Multi-Factor Authentication (MFA) (IAC-37) provides access control enforcement that compensates for the absence of Local Access to Privileged Accounts (IAC-37.7) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "IAC-38", "risk_if_not_implemented": "Without Cryptographic Module Authentication, data in transit and at rest may be exposed through weak, misconfigured or compromised cryptographic protections. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Access (R-AC-4), Identity Compromise / Impersonation (R-AC-5), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9), Cryptographic Compromise / Cryptanalytic Capability Advancement (MT-31).", "compensating_control_1": { "control_id": "CRY-10", "name": "Cryptographic Key Management", "description": "Mechanisms exist to facilitate cryptographic key management controls to protect the confidentiality, integrity and availability of keys.", "justification": "Cryptographic Key Management (CRY-10) provides cryptographic protection that compensates for the absence of Cryptographic Module Authentication (IAC-12) by ensuring data confidentiality and integrity through alternative technical means. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "IAC-32", "name": "Identification & Authentication for Organizational Users", "description": "Mechanisms exist to uniquely identify and centrally Authenticate, Authorize and Audit (AAA) organizational users and processes acting on behalf of organizational users.", "justification": "Identification & Authentication for Organizational Users (IAC-32) provides access control enforcement that compensates for the absence of Cryptographic Module Authentication (IAC-12) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "IAC-39", "risk_if_not_implemented": "Without Hardware Security Modules (HSM), data in transit and at rest may be exposed through weak, misconfigured or compromised cryptographic protections. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Access (R-AC-4), Identity Compromise / Impersonation (R-AC-5), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "IAC-32", "name": "Identification & Authentication for Organizational Users", "description": "Mechanisms exist to uniquely identify and centrally Authenticate, Authorize and Audit (AAA) organizational users and processes acting on behalf of organizational users.", "justification": "Identification & Authentication for Organizational Users (IAC-32) provides access control enforcement that compensates for the absence of Hardware Security Modules (HSM) (IAC-39) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CRY-10", "name": "Cryptographic Key Management", "description": "Mechanisms exist to facilitate cryptographic key management controls to protect the confidentiality, integrity and availability of keys.", "justification": "Cryptographic Key Management (CRY-10) provides cryptographic protection that compensates for the absence of Hardware Security Modules (HSM) (IAC-39) by ensuring data confidentiality and integrity through alternative technical means. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "IAC-40", "risk_if_not_implemented": "Without Single Sign-On (SSO) Transparent Authentication, credentials may be phished, replayed, guessed or stolen, allowing unauthorized actors to authenticate as trusted identities. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Access (R-AC-4), Identity Compromise / Impersonation (R-AC-5), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9).", "compensating_control_1": { "control_id": "MON-16", "name": "Anomalous Behavior", "description": "Mechanisms exist to utilize User & Entity Behavior Analytics (UEBA) and/or User Activity Monitoring (UAM) solutions to detect and respond to anomalous behavior that could indicate account compromise or other malicious activities.", "justification": "Anomalous Behavior (MON-16) provides detective monitoring capability that compensates for the absence of Single Sign-On (SSO) Transparent Authentication (IAC-40) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "IAC-37", "name": "Multi-Factor Authentication (MFA)", "description": "Automated mechanisms exist to enforce Multi-Factor Authentication (MFA) for:\n(1) Remote network access; \n(2) Third-party Technology Assets, Applications and/or Services (TAAS); and/ or\n(3) Non-console access to critical TAAS that store, transmit and/or process sensitive and/or regulated data.", "justification": "Multi-Factor Authentication (MFA) (IAC-37) provides access control enforcement that compensates for the absence of Single Sign-On (SSO) Transparent Authentication (IAC-40) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "IAC-41", "risk_if_not_implemented": "Without Adaptive Identification & Authentication, credentials may be phished, replayed, guessed or stolen, allowing unauthorized actors to authenticate as trusted identities. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Access (R-AC-4), Identity Compromise / Impersonation (R-AC-5), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9).", "compensating_control_1": { "control_id": "IAC-37", "name": "Multi-Factor Authentication (MFA)", "description": "Automated mechanisms exist to enforce Multi-Factor Authentication (MFA) for:\n(1) Remote network access; \n(2) Third-party Technology Assets, Applications and/or Services (TAAS); and/ or\n(3) Non-console access to critical TAAS that store, transmit and/or process sensitive and/or regulated data.", "justification": "Multi-Factor Authentication (MFA) (IAC-37) provides access control enforcement that compensates for the absence of Adaptive Identification & Authentication (IAC-41) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "MON-16", "name": "Anomalous Behavior", "description": "Mechanisms exist to utilize User & Entity Behavior Analytics (UEBA) and/or User Activity Monitoring (UAM) solutions to detect and respond to anomalous behavior that could indicate account compromise or other malicious activities.", "justification": "Anomalous Behavior (MON-16) provides detective monitoring capability that compensates for the absence of Adaptive Identification & Authentication (IAC-41) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "IAC-42", "risk_if_not_implemented": "Without Continuous Authentication, credentials may be phished, replayed, guessed or stolen, allowing unauthorized actors to authenticate as trusted identities. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Access (R-AC-4), Identity Compromise / Impersonation (R-AC-5), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "MON-16", "name": "Anomalous Behavior", "description": "Mechanisms exist to utilize User & Entity Behavior Analytics (UEBA) and/or User Activity Monitoring (UAM) solutions to detect and respond to anomalous behavior that could indicate account compromise or other malicious activities.", "justification": "Anomalous Behavior (MON-16) provides detective monitoring capability that compensates for the absence of Continuous Authentication (IAC-42) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "IAC-41", "name": "Adaptive Identification & Authentication", "description": "Mechanisms exist to allow individuals to utilize alternative methods of authentication under specific circumstances or situations.", "justification": "Adaptive Identification & Authentication (IAC-41) provides access control enforcement that compensates for the absence of Continuous Authentication (IAC-42) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "IAC-43", "risk_if_not_implemented": "Without Re-Authentication, credentials may be phished, replayed, guessed or stolen, allowing unauthorized actors to authenticate as trusted identities. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Access (R-AC-4), Identity Compromise / Impersonation (R-AC-5), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "CFG-04.3", "name": "Session Lock", "description": "Mechanisms exist to initiate a session lock after an organization-defined time period of inactivity, or upon receiving a request from a user and retain the session lock until the user reestablishes access using established identification and authentication methods.", "justification": "Session Lock (CFG-04.3) provides overlapping security capability that compensates for the absence of Re-Authentication (IAC-43) by addressing related risk objectives through an alternative control mechanism aligned with Technology applicability. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CFG-04.5", "name": "Session Termination", "description": "Automated mechanisms exist to log out users, both locally on the network and for remote sessions, at the end of the session or after an organization-defined period of inactivity.", "justification": "Session Termination (CFG-04.5) provides overlapping security capability that compensates for the absence of Re-Authentication (IAC-43) by addressing related risk objectives through an alternative control mechanism aligned with Technology applicability. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "IAC-44", "risk_if_not_implemented": "Without Mutual Authentication (MA), credentials may be phished, replayed, guessed or stolen, allowing unauthorized actors to authenticate as trusted identities. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Access (R-AC-4), Identity Compromise / Impersonation (R-AC-5), Loss of Authenticity / Provenance (R-IP-5), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9), Technical / Mechanical Failure (MT-10), Cryptographic Compromise / Cryptanalytic Capability Advancement (MT-31).", "compensating_control_1": { "control_id": "IAC-38", "name": "Cryptographic Module Authentication", "description": "Automated mechanisms exist to enable Technology Assets, Applications and/or Services (TAAS) to authenticate to a cryptographic module.", "justification": "Cryptographic Module Authentication (IAC-38) provides cryptographic protection that compensates for the absence of Mutual Authentication (MA) (IAC-44) by ensuring data confidentiality and integrity through alternative technical means. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "IAC-37", "name": "Multi-Factor Authentication (MFA)", "description": "Automated mechanisms exist to enforce Multi-Factor Authentication (MFA) for:\n(1) Remote network access; \n(2) Third-party Technology Assets, Applications and/or Services (TAAS); and/ or\n(3) Non-console access to critical TAAS that store, transmit and/or process sensitive and/or regulated data.", "justification": "Multi-Factor Authentication (MFA) (IAC-37) provides access control enforcement that compensates for the absence of Mutual Authentication (MA) (IAC-44) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "IAC-45", "risk_if_not_implemented": "Without Federated Credential Management, credentials may be phished, replayed, guessed or stolen, allowing unauthorized actors to authenticate as trusted identities. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Access (R-AC-4), Identity Compromise / Impersonation (R-AC-5), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "IAC-37", "name": "Multi-Factor Authentication (MFA)", "description": "Automated mechanisms exist to enforce Multi-Factor Authentication (MFA) for:\n(1) Remote network access; \n(2) Third-party Technology Assets, Applications and/or Services (TAAS); and/ or\n(3) Non-console access to critical TAAS that store, transmit and/or process sensitive and/or regulated data.", "justification": "Multi-Factor Authentication (MFA) (IAC-37) provides access control enforcement that compensates for the absence of Federated Credential Management (IAC-45) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "IAC-41", "name": "Adaptive Identification & Authentication", "description": "Mechanisms exist to allow individuals to utilize alternative methods of authentication under specific circumstances or situations.", "justification": "Adaptive Identification & Authentication (IAC-41) provides access control enforcement that compensates for the absence of Federated Credential Management (IAC-45) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "IAC-46", "risk_if_not_implemented": "Without Invalidate Session Identifiers at Logout, credentials may be phished, replayed, guessed or stolen, allowing unauthorized actors to authenticate as trusted identities. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Access (R-AC-4), Identity Compromise / Impersonation (R-AC-5), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "MON-34", "name": "Non-Repudiation", "description": "Mechanisms exist to utilize a non-repudiation capability to protect against an individual falsely denying having performed a particular action.", "justification": "Non-Repudiation (MON-34) provides overlapping security capability that compensates for the absence of Invalidate Session Identifiers at Logout (IAC-46) by addressing related risk objectives through an alternative control mechanism aligned with Technology applicability. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CRY-06", "name": "Integrity of Data In Transit", "description": "Cryptographic mechanisms exist to detect unauthorized changes to data in transit.", "justification": "Integrity of Data In Transit (CRY-06) provides cryptographic protection that compensates for the absence of Invalidate Session Identifiers at Logout (IAC-46) by ensuring data confidentiality and integrity through alternative technical means. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "IAC-47", "risk_if_not_implemented": "Without Unique System-Generated Session Identifiers, credentials may be phished, replayed, guessed or stolen, allowing unauthorized actors to authenticate as trusted identities. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Access (R-AC-4), Identity Compromise / Impersonation (R-AC-5), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "CRY-06", "name": "Integrity of Data In Transit", "description": "Cryptographic mechanisms exist to detect unauthorized changes to data in transit.", "justification": "Integrity of Data In Transit (CRY-06) provides cryptographic protection that compensates for the absence of Unique System-Generated Session Identifiers (IAC-47) by ensuring data confidentiality and integrity through alternative technical means. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "NET-29", "name": "Session Integrity", "description": "Mechanisms exist to protect the authenticity and integrity of communications sessions.", "justification": "Session Integrity (NET-29) provides cryptographic protection that compensates for the absence of Unique System-Generated Session Identifiers (IAC-47) by ensuring data confidentiality and integrity through alternative technical means. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "IAC-48", "risk_if_not_implemented": "Without Software Defined Storage (SDS) Data Access Control, unauthorized individuals, devices or services may gain access to Technology Assets, Applications, Services, Data and/or Facilities (TAASDF). Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Access (R-AC-4), Loss of Confidentiality (R-IP-2), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "CFG-02", "name": "Configuration Management Program", "description": "Mechanisms exist to facilitate the implementation of configuration management controls.", "justification": "Configuration Management Program (CFG-02) provides policy-level governance that compensates for the absence of Software Defined Storage (SDS) (IAC-48) by establishing documented expectations, accountability structures, and organizational guardrails. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CLD-02", "name": "Cloud Services", "description": "Mechanisms exist to facilitate the implementation of cloud management controls to ensure cloud instances are secure and in-line with industry practices.", "justification": "Cloud Services (CLD-02) provides overlapping security capability that compensates for the absence of Software Defined Storage (SDS) (IAC-48) by addressing related risk objectives through an alternative control mechanism aligned with Technology applicability. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "IAC-49", "risk_if_not_implemented": "Without Sensitive / Regulated Data Access Enforcement, unauthorized individuals, devices or services may gain access to Technology Assets, Applications, Services, Data and/or Facilities (TAASDF). Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Access (R-AC-4), Loss of Confidentiality (R-IP-2), Privacy Harm / Unauthorized Processing (R-IP-6), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9), Technical / Mechanical Failure (MT-10), Statutory / Regulatory / Contractual Change (MT-11).", "compensating_control_1": { "control_id": "IAC-25", "name": "Access Enforcement", "description": "Mechanisms exist to enforce Logical Access Control (LAC) permissions that conform to the principle of \"least privilege.\"", "justification": "Access Enforcement (IAC-25) provides access control enforcement that compensates for the absence of Sensitive / Regulated Data Access Enforcement (IAC-49) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "DCH-02", "name": "Data Protection", "description": "Mechanisms exist to facilitate the implementation of data protection controls.", "justification": "Data Protection (DCH-02) provides overlapping security capability that compensates for the absence of Sensitive / Regulated Data Access Enforcement (IAC-49) by addressing related risk objectives through an alternative control mechanism aligned with Technology applicability. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "IAC-49.1", "risk_if_not_implemented": "Without Sensitive / Regulated Data Actions, sensitive and/or regulated data may be disclosed, altered or lost through inadequate classification, handling or protection. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss of Accountability / Attribution (R-AC-1), Loss of Investigative / Evidentiary Capability (R-IR-1), Undetected / Delayed Detection of Adverse Activity (R-SA-1), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Technical / Mechanical Failure (MT-10), Statutory / Regulatory / Contractual Change (MT-11).", "compensating_control_1": { "control_id": "DCH-02", "name": "Data Protection", "description": "Mechanisms exist to facilitate the implementation of data protection controls.", "justification": "Data Protection (DCH-02) provides overlapping security capability that compensates for the absence of Sensitive / Regulated Data Actions (IAC-49.1) by addressing related risk objectives through an alternative control mechanism aligned with Technology applicability. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "IAC-25", "name": "Access Enforcement", "description": "Mechanisms exist to enforce Logical Access Control (LAC) permissions that conform to the principle of \"least privilege.\"", "justification": "Access Enforcement (IAC-25) provides access control enforcement that compensates for the absence of Sensitive / Regulated Data Actions (IAC-49.1) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "IAC-50", "risk_if_not_implemented": "Without Compliance As Code (CAC) Identity Governance, automated control assurance results may be manipulated, misattributed or lose integrity, causing misplaced confidence in control effectiveness. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss of Accountability / Attribution (R-AC-1), Unaddressed Security / Compliance Exposure (R-GV-2), Unperformed / Unowned Control Responsibilities (R-GV-3), and most likely increases susceptibility to Human Error (MT-9), Data Quality Degradation / Data Poisoning (MT-12).", "compensating_control_1": { "control_id": "IAC-02", "name": "Identity & Access Management (IAM)", "description": "Mechanisms exist to facilitate the implementation of Identification and Access Management (IAM) controls.", "justification": "Identity & Access Management (IAM) (IAC-02) provides access control enforcement that compensates for the absence of Compliance As Code (CAC) Identity Governance (IAC-50) by restricting system and data access through alternative identity and access management mechanisms. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "IAC-12", "name": "Periodic Review of Individual & Service Account Privileges", "description": "Mechanisms exist to periodically-review the privileges assigned to individuals and service accounts to validate the need for such privileges and reassign or remove unnecessary privileges, as necessary.", "justification": "Periodic Review of Individual & Service Account Privileges (IAC-12) provides periodic assessment and verification that compensates for the absence of Compliance As Code (CAC) Identity Governance (IAC-50) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "IAC-51", "risk_if_not_implemented": "Without Compliance As Code (CAC) Least Privileges, automated control assurance results may be manipulated, misattributed or lose integrity, causing misplaced confidence in control effectiveness. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Excessive or Unauthorized Privilege (R-AC-2), Unauthorized Privilege Elevation (R-AC-3), and most likely increases susceptibility to Human Error (MT-9).", "compensating_control_1": { "control_id": "IAC-30", "name": "Least Privilege", "description": "Mechanisms exist to utilize the concept of least privilege, allowing only authorized access to processes necessary to accomplish assigned tasks in accordance with organizational business functions.", "justification": "Least Privilege (IAC-30) provides access control enforcement that compensates for the absence of Compliance As Code (CAC) Least Privileges (IAC-51) by restricting system and data access through alternative identity and access management mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "IAC-06", "name": "Role-Based Access Control (RBAC)", "description": "Mechanisms exist to enforce Role-Based Access Control (RBAC) for Technology Assets, Applications, Services and/or Data (TAASD) to restrict access to individuals assigned specific roles with legitimate business needs.", "justification": "Role-Based Access Control (RBAC) (IAC-06) provides access control enforcement that compensates for the absence of Compliance As Code (CAC) Least Privileges (IAC-51) by restricting system and data access through alternative identity and access management mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "IAC-52", "risk_if_not_implemented": "Without Compliance As Code (CAC) Credential Lifecycle Management, automated control assurance results may be manipulated, misattributed or lose integrity, causing misplaced confidence in control effectiveness. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Excessive or Unauthorized Privilege (R-AC-2), Unauthorized Access (R-AC-4), Identity Compromise / Impersonation (R-AC-5), and most likely increases susceptibility to Human Error (MT-9), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "IAC-14", "name": "Authenticator Management", "description": "Mechanisms exist to:\n(1) Securely manage authenticators for users and devices; and\n(2) Ensure the strength of authentication is appropriate to the classification of the data being accessed.", "justification": "Authenticator Management (IAC-14) provides access control enforcement that compensates for the absence of Compliance As Code (CAC) Credential Lifecycle Management (IAC-52) by restricting system and data access through alternative identity and access management mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "IAC-04", "name": "User Provisioning & De-Provisioning", "description": "Mechanisms exist to utilize a formal user registration and de-registration process that governs the assignment of access rights.", "justification": "User Provisioning & De-Provisioning (IAC-04) provides access control enforcement that compensates for the absence of Compliance As Code (CAC) Credential Lifecycle Management (IAC-52) by restricting system and data access through alternative identity and access management mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "IAC-53", "risk_if_not_implemented": "Without Compliance As Code (CAC) Credentials Management, automated control assurance results may be manipulated, misattributed or lose integrity, causing misplaced confidence in control effectiveness. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Identity Compromise / Impersonation (R-AC-5), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9).", "compensating_control_1": { "control_id": "IAC-14", "name": "Authenticator Management", "description": "Mechanisms exist to:\n(1) Securely manage authenticators for users and devices; and\n(2) Ensure the strength of authentication is appropriate to the classification of the data being accessed.", "justification": "Authenticator Management (IAC-14) provides access control enforcement that compensates for the absence of Compliance As Code (CAC) Credentials Management (IAC-53) by restricting system and data access through alternative identity and access management mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "DCH-15", "name": "Storing Authentication Data", "description": "Mechanisms exist to prohibit the storage of sensitive transaction authentication data after authorization.", "justification": "Storing Authentication Data (DCH-15) provides access control enforcement that compensates for the absence of Compliance As Code (CAC) Credentials Management (IAC-53) by restricting system and data access through alternative identity and access management mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "IRO-02", "risk_if_not_implemented": "Without Incident Response Operations, security incidents may not be detected, contained, investigated or communicated in a timely manner, increasing their scope, duration and cost. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Delayed Containment / Increased Incident Impact (R-IR-2), Incident Persistence / Recurrence (R-IR-3), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Dysfunctional Management Practices (MT-8), Human Error (MT-9), Workforce Shortage / Loss of Critical Skills / Labor Disruption (MT-25).", "compensating_control_1": { "control_id": "MON-02", "name": "Continuous Monitoring", "description": "Mechanisms exist to facilitate the implementation of enterprise-wide monitoring controls.", "justification": "Continuous Monitoring (MON-02) provides detective monitoring capability that compensates for the absence of Incident Response Operations (IRO-02) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "BCD-02", "name": "Business Continuity Management System (BCMS)", "description": "Mechanisms exist to operate a Business Continuity Management System (BCMS) to achieve resilient Technology Assets, Applications, Services and/or Data (TAASD) during:\n(1) Routine operations; and\n(2) Adverse conditions.", "justification": "Business Continuity Management System (BCMS) (BCD-02) provides resilience and recovery capability that compensates for the absence of Incident Response Operations (IRO-02) by ensuring the organization can restore operations and data when the primary control is absent. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "IRO-03", "risk_if_not_implemented": "Without Continuous Incident Response Improvements, security incidents may not be detected, contained, investigated or communicated in a timely manner, increasing their scope, duration and cost. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Lack of oversight of internal controls (R-GV-6), Unreliable Assurance / Decision Information (R-GV-10), Incident Persistence / Recurrence (R-IR-3), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Data Quality Degradation / Data Poisoning (MT-12).", "compensating_control_1": { "control_id": "BCD-02", "name": "Business Continuity Management System (BCMS)", "description": "Mechanisms exist to operate a Business Continuity Management System (BCMS) to achieve resilient Technology Assets, Applications, Services and/or Data (TAASD) during:\n(1) Routine operations; and\n(2) Adverse conditions.", "justification": "Business Continuity Management System (BCMS) (BCD-02) provides resilience and recovery capability that compensates for the absence of Continuous Incident Response Improvements (IRO-03) by ensuring the organization can restore operations and data when the primary control is absent. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "IRO-08", "name": "Incident Response Plan (IRP)", "description": "Mechanisms exist to maintain and make available a current and viable Incident Response Plan (IRP) to all stakeholders.", "justification": "Incident Response Plan (IRP) (IRO-08) provides incident response capability that compensates for the absence of Continuous Incident Response Improvements (IRO-03) by enabling timely detection, containment, and recovery from security events in the absence of the primary control. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "IRO-04", "risk_if_not_implemented": "Without Incident Classification & Prioritization, security incidents may not be detected, contained, investigated or communicated in a timely manner, increasing their scope, duration and cost. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Delayed Containment / Increased Incident Impact (R-IR-2), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9).", "compensating_control_1": { "control_id": "MON-02", "name": "Continuous Monitoring", "description": "Mechanisms exist to facilitate the implementation of enterprise-wide monitoring controls.", "justification": "Continuous Monitoring (MON-02) provides detective monitoring capability that compensates for the absence of Incident Classification & Prioritization (IRO-04) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "IRO-08", "name": "Incident Response Plan (IRP)", "description": "Mechanisms exist to maintain and make available a current and viable Incident Response Plan (IRP) to all stakeholders.", "justification": "Incident Response Plan (IRP) (IRO-08) provides incident response capability that compensates for the absence of Incident Classification & Prioritization (IRO-04) by enabling timely detection, containment, and recovery from security events in the absence of the primary control. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "IRO-05", "risk_if_not_implemented": "Without Indicators of Compromise (IOC), malicious, anomalous or unauthorized activity may go undetected or be detected too late to prevent or limit harm. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Undetected / Delayed Detection of Adverse Activity (R-SA-1), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9), Data Quality Degradation / Data Poisoning (MT-12).", "compensating_control_1": { "control_id": "THR-04", "name": "Threat Intelligence Feeds", "description": "Mechanisms exist to maintain situational awareness of vulnerabilities and evolving threats by leveraging the knowledge of attacker tactics, techniques and procedures to facilitate the implementation of preventative and compensating controls.", "justification": "Threat Intelligence Feeds (THR-04) provides overlapping security capability that compensates for the absence of Indicators of Compromise (IOC) (IRO-05) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "MON-02", "name": "Continuous Monitoring", "description": "Mechanisms exist to facilitate the implementation of enterprise-wide monitoring controls.", "justification": "Continuous Monitoring (MON-02) provides detective monitoring capability that compensates for the absence of Indicators of Compromise (IOC) (IRO-05) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "IRO-06.1", "risk_if_not_implemented": "Without Correlation with External Organizations, security incidents may not be detected, contained, investigated or communicated in a timely manner, increasing their scope, duration and cost. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Undetected / Delayed Detection of Adverse Activity (R-SA-1), and most likely increases susceptibility to Human Error (MT-9).", "compensating_control_1": { "control_id": "IRO-06", "name": "Incident Handling", "description": "Mechanisms exist to cover:\n(1) Preparation;\n(2) Automated event detection or manual incident report intake;\n(3) Analysis;\n(4) Containment;\n(5) Eradication; and\n(6) Recovery.", "justification": "Incident Handling (IRO-06) provides incident response capability that compensates for the absence of Correlation with External Organizations (IRO-06.1) by enabling timely detection, containment, and recovery from security events in the absence of the primary control. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "MON-02", "name": "Continuous Monitoring", "description": "Mechanisms exist to facilitate the implementation of enterprise-wide monitoring controls.", "justification": "Continuous Monitoring (MON-02) provides detective monitoring capability that compensates for the absence of Correlation with External Organizations (IRO-06.1) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "IRO-07", "risk_if_not_implemented": "Without Automated Incident Handling Processes, security incidents may not be detected, contained, investigated or communicated in a timely manner, increasing their scope, duration and cost. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Delayed Containment / Increased Incident Impact (R-IR-2), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "MON-05.2", "name": "Event Log & Security-Relevant Telemetry Analysis & Triage", "description": "Mechanisms exist to ensure event log and security-relevant telemetry reviews include analysis and triage practices that integrate with the organization's established incident response processes.", "justification": "Event Log & Security-Relevant Telemetry Analysis & Triage (MON-05.2) provides detective monitoring capability that compensates for the absence of Automated Incident Handling Processes (IRO-07) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "IRO-08", "name": "Incident Response Plan (IRP)", "description": "Mechanisms exist to maintain and make available a current and viable Incident Response Plan (IRP) to all stakeholders.", "justification": "Incident Response Plan (IRP) (IRO-08) provides incident response capability that compensates for the absence of Automated Incident Handling Processes (IRO-07) by enabling timely detection, containment, and recovery from security events in the absence of the primary control. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "IRO-07.1", "risk_if_not_implemented": "Without Automated Reporting, security incidents may not be detected, contained, investigated or communicated in a timely manner, increasing their scope, duration and cost. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Delayed Containment / Increased Incident Impact (R-IR-2), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "IRO-08", "name": "Incident Response Plan (IRP)", "description": "Mechanisms exist to maintain and make available a current and viable Incident Response Plan (IRP) to all stakeholders.", "justification": "Incident Response Plan (IRP) (IRO-08) provides incident response capability that compensates for the absence of Automated Reporting (IRO-07.1) by enabling timely detection, containment, and recovery from security events in the absence of the primary control. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "GOV-15", "name": "Contacts With Authorities", "description": "Mechanisms exist to identify and document appropriate contacts with relevant law enforcement and regulatory bodies.", "justification": "Contacts With Authorities (GOV-15) provides overlapping security capability that compensates for the absence of Automated Reporting (IRO-07.1) by addressing related risk objectives through an alternative control mechanism aligned with Technology applicability. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "IRO-07.2", "risk_if_not_implemented": "Without Automated Tracking, Data Collection & Analysis, security incidents may not be detected, contained, investigated or communicated in a timely manner, increasing their scope, duration and cost. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss of Investigative / Evidentiary Capability (R-IR-1), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Technical / Mechanical Failure (MT-10), Data Quality Degradation / Data Poisoning (MT-12).", "compensating_control_1": { "control_id": "THR-04", "name": "Threat Intelligence Feeds", "description": "Mechanisms exist to maintain situational awareness of vulnerabilities and evolving threats by leveraging the knowledge of attacker tactics, techniques and procedures to facilitate the implementation of preventative and compensating controls.", "justification": "Threat Intelligence Feeds (THR-04) provides overlapping security capability that compensates for the absence of Automated Tracking, Data Collection & Analysis (IRO-07.2) by addressing related risk objectives through an alternative control mechanism aligned with Technology applicability. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "MON-02", "name": "Continuous Monitoring", "description": "Mechanisms exist to facilitate the implementation of enterprise-wide monitoring controls.", "justification": "Continuous Monitoring (MON-02) provides detective monitoring capability that compensates for the absence of Automated Tracking, Data Collection & Analysis (IRO-07.2) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "IRO-07.3", "risk_if_not_implemented": "Without Dynamic Reconfiguration, Technology Assets, Applications and/or Services (TAAS) may operate with insecure, unauthorized or drifted configurations that expand the attack surface. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Delayed Containment / Increased Incident Impact (R-IR-2), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "IRO-08", "name": "Incident Response Plan (IRP)", "description": "Mechanisms exist to maintain and make available a current and viable Incident Response Plan (IRP) to all stakeholders.", "justification": "Incident Response Plan (IRP) (IRO-08) provides incident response capability that compensates for the absence of Dynamic Reconfiguration (IRO-07.3) by enabling timely detection, containment, and recovery from security events in the absence of the primary control. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "IRO-06", "name": "Incident Handling", "description": "Mechanisms exist to cover:\n(1) Preparation;\n(2) Automated event detection or manual incident report intake;\n(3) Analysis;\n(4) Containment;\n(5) Eradication; and\n(6) Recovery.", "justification": "Incident Handling (IRO-06) provides incident response capability that compensates for the absence of Dynamic Reconfiguration (IRO-07.3) by enabling timely detection, containment, and recovery from security events in the absence of the primary control. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "IRO-07.4", "risk_if_not_implemented": "Without Automatic Disabling of Technology Assets, Applications and/or Services (TAAS), security incidents may not be detected, contained, investigated or communicated in a timely manner, increasing their scope, duration and cost. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss of Investigative / Evidentiary Capability (R-IR-1), Delayed Containment / Increased Incident Impact (R-IR-2), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "IRO-08", "name": "Incident Response Plan (IRP)", "description": "Mechanisms exist to maintain and make available a current and viable Incident Response Plan (IRP) to all stakeholders.", "justification": "Incident Response Plan (IRP) (IRO-08) provides incident response capability that compensates for the absence of Automatic Disabling of Technology Assets, Applications and/or Services (TAAS) (IRO-07.4) by enabling timely detection, containment, and recovery from security events in the absence of the primary control. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "MON-05.2", "name": "Event Log & Security-Relevant Telemetry Analysis & Triage", "description": "Mechanisms exist to ensure event log and security-relevant telemetry reviews include analysis and triage practices that integrate with the organization's established incident response processes.", "justification": "Event Log & Security-Relevant Telemetry Analysis & Triage (MON-05.2) provides detective monitoring capability that compensates for the absence of Automatic Disabling of Technology Assets, Applications and/or Services (TAAS) (IRO-07.4) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "IRO-08", "risk_if_not_implemented": "Without Incident Response Plan (IRP), security incidents may not be detected, contained, investigated or communicated in a timely manner, increasing their scope, duration and cost. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unperformed / Unowned Control Responsibilities (R-GV-3), Uncontrolled Internal Security / Privacy Exposure (R-GV-4), Inability to Demonstrate Due Diligence / Due Care (R-GV-9), Delayed Containment / Increased Incident Impact (R-IR-2), and most likely increases susceptibility to Human Error (MT-9).", "compensating_control_1": { "control_id": "IRO-10", "name": "Incident Response Training", "description": "Mechanisms exist to train personnel in their incident response roles and responsibilities.", "justification": "Incident Response Training (IRO-10) provides personnel training and awareness that compensates for the absence of Incident Response Plan (IRP) (IRO-08) by reducing human-factor risk by equipping personnel to recognize and respond to relevant threats. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "BCD-02", "name": "Business Continuity Management System (BCMS)", "description": "Mechanisms exist to operate a Business Continuity Management System (BCMS) to achieve resilient Technology Assets, Applications, Services and/or Data (TAASD) during:\n(1) Routine operations; and\n(2) Adverse conditions.", "justification": "Business Continuity Management System (BCMS) (BCD-02) provides resilience and recovery capability that compensates for the absence of Incident Response Plan (IRP) (IRO-08) by ensuring the organization can restore operations and data when the primary control is absent. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "IRO-08.1", "risk_if_not_implemented": "Without Incident Response Plan (IRP) Update, security incidents may not be detected, contained, investigated or communicated in a timely manner, increasing their scope, duration and cost. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Lack of oversight of internal controls (R-GV-6), Incident Persistence / Recurrence (R-IR-3), and most likely increases susceptibility to Human Error (MT-9).", "compensating_control_1": { "control_id": "IRO-14", "name": "Root Cause Analysis (RCA) & Lessons Learned", "description": "Mechanisms exist to incorporate lessons learned from analyzing and resolving cybersecurity and data protection incidents to reduce the likelihood or impact of future incidents.", "justification": "Root Cause Analysis (RCA) & Lessons Learned (IRO-14) provides overlapping security capability that compensates for the absence of IRP Update (IRO-08.1) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "IRO-08", "name": "Incident Response Plan (IRP)", "description": "Mechanisms exist to maintain and make available a current and viable Incident Response Plan (IRP) to all stakeholders.", "justification": "Incident Response Plan (IRP) (IRO-08) provides incident response capability that compensates for the absence of IRP Update (IRO-08.1) by enabling timely detection, containment, and recovery from security events in the absence of the primary control. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "IRO-09", "risk_if_not_implemented": "Without Incident Response Capabilities Testing, security incidents may not be detected, contained, investigated or communicated in a timely manner, increasing their scope, duration and cost. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Lack of oversight of internal controls (R-GV-6), Inability to Demonstrate Due Diligence / Due Care (R-GV-9), and most likely increases susceptibility to Human Error (MT-9).", "compensating_control_1": { "control_id": "BCD-10", "name": "Contingency Plan Testing & Exercises", "description": "Mechanisms exist to conduct tests and/or exercises to evaluate the contingency plan's effectiveness and the organization's readiness to execute the plan.", "justification": "Contingency Plan Testing & Exercises (BCD-10) provides periodic assessment and assurance that compensates for the absence of Incident Response Testing (IRO-09) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "IRO-10", "name": "Incident Response Training", "description": "Mechanisms exist to train personnel in their incident response roles and responsibilities.", "justification": "Incident Response Training (IRO-10) provides personnel training and awareness that compensates for the absence of Incident Response Testing (IRO-09) by reducing human-factor risk by equipping personnel to recognize and respond to relevant threats. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "IRO-09.1", "risk_if_not_implemented": "Without Incident Response Capabilities Testing Coordination with Related Plans, security incidents may not be detected, contained, investigated or communicated in a timely manner, increasing their scope, duration and cost. Based on the risk and threat mapping for this control, no risk is rated Likely; risks rated Possible include Business / Service Interruption (R-BC-1), Unperformed / Unowned Control Responsibilities (R-GV-3), Lack of oversight of internal controls (R-GV-6), and most likely increases susceptibility to Human Error (MT-9).", "compensating_control_1": { "control_id": "IRO-10", "name": "Incident Response Training", "description": "Mechanisms exist to train personnel in their incident response roles and responsibilities.", "justification": "Incident Response Training (IRO-10) provides personnel training and awareness that compensates for the absence of Coordination with Related Plans (IRO-09.1) by reducing human-factor risk by equipping personnel to recognize and respond to relevant threats. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "BCD-10", "name": "Contingency Plan Testing & Exercises", "description": "Mechanisms exist to conduct tests and/or exercises to evaluate the contingency plan's effectiveness and the organization's readiness to execute the plan.", "justification": "Contingency Plan Testing & Exercises (BCD-10) provides periodic assessment and assurance that compensates for the absence of Coordination with Related Plans (IRO-09.1) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "IRO-10", "risk_if_not_implemented": "Without Incident Response Training, security incidents may not be detected, contained, investigated or communicated in a timely manner, increasing their scope, duration and cost. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Inability to Demonstrate Due Diligence / Due Care (R-GV-9), Lack of a security-minded workforce (R-SA-2), and most likely increases susceptibility to Human Error (MT-9).", "compensating_control_1": { "control_id": "SAT-05", "name": "Role-Based Security, Compliance & Resilience Training", "description": "Mechanisms exist to provide role-based security, compliance and resilience-related training: \n(1) Before authorizing access to the system or performing assigned duties; \n(2) When required by system changes; and \n(3) Annually thereafter.", "justification": "Role-Based Security, Compliance & Resilience Training (SAT-05) provides personnel training and awareness that compensates for the absence of Incident Response Training (IRO-10) by reducing human-factor risk by equipping personnel to recognize and respond to relevant threats. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "IRO-08", "name": "Incident Response Plan (IRP)", "description": "Mechanisms exist to maintain and make available a current and viable Incident Response Plan (IRP) to all stakeholders.", "justification": "Incident Response Plan (IRP) (IRO-08) provides incident response capability that compensates for the absence of Incident Response Training (IRO-10) by enabling timely detection, containment, and recovery from security events in the absence of the primary control. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "IRO-10.1", "risk_if_not_implemented": "Without Simulated Incidents, security incidents may not be detected, contained, investigated or communicated in a timely manner, increasing their scope, duration and cost. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Lack of a security-minded workforce (R-SA-2), and most likely increases susceptibility to Human Error (MT-9).", "compensating_control_1": { "control_id": "IRO-08", "name": "Incident Response Plan (IRP)", "description": "Mechanisms exist to maintain and make available a current and viable Incident Response Plan (IRP) to all stakeholders.", "justification": "Incident Response Plan (IRP) (IRO-08) provides incident response capability that compensates for the absence of Simulated Incidents (IRO-10.1) by enabling timely detection, containment, and recovery from security events in the absence of the primary control. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "SAT-05", "name": "Role-Based Security, Compliance & Resilience Training", "description": "Mechanisms exist to provide role-based security, compliance and resilience-related training: \n(1) Before authorizing access to the system or performing assigned duties; \n(2) When required by system changes; and \n(3) Annually thereafter.", "justification": "Role-Based Security, Compliance & Resilience Training (SAT-05) provides personnel training and awareness that compensates for the absence of Simulated Incidents (IRO-10.1) by reducing human-factor risk by equipping personnel to recognize and respond to relevant threats. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "IRO-10.2", "risk_if_not_implemented": "Without Automated Incident Response Training Environments, security incidents may not be detected, contained, investigated or communicated in a timely manner, increasing their scope, duration and cost. Based on the risk and threat mapping for this control, no risk is rated Likely; risks rated Possible include Inability to Demonstrate Due Diligence / Due Care (R-GV-9), Delayed Containment / Increased Incident Impact (R-IR-2), Incident Persistence / Recurrence (R-IR-3), and most likely increases susceptibility to Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "SAT-05", "name": "Role-Based Security, Compliance & Resilience Training", "description": "Mechanisms exist to provide role-based security, compliance and resilience-related training: \n(1) Before authorizing access to the system or performing assigned duties; \n(2) When required by system changes; and \n(3) Annually thereafter.", "justification": "Role-Based Security, Compliance & Resilience Training (SAT-05) provides personnel training and awareness that compensates for the absence of Automated Incident Response Training Environments (IRO-10.2) by reducing human-factor risk by equipping personnel to recognize and respond to relevant threats. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "IRO-10", "name": "Incident Response Training", "description": "Mechanisms exist to train personnel in their incident response roles and responsibilities.", "justification": "Incident Response Training (IRO-10) provides personnel training and awareness that compensates for the absence of Automated Incident Response Training Environments (IRO-10.2) by reducing human-factor risk by equipping personnel to recognize and respond to relevant threats. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "IRO-11", "risk_if_not_implemented": "Without Integrated Security Incident Response Team (ISIRT), security incidents may not be detected, contained, investigated or communicated in a timely manner, increasing their scope, duration and cost. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unperformed / Unowned Control Responsibilities (R-GV-3), Uncontrolled Internal Security / Privacy Exposure (R-GV-4), Delayed Containment / Increased Incident Impact (R-IR-2), and most likely increases susceptibility to Human Error (MT-9), Workforce Shortage / Loss of Critical Skills / Labor Disruption (MT-25).", "compensating_control_1": { "control_id": "IRO-08", "name": "Incident Response Plan (IRP)", "description": "Mechanisms exist to maintain and make available a current and viable Incident Response Plan (IRP) to all stakeholders.", "justification": "Incident Response Plan (IRP) (IRO-08) provides incident response capability that compensates for the absence of Integrated Security Incident Response Team (ISIRT) (IRO-11) by enabling timely detection, containment, and recovery from security events in the absence of the primary control. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "HRS-04", "name": "Defined Roles & Responsibilities", "description": "Mechanisms exist to define cybersecurity roles & responsibilities for all personnel.", "justification": "Defined Roles & Responsibilities (HRS-04) provides overlapping security capability that compensates for the absence of Integrated Security Incident Response Team (ISIRT) (IRO-11) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "IRO-12", "risk_if_not_implemented": "Without Public Relations & Reputation Repair, security incidents may not be detected, contained, investigated or communicated in a timely manner, increasing their scope, duration and cost. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Reputational Harm / Loss of Stakeholder Trust (R-EX-4), Delayed Containment / Increased Incident Impact (R-IR-2), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9).", "compensating_control_1": { "control_id": "GOV-15", "name": "Contacts With Authorities", "description": "Mechanisms exist to identify and document appropriate contacts with relevant law enforcement and regulatory bodies.", "justification": "Contacts With Authorities (GOV-15) provides overlapping security capability that compensates for the absence of Public Relations & Reputation Repair (IRO-12) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CPL-02", "name": "Statutory, Regulatory & Contractual Compliance", "description": "Mechanisms exist to facilitate the identification and implementation of relevant statutory, regulatory and contractual controls.", "justification": "Statutory, Regulatory & Contractual Compliance (CPL-02) provides overlapping security capability that compensates for the absence of Public Relations & Reputation Repair (IRO-12) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "IRO-13", "risk_if_not_implemented": "Without Chain of Custody & Forensics, required evidence, logs and chain-of-custody integrity may be unavailable or unreliable when needed for investigation or legal proceedings. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss of Accountability / Attribution (R-AC-1), Loss of Investigative / Evidentiary Capability (R-IR-1), Loss of Authenticity / Provenance (R-IP-5), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11), Workforce Shortage / Loss of Critical Skills / Labor Disruption (MT-25).", "compensating_control_1": { "control_id": "MON-34", "name": "Non-Repudiation", "description": "Mechanisms exist to utilize a non-repudiation capability to protect against an individual falsely denying having performed a particular action.", "justification": "Non-Repudiation (MON-34) provides overlapping security capability that compensates for the absence of Chain of Custody & Forensics (IRO-13) by addressing related risk objectives through an alternative control mechanism aligned with Data applicability. Given the data-handling focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "MON-18.1", "name": "Session Audit", "description": "Mechanisms exist to provide session audit capabilities that can: \n(1) Capture and log all content related to a user session; and\n(2) Remotely view all content related to an established user session in real time.", "justification": "Session Audit (MON-18.1) provides detective monitoring capability that compensates for the absence of Chain of Custody & Forensics (IRO-13) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the data-handling focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "IRO-13.1", "risk_if_not_implemented": "Without Licensed Forensic Investigators, required evidence, logs and chain-of-custody integrity may be unavailable or unreliable when needed for investigation or legal proceedings. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss of Investigative / Evidentiary Capability (R-IR-1), and most likely increases susceptibility to Human Error (MT-9), Workforce Shortage / Loss of Critical Skills / Labor Disruption (MT-25).", "compensating_control_1": { "control_id": "MON-18.1", "name": "Session Audit", "description": "Mechanisms exist to provide session audit capabilities that can: \n(1) Capture and log all content related to a user session; and\n(2) Remotely view all content related to an established user session in real time.", "justification": "Session Audit (MON-18.1) provides detective monitoring capability that compensates for the absence of Licensed Forensic Investigators (IRO-13.1) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the people-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "MON-34", "name": "Non-Repudiation", "description": "Mechanisms exist to utilize a non-repudiation capability to protect against an individual falsely denying having performed a particular action.", "justification": "Non-Repudiation (MON-34) provides overlapping security capability that compensates for the absence of Licensed Forensic Investigators (IRO-13.1) by addressing related risk objectives through an alternative control mechanism aligned with People applicability. Given the people-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "IRO-14", "risk_if_not_implemented": "Without Root Cause Analysis (RCA) & Lessons Learned, security incidents may not be detected, contained, investigated or communicated in a timely manner, increasing their scope, duration and cost. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Incident Persistence / Recurrence (R-IR-3), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9).", "compensating_control_1": { "control_id": "BCD-11", "name": "Contingency Plan Root Cause Analysis (RCA) & Lessons Learned", "description": "Mechanisms exist to conduct a Root Cause Analysis (RCA) and \"lessons learned\" activity every time the contingency plan is activated.", "justification": "Contingency Plan Root Cause Analysis (RCA) & Lessons Learned (BCD-11) provides overlapping security capability that compensates for the absence of Root Cause Analysis (RCA) & Lessons Learned (IRO-14) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "IRO-08", "name": "Incident Response Plan (IRP)", "description": "Mechanisms exist to maintain and make available a current and viable Incident Response Plan (IRP) to all stakeholders.", "justification": "Incident Response Plan (IRP) (IRO-08) provides incident response capability that compensates for the absence of Root Cause Analysis (RCA) & Lessons Learned (IRO-14) by enabling timely detection, containment, and recovery from security events in the absence of the primary control. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "IRO-15", "risk_if_not_implemented": "Without Regulatory & Law Enforcement Contacts, the organization may fail to meet statutory, regulatory or contractual obligations, or be unable to demonstrate conformity when required. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Delayed Containment / Increased Incident Impact (R-IR-2), and most likely increases susceptibility to Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11).", "compensating_control_1": { "control_id": "GOV-15", "name": "Contacts With Authorities", "description": "Mechanisms exist to identify and document appropriate contacts with relevant law enforcement and regulatory bodies.", "justification": "Contacts With Authorities (GOV-15) provides overlapping security capability that compensates for the absence of Regulatory & Law Enforcement Contacts (IRO-15) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "IRO-16", "name": "Incident Stakeholder Reporting", "description": "Mechanisms exist to timely-report incidents to applicable:\n(1) Internal stakeholders; \n(2) Affected clients & third-parties; and\n(3) Regulatory authorities.", "justification": "Incident Stakeholder Reporting (IRO-16) provides incident response capability that compensates for the absence of Regulatory & Law Enforcement Contacts (IRO-15) by enabling timely detection, containment, and recovery from security events in the absence of the primary control. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "IRO-16", "risk_if_not_implemented": "Without Incident Stakeholder Reporting, security incidents may not be detected, contained, investigated or communicated in a timely manner, increasing their scope, duration and cost. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Regulatory / Legal / Contractual Financial Liability (R-EX-5), Unreliable Assurance / Decision Information (R-GV-10), Delayed Containment / Increased Incident Impact (R-IR-2), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11).", "compensating_control_1": { "control_id": "GOV-15", "name": "Contacts With Authorities", "description": "Mechanisms exist to identify and document appropriate contacts with relevant law enforcement and regulatory bodies.", "justification": "Contacts With Authorities (GOV-15) provides overlapping security capability that compensates for the absence of Incident Stakeholder Reporting (IRO-16) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "IRO-08", "name": "Incident Response Plan (IRP)", "description": "Mechanisms exist to maintain and make available a current and viable Incident Response Plan (IRP) to all stakeholders.", "justification": "Incident Response Plan (IRP) (IRO-08) provides incident response capability that compensates for the absence of Incident Stakeholder Reporting (IRO-16) by enabling timely detection, containment, and recovery from security events in the absence of the primary control. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "IRO-16.1", "risk_if_not_implemented": "Without Situational Awareness For Incidents, security incidents may not be detected, contained, investigated or communicated in a timely manner, increasing their scope, duration and cost. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unreliable Assurance / Decision Information (R-GV-10), Delayed Containment / Increased Incident Impact (R-IR-2), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9).", "compensating_control_1": { "control_id": "MON-02", "name": "Continuous Monitoring", "description": "Mechanisms exist to facilitate the implementation of enterprise-wide monitoring controls.", "justification": "Continuous Monitoring (MON-02) provides detective monitoring capability that compensates for the absence of Situational Awareness For Incidents (IRO-16.1) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "THR-04", "name": "Threat Intelligence Feeds", "description": "Mechanisms exist to maintain situational awareness of vulnerabilities and evolving threats by leveraging the knowledge of attacker tactics, techniques and procedures to facilitate the implementation of preventative and compensating controls.", "justification": "Threat Intelligence Feeds (THR-04) provides overlapping security capability that compensates for the absence of Situational Awareness For Incidents (IRO-16.1) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "IRO-16.2", "risk_if_not_implemented": "Without Cyber Incident Reporting for Sensitive / Regulated Data, security incidents may not be detected, contained, investigated or communicated in a timely manner, increasing their scope, duration and cost. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Regulatory / Legal / Contractual Financial Liability (R-EX-5), Delayed Containment / Increased Incident Impact (R-IR-2), Privacy Harm / Unauthorized Processing (R-IP-6), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11).", "compensating_control_1": { "control_id": "GOV-15", "name": "Contacts With Authorities", "description": "Mechanisms exist to identify and document appropriate contacts with relevant law enforcement and regulatory bodies.", "justification": "Contacts With Authorities (GOV-15) provides overlapping security capability that compensates for the absence of Cyber Incident Reporting for Sensitive / Regulated Data (IRO-16.2) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "IRO-16", "name": "Incident Stakeholder Reporting", "description": "Mechanisms exist to timely-report incidents to applicable:\n(1) Internal stakeholders; \n(2) Affected clients & third-parties; and\n(3) Regulatory authorities.", "justification": "Incident Stakeholder Reporting (IRO-16) provides incident response capability that compensates for the absence of Cyber Incident Reporting for Sensitive / Regulated Data (IRO-16.2) by enabling timely detection, containment, and recovery from security events in the absence of the primary control. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "IRO-16.3", "risk_if_not_implemented": "Without Serious Incident Reporting, security incidents may not be detected, contained, investigated or communicated in a timely manner, increasing their scope, duration and cost. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Regulatory / Legal / Contractual Financial Liability (R-EX-5), Delayed Containment / Increased Incident Impact (R-IR-2), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11).", "compensating_control_1": { "control_id": "GOV-15", "name": "Contacts With Authorities", "description": "Mechanisms exist to identify and document appropriate contacts with relevant law enforcement and regulatory bodies.", "justification": "Contacts With Authorities (GOV-15) provides overlapping security capability that compensates for the absence of Serious Incident Reporting (IRO-16.3) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "IRO-08", "name": "Incident Response Plan (IRP)", "description": "Mechanisms exist to maintain and make available a current and viable Incident Response Plan (IRP) to all stakeholders.", "justification": "Incident Response Plan (IRP) (IRO-08) provides incident response capability that compensates for the absence of Serious Incident Reporting (IRO-16.3) by enabling timely detection, containment, and recovery from security events in the absence of the primary control. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "IRO-16.4", "risk_if_not_implemented": "Without Vulnerabilities Related To Incidents, security incidents may not be detected, contained, investigated or communicated in a timely manner, increasing their scope, duration and cost. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Exposure from Unaddressed Vulnerabilities (R-EX-6), Incident Persistence / Recurrence (R-IR-3), and most likely increases susceptibility to Human Error (MT-9).", "compensating_control_1": { "control_id": "IRO-16", "name": "Incident Stakeholder Reporting", "description": "Mechanisms exist to timely-report incidents to applicable:\n(1) Internal stakeholders; \n(2) Affected clients & third-parties; and\n(3) Regulatory authorities.", "justification": "Incident Stakeholder Reporting (IRO-16) provides incident response capability that compensates for the absence of Vulnerabilities Related To Incidents (IRO-16.4) by enabling timely detection, containment, and recovery from security events in the absence of the primary control. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "GOV-15", "name": "Contacts With Authorities", "description": "Mechanisms exist to identify and document appropriate contacts with relevant law enforcement and regulatory bodies.", "justification": "Contacts With Authorities (GOV-15) provides overlapping security capability that compensates for the absence of Vulnerabilities Related To Incidents (IRO-16.4) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "IRO-17", "risk_if_not_implemented": "Without Incident Tracking Repository, security incidents may not be detected, contained, investigated or communicated in a timely manner, increasing their scope, duration and cost. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Inability to Demonstrate Due Diligence / Due Care (R-GV-9), Loss of Investigative / Evidentiary Capability (R-IR-1), Incident Persistence / Recurrence (R-IR-3), and most likely increases susceptibility to Human Error (MT-9).", "compensating_control_1": { "control_id": "THR-04", "name": "Threat Intelligence Feeds", "description": "Mechanisms exist to maintain situational awareness of vulnerabilities and evolving threats by leveraging the knowledge of attacker tactics, techniques and procedures to facilitate the implementation of preventative and compensating controls.", "justification": "Threat Intelligence Feeds (THR-04) provides overlapping security capability that compensates for the absence of Incident Tracking Repository (IRO-17) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "IRO-16.1", "name": "Situational Awareness For Incidents", "description": "Mechanisms exist to document, monitor and report the status of cybersecurity and data protection incidents to internal stakeholders all the way through the resolution of the incident.", "justification": "Situational Awareness For Incidents (IRO-16.1) provides personnel training and awareness that compensates for the absence of Incident Tracking Repository (IRO-17) by reducing human-factor risk by equipping personnel to recognize and respond to relevant threats. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "IRO-17.1", "risk_if_not_implemented": "Without Incident Pattern Analysis, security incidents may not be detected, contained, investigated or communicated in a timely manner, increasing their scope, duration and cost. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Exposure from Unaddressed Vulnerabilities (R-EX-6), Incident Persistence / Recurrence (R-IR-3), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Data Quality Degradation / Data Poisoning (MT-12).", "compensating_control_1": { "control_id": "IRO-16.1", "name": "Situational Awareness For Incidents", "description": "Mechanisms exist to document, monitor and report the status of cybersecurity and data protection incidents to internal stakeholders all the way through the resolution of the incident.", "justification": "Situational Awareness For Incidents (IRO-16.1) provides personnel training and awareness that compensates for the absence of Incident Pattern Analysis (IRO-17.1) by reducing human-factor risk by equipping personnel to recognize and respond to relevant threats. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "MON-02", "name": "Continuous Monitoring", "description": "Mechanisms exist to facilitate the implementation of enterprise-wide monitoring controls.", "justification": "Continuous Monitoring (MON-02) provides detective monitoring capability that compensates for the absence of Incident Pattern Analysis (IRO-17.1) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "IRO-17.2", "risk_if_not_implemented": "Without Recurring Incident Analysis, security incidents may not be detected, contained, investigated or communicated in a timely manner, increasing their scope, duration and cost. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Incident Persistence / Recurrence (R-IR-3), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9).", "compensating_control_1": { "control_id": "MON-02", "name": "Continuous Monitoring", "description": "Mechanisms exist to facilitate the implementation of enterprise-wide monitoring controls.", "justification": "Continuous Monitoring (MON-02) provides detective monitoring capability that compensates for the absence of Recurring Incident Analysis (IRO-17.2) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "IRO-16.1", "name": "Situational Awareness For Incidents", "description": "Mechanisms exist to document, monitor and report the status of cybersecurity and data protection incidents to internal stakeholders all the way through the resolution of the incident.", "justification": "Situational Awareness For Incidents (IRO-16.1) provides personnel training and awareness that compensates for the absence of Recurring Incident Analysis (IRO-17.2) by reducing human-factor risk by equipping personnel to recognize and respond to relevant threats. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "IRO-18", "risk_if_not_implemented": "Without Incident Reporting Assistance, security incidents may not be detected, contained, investigated or communicated in a timely manner, increasing their scope, duration and cost. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Lack of a security-minded workforce (R-SA-2), and most likely increases susceptibility to Human Error (MT-9).", "compensating_control_1": { "control_id": "IRO-08", "name": "Incident Response Plan (IRP)", "description": "Mechanisms exist to maintain and make available a current and viable Incident Response Plan (IRP) to all stakeholders.", "justification": "Incident Response Plan (IRP) (IRO-08) provides incident response capability that compensates for the absence of Incident Reporting Assistance (IRO-18) by enabling timely detection, containment, and recovery from security events in the absence of the primary control. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "IRO-16", "name": "Incident Stakeholder Reporting", "description": "Mechanisms exist to timely-report incidents to applicable:\n(1) Internal stakeholders; \n(2) Affected clients & third-parties; and\n(3) Regulatory authorities.", "justification": "Incident Stakeholder Reporting (IRO-16) provides incident response capability that compensates for the absence of Incident Reporting Assistance (IRO-18) by enabling timely detection, containment, and recovery from security events in the absence of the primary control. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "IRO-18.1", "risk_if_not_implemented": "Without Automation Support of Availability of Information / Support, security incidents may not be detected, contained, investigated or communicated in a timely manner, increasing their scope, duration and cost. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss of Data / Service Availability (R-IP-4), and most likely increases susceptibility to Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "IRO-16", "name": "Incident Stakeholder Reporting", "description": "Mechanisms exist to timely-report incidents to applicable:\n(1) Internal stakeholders; \n(2) Affected clients & third-parties; and\n(3) Regulatory authorities.", "justification": "Incident Stakeholder Reporting (IRO-16) provides incident response capability that compensates for the absence of Automation Support of Availability of Information / Support (IRO-18.1) by enabling timely detection, containment, and recovery from security events in the absence of the primary control. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "IRO-08", "name": "Incident Response Plan (IRP)", "description": "Mechanisms exist to maintain and make available a current and viable Incident Response Plan (IRP) to all stakeholders.", "justification": "Incident Response Plan (IRP) (IRO-08) provides incident response capability that compensates for the absence of Automation Support of Availability of Information / Support (IRO-18.1) by enabling timely detection, containment, and recovery from security events in the absence of the primary control. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "IRO-19", "risk_if_not_implemented": "Without Supply Chain Coordination, supplier and External Service Provider (ESP) weaknesses, incidents or failures may propagate into the organization's environment unmanaged. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Delayed Containment / Increased Incident Impact (R-IR-2), Third-Party Cybersecurity Compromise / Exposure (R-SC-1), and most likely increases susceptibility to Human Error (MT-9), Workforce Shortage / Loss of Critical Skills / Labor Disruption (MT-25).", "compensating_control_1": { "control_id": "IRO-08", "name": "Incident Response Plan (IRP)", "description": "Mechanisms exist to maintain and make available a current and viable Incident Response Plan (IRP) to all stakeholders.", "justification": "Incident Response Plan (IRP) (IRO-08) provides incident response capability that compensates for the absence of Supply Chain Coordination (IRO-19) by enabling timely detection, containment, and recovery from security events in the absence of the primary control. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "IRO-16", "name": "Incident Stakeholder Reporting", "description": "Mechanisms exist to timely-report incidents to applicable:\n(1) Internal stakeholders; \n(2) Affected clients & third-parties; and\n(3) Regulatory authorities.", "justification": "Incident Stakeholder Reporting (IRO-16) provides incident response capability that compensates for the absence of Supply Chain Coordination (IRO-19) by enabling timely detection, containment, and recovery from security events in the absence of the primary control. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "IRO-19.1", "risk_if_not_implemented": "Without Coordination With External Providers, security incidents may not be detected, contained, investigated or communicated in a timely manner, increasing their scope, duration and cost. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Uncontrolled Third-Party Security / Privacy Exposure (R-GV-5), Third-Party Cybersecurity Compromise / Exposure (R-SC-1), and most likely increases susceptibility to Human Error (MT-9), Workforce Shortage / Loss of Critical Skills / Labor Disruption (MT-25).", "compensating_control_1": { "control_id": "IRO-08", "name": "Incident Response Plan (IRP)", "description": "Mechanisms exist to maintain and make available a current and viable Incident Response Plan (IRP) to all stakeholders.", "justification": "Incident Response Plan (IRP) (IRO-08) provides incident response capability that compensates for the absence of Coordination With External Providers (IRO-19.1) by enabling timely detection, containment, and recovery from security events in the absence of the primary control. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "IRO-18", "name": "Incident Reporting Assistance", "description": "Mechanisms exist to provide incident response advice and assistance to users of Technology Assets, Applications and/or Services (TAAS) for the handling and reporting of actual and potential cybersecurity and data protection incidents.", "justification": "Incident Reporting Assistance (IRO-18) provides incident response capability that compensates for the absence of Coordination With External Providers (IRO-19.1) by enabling timely detection, containment, and recovery from security events in the absence of the primary control. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "IRO-20", "risk_if_not_implemented": "Without Sensitive / Regulated Data Spill Response, security incidents may not be detected, contained, investigated or communicated in a timely manner, increasing their scope, duration and cost. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Retention / Inability to Dispose of Data (R-AM-3), Delayed Containment / Increased Incident Impact (R-IR-2), Loss of Confidentiality (R-IP-2), and most likely increases susceptibility to Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11), Workforce Shortage / Loss of Critical Skills / Labor Disruption (MT-25).", "compensating_control_1": { "control_id": "DCH-02", "name": "Data Protection", "description": "Mechanisms exist to facilitate the implementation of data protection controls.", "justification": "Data Protection (DCH-02) provides overlapping security capability that compensates for the absence of Sensitive / Regulated Data Spill Response (IRO-20) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "IRO-08", "name": "Incident Response Plan (IRP)", "description": "Mechanisms exist to maintain and make available a current and viable Incident Response Plan (IRP) to all stakeholders.", "justification": "Incident Response Plan (IRP) (IRO-08) provides incident response capability that compensates for the absence of Sensitive / Regulated Data Spill Response (IRO-20) by enabling timely detection, containment, and recovery from security events in the absence of the primary control. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "IRO-20.1", "risk_if_not_implemented": "Without Sensitive / Regulated Data Spill Responsible Personnel, security incidents may not be detected, contained, investigated or communicated in a timely manner, increasing their scope, duration and cost. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unperformed / Unowned Control Responsibilities (R-GV-3), and most likely increases susceptibility to Human Error (MT-9), Workforce Shortage / Loss of Critical Skills / Labor Disruption (MT-25).", "compensating_control_1": { "control_id": "IRO-08", "name": "Incident Response Plan (IRP)", "description": "Mechanisms exist to maintain and make available a current and viable Incident Response Plan (IRP) to all stakeholders.", "justification": "Incident Response Plan (IRP) (IRO-08) provides incident response capability that compensates for the absence of Sensitive / Regulated Data Spill Responsible Personnel (IRO-20.1) by enabling timely detection, containment, and recovery from security events in the absence of the primary control. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "DCH-02", "name": "Data Protection", "description": "Mechanisms exist to facilitate the implementation of data protection controls.", "justification": "Data Protection (DCH-02) provides overlapping security capability that compensates for the absence of Sensitive / Regulated Data Spill Responsible Personnel (IRO-20.1) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "IRO-20.2", "risk_if_not_implemented": "Without Sensitive / Regulated Data Spill Training, security incidents may not be detected, contained, investigated or communicated in a timely manner, increasing their scope, duration and cost. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Lack of a security-minded workforce (R-SA-2), and most likely increases susceptibility to Human Error (MT-9).", "compensating_control_1": { "control_id": "DCH-02", "name": "Data Protection", "description": "Mechanisms exist to facilitate the implementation of data protection controls.", "justification": "Data Protection (DCH-02) provides overlapping security capability that compensates for the absence of Sensitive / Regulated Data Spill Training (IRO-20.2) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "IRO-20", "name": "Sensitive / Regulated Data Spill Response", "description": "Mechanisms exist to respond to sensitive and/or regulated data spills.", "justification": "Sensitive / Regulated Data Spill Response (IRO-20) provides incident response capability that compensates for the absence of Sensitive / Regulated Data Spill Training (IRO-20.2) by enabling timely detection, containment, and recovery from security events in the absence of the primary control. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "IRO-20.3", "risk_if_not_implemented": "Without Post-Sensitive / Regulated Data Spill Operations, security incidents may not be detected, contained, investigated or communicated in a timely manner, increasing their scope, duration and cost. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Reduced Operational Productivity (R-BC-3), and most likely increases susceptibility to Human Error (MT-9), Workforce Shortage / Loss of Critical Skills / Labor Disruption (MT-25).", "compensating_control_1": { "control_id": "IRO-08", "name": "Incident Response Plan (IRP)", "description": "Mechanisms exist to maintain and make available a current and viable Incident Response Plan (IRP) to all stakeholders.", "justification": "Incident Response Plan (IRP) (IRO-08) provides incident response capability that compensates for the absence of Post-Sensitive / Regulated Data Spill Operations (IRO-20.3) by enabling timely detection, containment, and recovery from security events in the absence of the primary control. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "IRO-20", "name": "Sensitive / Regulated Data Spill Response", "description": "Mechanisms exist to respond to sensitive and/or regulated data spills.", "justification": "Sensitive / Regulated Data Spill Response (IRO-20) provides incident response capability that compensates for the absence of Post-Sensitive / Regulated Data Spill Operations (IRO-20.3) by enabling timely detection, containment, and recovery from security events in the absence of the primary control. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "IRO-20.4", "risk_if_not_implemented": "Without Sensitive / Regulated Data Exposure to Unauthorized Personnel, sensitive and/or regulated data may be disclosed, altered or lost through inadequate classification, handling or protection. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Access (R-AC-4), Loss of Confidentiality (R-IP-2), and most likely increases susceptibility to Human Error (MT-9), Workforce Shortage / Loss of Critical Skills / Labor Disruption (MT-25).", "compensating_control_1": { "control_id": "IRO-20", "name": "Sensitive / Regulated Data Spill Response", "description": "Mechanisms exist to respond to sensitive and/or regulated data spills.", "justification": "Sensitive / Regulated Data Spill Response (IRO-20) provides incident response capability that compensates for the absence of Sensitive / Regulated Data Exposure to Unauthorized Personnel (IRO-20.4) by enabling timely detection, containment, and recovery from security events in the absence of the primary control. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "DCH-02", "name": "Data Protection", "description": "Mechanisms exist to facilitate the implementation of data protection controls.", "justification": "Data Protection (DCH-02) provides overlapping security capability that compensates for the absence of Sensitive / Regulated Data Exposure to Unauthorized Personnel (IRO-20.4) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "IRO-21", "risk_if_not_implemented": "Without Detonation Chambers (Sandboxes), security incidents may not be detected, contained, investigated or communicated in a timely manner, increasing their scope, duration and cost. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to System / Data Compromise (Technical Vector) (R-BC-4), Undetected / Delayed Detection of Adverse Activity (R-SA-1), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "NET-06", "name": "Network Segmentation (macrosegmentation)", "description": "Mechanisms exist to implement network segmentation within network architectures to isolate Technology Assets, Applications and/or Services (TAAS) from other network resources.", "justification": "Network Segmentation (macrosegmentation) (NET-06) provides network-level access restriction that compensates for the absence of Detonation Chambers (Sandboxes) (IRO-21) by limiting attacker reach and lateral movement opportunities across the environment. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "END-04", "name": "Malicious Code Protection (Antimalware)", "description": "Mechanisms exist to utilize antimalware, or similar technologies, to detect and eradicate malicious code.", "justification": "Malicious Code Protection (Antimalware) (END-04) provides overlapping security capability that compensates for the absence of Detonation Chambers (Sandboxes) (IRO-21) by addressing related risk objectives through an alternative control mechanism aligned with Technology applicability. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "IRO-22", "risk_if_not_implemented": "Without Data Breach, security incidents may not be detected, contained, investigated or communicated in a timely manner, increasing their scope, duration and cost. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Contractual Default / Termination (R-EX-2), Regulatory / Legal / Contractual Financial Liability (R-EX-5), Delayed Containment / Increased Incident Impact (R-IR-2), Loss of Confidentiality (R-IP-2), Privacy Harm / Unauthorized Processing (R-IP-6), and most likely increases susceptibility to Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11), Workforce Shortage / Loss of Critical Skills / Labor Disruption (MT-25).", "compensating_control_1": { "control_id": "BCD-07", "name": "Ongoing Contingency Planning", "description": "Mechanisms exist to update contingency plans due to changes affecting:\n(1) People (e.g., personnel changes);\n(2) Processes (e.g., new, altered or decommissioned business practices, including third-party services);\n(3) Technologies (e.g., new, altered or decommissioned technologies);\n(4) Data (e.g., changes to data flows and/or data repositories);\n(5) Facilities (e.g., new, altered or decommissioned physical infrastructure); and/or\n(6) Feedback from contingency plan testing activities.", "justification": "Ongoing Contingency Planning (BCD-07) provides overlapping security capability that compensates for the absence of Data Breach (IRO-22) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "IRO-08", "name": "Incident Response Plan (IRP)", "description": "Mechanisms exist to maintain and make available a current and viable Incident Response Plan (IRP) to all stakeholders.", "justification": "Incident Response Plan (IRP) (IRO-08) provides incident response capability that compensates for the absence of Data Breach (IRO-22) by enabling timely detection, containment, and recovery from security events in the absence of the primary control. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "IRO-24", "risk_if_not_implemented": "Without Cryptographic Incident Response (Emergency Algorithm Transition), security incidents may not be detected, contained, investigated or communicated in a timely manner, increasing their scope, duration and cost. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Long-Term Confidentiality Loss from Cryptographic Obsolescence (R-IP-1), and most likely increases susceptibility to Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11), Workforce Shortage / Loss of Critical Skills / Labor Disruption (MT-25), Harvest Now / Decrypt Later (HNDL) (MT-28), Cryptographic Compromise / Cryptanalytic Capability Advancement (MT-31).", "compensating_control_1": { "control_id": "IRO-08", "name": "Incident Response Plan (IRP)", "description": "Mechanisms exist to maintain and make available a current and viable Incident Response Plan (IRP) to all stakeholders.", "justification": "Incident Response Plan (IRP) (IRO-08) provides incident response capability that compensates for the absence of Cryptographic Incident Response (Emergency Algorithm Transition) (IRO-24) by enabling timely detection, containment, and recovery from security events. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "RSK-18", "name": "Compensating Countermeasures", "description": "Mechanisms exist to identify and implement one, or more, compensating controls to reduce risk and threat exposure when the primary means of implementing the security function is unavailable or compromised.", "justification": "Compensating Countermeasures (RSK-18) provides overlapping security capability that compensates for the absence of Cryptographic Incident Response (Emergency Algorithm Transition) (IRO-24) by addressing related risk objectives through an alternative control mechanism. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "IRO-25", "risk_if_not_implemented": "Without Embedded Technology Incidents, embedded and IoT technologies may operate with unknown, insecure or unmonitored configurations, creating exploitable footholds. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Delayed Containment / Increased Incident Impact (R-IR-2), and most likely increases susceptibility to Human Error (MT-9), Workforce Shortage / Loss of Critical Skills / Labor Disruption (MT-25).", "compensating_control_1": { "control_id": "IRO-08", "name": "Incident Response Plan (IRP)", "description": "Mechanisms exist to maintain and make available a current and viable Incident Response Plan (IRP) to all stakeholders.", "justification": "Incident Response Plan (IRP) (IRO-08) provides incident response capability that compensates for the absence of Embedded Technology Incidents (IRO-25) by enabling timely detection, containment and recovery from security events. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "IRO-06", "name": "Incident Handling", "description": "Mechanisms exist to cover:\n(1) Preparation;\n(2) Automated event detection or manual incident report intake;\n(3) Analysis;\n(4) Containment;\n(5) Eradication; and\n(6) Recovery.", "justification": "Incident Handling (IRO-06) provides incident response capability that compensates for the absence of Embedded Technology Incidents (IRO-25) by enabling timely detection, containment and recovery from security events. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "IRO-26", "risk_if_not_implemented": "Without Post-Incident Technology Assets, Applications and Services (TAAS) Validation, compromised or degraded Technology Assets, Applications and Services (TAAS) may be returned to service without confirming they are secure, compliant and functional, allowing the same incident to persist or recur. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unreliable Assurance / Decision Information (R-GV-10), Delayed Containment / Increased Incident Impact (R-IR-2), Incident Persistence / Recurrence (R-IR-3), Recovery Failure / Unacceptable Recovery Delay (R-OR-1), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9).", "compensating_control_1": { "control_id": "IRO-14", "name": "Root Cause Analysis (RCA) & Lessons Learned", "description": "Mechanisms exist to incorporate lessons learned from analyzing and resolving cybersecurity and data protection incidents to reduce the likelihood or impact of future incidents.", "justification": "Root Cause Analysis (RCA) & Lessons Learned (IRO-14) compensates for the absence of Post-Incident Technology Assets, Applications and Services (TAAS) Validation (IRO-26) by analyzing the root cause of the incident and capturing lessons learned, which surfaces residual weaknesses in affected TAAS before they are relied upon again. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "IAO-04", "name": "Control Validation Testing (CVT)", "description": "Mechanisms exist to formally assess the security, compliance and resilience controls in Technology Assets, Applications and/or Services (TAAS) through Information Assurance Program (IAP) activities to determine the extent to which the controls are implemented correctly, operating as intended and producing the desired outcome with respect to meeting expected requirements.", "justification": "Control Validation Testing (CVT) (IAO-04) compensates for the absence of Post-Incident Technology Assets, Applications and Services (TAAS) Validation (IRO-26) by executing Control Validation Testing (CVT) against affected TAAS, which independently confirms that required controls function as intended following remediation. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "IAO-03", "risk_if_not_implemented": "Without Assessment Boundaries, executive management, the Board of Directors (BoD) and assessors may rely on inaccurate, incomplete or unverifiable control and risk information. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unaddressed Security / Compliance Exposure (R-GV-2), Unreliable Assurance / Decision Information (R-GV-10), and most likely increases susceptibility to Human Error (MT-9).", "compensating_control_1": { "control_id": "MON-02", "name": "Continuous Monitoring", "description": "Mechanisms exist to facilitate the implementation of enterprise-wide monitoring controls.", "justification": "Continuous Monitoring (MON-02) provides detective monitoring capability that compensates for the absence of Assessment Boundaries (IAO-03) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CPL-05", "name": "Conformity Monitoring", "description": "Mechanisms exist to validate that Technology Assets, Applications, Services and/or Data (TAASD) conform to the organization's security, compliance and/or resilience policies, standards and other applicable requirements.", "justification": "Conformity Monitoring (CPL-05) provides periodic assessment and assurance that compensates for the absence of Assessment Boundaries (IAO-03) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "IAO-04.1", "risk_if_not_implemented": "Without Plan / Coordinate with Other Organizational Entities, executive management, the Board of Directors (BoD) and assessors may rely on inaccurate, incomplete or unverifiable control and risk information. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Business / Service Interruption (R-BC-1), Reduced Operational Productivity (R-BC-3), and most likely increases susceptibility to Human Error (MT-9).", "compensating_control_1": { "control_id": "GOV-04", "name": "Publishing Security, Compliance & Resilience Documentation", "description": "Mechanisms exist to establish, maintain and disseminate policies, standards and procedures necessary for secure, compliant and resilient capabilities.", "justification": "Publishing Security, Compliance & Resilience Documentation (GOV-04) provides resilience and recovery capability that compensates for the absence of Plan / Coordinate with Other Organizational Entities (IAO-04.1) by ensuring the organization can restore operations and data when the primary control is absent. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CPL-05", "name": "Conformity Monitoring", "description": "Mechanisms exist to validate that Technology Assets, Applications, Services and/or Data (TAASD) conform to the organization's security, compliance and/or resilience policies, standards and other applicable requirements.", "justification": "Conformity Monitoring (CPL-05) provides periodic assessment and assurance that compensates for the absence of Plan / Coordinate with Other Organizational Entities (IAO-04.1) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "IAO-05", "risk_if_not_implemented": "Without Specialized Assessments, executive management, the Board of Directors (BoD) and assessors may rely on inaccurate, incomplete or unverifiable control and risk information. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Exposure from Unaddressed Vulnerabilities (R-EX-6), Unaddressed Security / Compliance Exposure (R-GV-2), Lack of oversight of internal controls (R-GV-6), Inability to Demonstrate Due Diligence / Due Care (R-GV-9), and most likely increases susceptibility to Human Error (MT-9), Workforce Shortage / Loss of Critical Skills / Labor Disruption (MT-25).", "compensating_control_1": { "control_id": "CPL-05", "name": "Conformity Monitoring", "description": "Mechanisms exist to validate that Technology Assets, Applications, Services and/or Data (TAASD) conform to the organization's security, compliance and/or resilience policies, standards and other applicable requirements.", "justification": "Conformity Monitoring (CPL-05) provides periodic assessment and assurance that compensates for the absence of Specialized Assessments (IAO-05) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "IAO-04", "name": "Control Validation Testing (CVT)", "description": "Mechanisms exist to formally assess the security, compliance and resilience controls in Technology Assets, Applications and/or Services (TAAS) through Information Assurance Program (IAP) activities to determine the extent to which the controls are implemented correctly, operating as intended and producing the desired outcome with respect to meeting expected requirements.", "justification": "Control Validation Testing (CVT) (IAO-04) provides periodic assessment and assurance that compensates for the absence of Specialized Assessments (IAO-05) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "IAO-06", "risk_if_not_implemented": "Without Assessor Independence, the organization may fail to meet statutory, regulatory or contractual obligations, or be unable to demonstrate conformity when required. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Lack of oversight of internal controls (R-GV-6), Inability to Demonstrate Due Diligence / Due Care (R-GV-9), Unreliable Assurance / Decision Information (R-GV-10), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Conflict of Interest (COI) / Undue Influence / Insider Misconduct (MT-15).", "compensating_control_1": { "control_id": "VPM-18", "name": "Penetration Testing", "description": "Mechanisms exist to conduct penetration testing on Technology Assets, Applications and/or Services (TAAS).", "justification": "Penetration Testing (VPM-18) provides periodic assessment and assurance that compensates for the absence of Assessor Independence (IAO-06) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CPL-05", "name": "Conformity Monitoring", "description": "Mechanisms exist to validate that Technology Assets, Applications, Services and/or Data (TAASD) conform to the organization's security, compliance and/or resilience policies, standards and other applicable requirements.", "justification": "Conformity Monitoring (CPL-05) provides periodic assessment and assurance that compensates for the absence of Assessor Independence (IAO-06) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "IAO-07", "risk_if_not_implemented": "Without Third-Party Assessment Reciprocity, supplier and External Service Provider (ESP) weaknesses, incidents or failures may propagate into the organization's environment unmanaged. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Lack of oversight of third-party controls (R-GV-7), Unreliable Assurance / Decision Information (R-GV-10), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9).", "compensating_control_1": { "control_id": "IAO-04", "name": "Control Validation Testing (CVT)", "description": "Mechanisms exist to formally assess the security, compliance and resilience controls in Technology Assets, Applications and/or Services (TAAS) through Information Assurance Program (IAP) activities to determine the extent to which the controls are implemented correctly, operating as intended and producing the desired outcome with respect to meeting expected requirements.", "justification": "Control Validation Testing (CVT) (IAO-04) provides periodic assessment and assurance that compensates for the absence of Third-Party Assessment Reciprocity (IAO-07) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "VPM-18", "name": "Penetration Testing", "description": "Mechanisms exist to conduct penetration testing on Technology Assets, Applications and/or Services (TAAS).", "justification": "Penetration Testing (VPM-18) provides periodic assessment and assurance that compensates for the absence of Third-Party Assessment Reciprocity (IAO-07) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "IAO-08", "risk_if_not_implemented": "Without Adequate Security for Sensitive / Regulated Data In Support of Contracts, sensitive and/or regulated data may be disclosed, altered or lost through inadequate classification, handling or protection. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Contractual Default / Termination (R-EX-2), Regulatory / Legal / Contractual Financial Liability (R-EX-5), Loss of Confidentiality (R-IP-2), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11).", "compensating_control_1": { "control_id": "CPL-05", "name": "Conformity Monitoring", "description": "Mechanisms exist to validate that Technology Assets, Applications, Services and/or Data (TAASD) conform to the organization's security, compliance and/or resilience policies, standards and other applicable requirements.", "justification": "Conformity Monitoring (CPL-05) provides periodic assessment and assurance that compensates for the absence of Adequate Security for Sensitive / Regulated Data In Support of Contracts (IAO-08) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "IAO-09", "name": "Applied Security, Compliance and Resilience Controls Documentation", "description": "Mechanisms exist to generate authoritative documentation (e.g., System Security Plan (SSP)) that:\n(1) Identifies key architectural and implementation information on in-scope Technology Assets, Applications and/or Services (TAAS);\n(2) Reflects the current state of applied security, compliance and resilience controls on applicable People, Processes, Technologies, Data and/or Facilities (PPTDF) that are contained within the system boundary; and\n(3) Provides a historical record of applied security controls, including changes.", "justification": "Applied Security, Compliance and Resilience Controls Documentation (IAO-09) provides resilience and recovery capability that compensates for the absence of Adequate Security for Sensitive / Regulated Data In Support of Contracts (IAO-08) by ensuring the organization can restore operations and data when the primary control is absent. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "IAO-09", "risk_if_not_implemented": "Without Applied Security, Compliance and Resilience Controls Documentation, executive management, the Board of Directors (BoD) and assessors may rely on inaccurate, incomplete or unverifiable control and risk information. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss of Authorization / Certification / License (R-EX-11), Inability to Demonstrate Due Diligence / Due Care (R-GV-9), Unreliable Assurance / Decision Information (R-GV-10), and most likely increases susceptibility to Human Error (MT-9), Data Quality Degradation / Data Poisoning (MT-12).", "compensating_control_1": { "control_id": "CPL-05", "name": "Conformity Monitoring", "description": "Mechanisms exist to validate that Technology Assets, Applications, Services and/or Data (TAASD) conform to the organization's security, compliance and/or resilience policies, standards and other applicable requirements.", "justification": "Conformity Monitoring (CPL-05) provides periodic assessment and assurance that compensates for the absence of Applied Security, Compliance and Resilience Controls Documentation (IAO-09) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "GOV-04", "name": "Publishing Security, Compliance & Resilience Documentation", "description": "Mechanisms exist to establish, maintain and disseminate policies, standards and procedures necessary for secure, compliant and resilient capabilities.", "justification": "Publishing Security, Compliance & Resilience Documentation (GOV-04) provides resilience and recovery capability that compensates for the absence of Applied Security, Compliance and Resilience Controls Documentation (IAO-09) by ensuring the organization can restore operations and data when the primary control is absent. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "IAO-11", "risk_if_not_implemented": "Without Technical Verification, executive management, the Board of Directors (BoD) and assessors may rely on inaccurate, incomplete or unverifiable control and risk information. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Lack of oversight of internal controls (R-GV-6), Unreliable Assurance / Decision Information (R-GV-10), and most likely increases susceptibility to Human Error (MT-9).", "compensating_control_1": { "control_id": "CPL-05", "name": "Conformity Monitoring", "description": "Mechanisms exist to validate that Technology Assets, Applications, Services and/or Data (TAASD) conform to the organization's security, compliance and/or resilience policies, standards and other applicable requirements.", "justification": "Conformity Monitoring (CPL-05) provides periodic assessment and assurance that compensates for the absence of Technical Verification (IAO-11) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "TDA-17", "name": "Security, Compliance & Resilience Testing Throughout Development", "description": "Mechanisms exist to require system developers/integrators consult with security, compliance and/or resilience personnel to: \n(1) Create and implement a Security Testing and Evaluation (ST&E) plan, or similar capability;\n(2) Implement a verifiable flaw remediation process to correct weaknesses and deficiencies identified during the control testing and evaluation process; and\n(3) Document the results.", "justification": "Security, Compliance & Resilience Testing Throughout Development (TDA-17) provides periodic assessment and assurance that compensates for the absence of Technical Verification (IAO-11) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "IAO-12", "risk_if_not_implemented": "Without Capabilities Deficiency Tracking, executive management, the Board of Directors (BoD) and assessors may rely on inaccurate, incomplete or unverifiable control and risk information. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unaddressed Security / Compliance Exposure (R-GV-2), Unperformed / Unowned Control Responsibilities (R-GV-3), Lack of oversight of internal controls (R-GV-6), Inability to Demonstrate Due Diligence / Due Care (R-GV-9), Unreliable Assurance / Decision Information (R-GV-10), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9).", "compensating_control_1": { "control_id": "VPM-06", "name": "Vulnerability Remediation Process", "description": "Mechanisms exist to ensure that vulnerabilities are properly identified, tracked and remediated.", "justification": "Vulnerability Remediation Process (VPM-06) provides vulnerability management that compensates for the absence of Capabilities Deficiency Tracking (IAO-12) by reducing the exploitable attack surface by addressing known weaknesses before they are leveraged. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "RSK-17", "name": "Risk Remediation", "description": "Mechanisms exist to remediate risks to an acceptable level.", "justification": "Risk Remediation (RSK-17) provides vulnerability management that compensates for the absence of Capabilities Deficiency Tracking (IAO-12) by reducing the exploitable attack surface by addressing known weaknesses before they are leveraged. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "IAO-12.1", "risk_if_not_implemented": "Without Deficiency Tracking Automation, executive management, the Board of Directors (BoD) and assessors may rely on inaccurate, incomplete or unverifiable control and risk information. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unaddressed Security / Compliance Exposure (R-GV-2), Lack of oversight of internal controls (R-GV-6), Inability to Demonstrate Due Diligence / Due Care (R-GV-9), Unreliable Assurance / Decision Information (R-GV-10), and most likely increases susceptibility to Technical / Mechanical Failure (MT-10), Data Quality Degradation / Data Poisoning (MT-12).", "compensating_control_1": { "control_id": "RSK-17", "name": "Risk Remediation", "description": "Mechanisms exist to remediate risks to an acceptable level.", "justification": "Risk Remediation (RSK-17) provides vulnerability management that compensates for the absence of Deficiency Tracking Automation (IAO-12.1) by reducing the exploitable attack surface by addressing known weaknesses before they are leveraged. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "VPM-06", "name": "Vulnerability Remediation Process", "description": "Mechanisms exist to ensure that vulnerabilities are properly identified, tracked and remediated.", "justification": "Vulnerability Remediation Process (VPM-06) provides vulnerability management that compensates for the absence of Deficiency Tracking Automation (IAO-12.1) by reducing the exploitable attack surface by addressing known weaknesses before they are leveraged. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "IAO-13", "risk_if_not_implemented": "Without Security Assessment Report (SAR), executive management, the Board of Directors (BoD) and assessors may rely on inaccurate, incomplete or unverifiable control and risk information. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss of Authorization / Certification / License (R-EX-11), Unaddressed Security / Compliance Exposure (R-GV-2), Lack of oversight of internal controls (R-GV-6), Inability to Demonstrate Due Diligence / Due Care (R-GV-9), Unreliable Assurance / Decision Information (R-GV-10), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Conflict of Interest (COI) / Undue Influence / Insider Misconduct (MT-15).", "compensating_control_1": { "control_id": "VPM-18", "name": "Penetration Testing", "description": "Mechanisms exist to conduct penetration testing on Technology Assets, Applications and/or Services (TAAS).", "justification": "Penetration Testing (VPM-18) provides periodic assessment and assurance that compensates for the absence of Security Assessment Report (SAR) (IAO-13) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "IAO-04", "name": "Control Validation Testing (CVT)", "description": "Mechanisms exist to formally assess the security, compliance and resilience controls in Technology Assets, Applications and/or Services (TAAS) through Information Assurance Program (IAP) activities to determine the extent to which the controls are implemented correctly, operating as intended and producing the desired outcome with respect to meeting expected requirements.", "justification": "Control Validation Testing (CVT) (IAO-04) provides periodic assessment and assurance that compensates for the absence of Security Assessment Report (SAR) (IAO-13) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "IAO-15", "risk_if_not_implemented": "Without Control Assurance Automation (CAA) Automation, control validation remains manual, infrequent and error-prone, so control failures may go undetected between assessment cycles and reported control status may not reflect reality. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Lack of oversight of internal controls (R-GV-6), Inability to Demonstrate Due Diligence / Due Care (R-GV-9), Unreliable Assurance / Decision Information (R-GV-10), and most likely increases susceptibility to Human Error (MT-9), Technical / Mechanical Failure (MT-10), Data Quality Degradation / Data Poisoning (MT-12), Fraud, Corruption and/or Intentional Criminal Conduct (MT-14).", "compensating_control_1": { "control_id": "CPL-18", "name": "Continuous Control Monitoring (CCM)", "description": "Automated mechanisms exist to perform Continuous Control Monitoring (CCM) to assess and report the conformity status of the organization's Technology Assets, Applications, Services and Data (TAASD) against applicable security, compliance and resilience controls.", "justification": "Continuous Control Monitoring (CCM) (CPL-18) compensates for the absence of Control Assurance Automation (CAA) Automation (IAO-15) by providing ongoing, semi-automated visibility into control status, which narrows the detection gap that fully automated Control Validation Testing (CVT) would otherwise close. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "IAO-04", "name": "Control Validation Testing (CVT)", "description": "Mechanisms exist to formally assess the security, compliance and resilience controls in Technology Assets, Applications and/or Services (TAAS) through Information Assurance Program (IAP) activities to determine the extent to which the controls are implemented correctly, operating as intended and producing the desired outcome with respect to meeting expected requirements.", "justification": "Control Validation Testing (CVT) (IAO-04) compensates for the absence of Control Assurance Automation (CAA) Automation (IAO-15) by performing periodic manual Control Validation Testing (CVT), which delivers the same assurance outcome at lower frequency and with greater reliance on assessor judgment. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "MNT-02", "risk_if_not_implemented": "Without Maintenance Operations, maintenance activities may introduce unauthorized changes, expose systems to untrusted personnel or tools, or leave systems in an unsafe state. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unperformed / Unowned Control Responsibilities (R-GV-3), Inability to Demonstrate Due Diligence / Due Care (R-GV-9), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9).", "compensating_control_1": { "control_id": "CHG-02", "name": "Change Management Program", "description": "Mechanisms exist to facilitate the implementation of a change management program.", "justification": "Change Management Program (CHG-02) provides policy-level governance that compensates for the absence of Maintenance Operations (MNT-02) by establishing documented expectations, accountability structures, and organizational guardrails. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "MON-02", "name": "Continuous Monitoring", "description": "Mechanisms exist to facilitate the implementation of enterprise-wide monitoring controls.", "justification": "Continuous Monitoring (MON-02) provides detective monitoring capability that compensates for the absence of Maintenance Operations (MNT-02) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "MNT-04", "risk_if_not_implemented": "Without Timely Maintenance, maintenance activities may introduce unauthorized changes, expose systems to untrusted personnel or tools, or leave systems in an unsafe state. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss, Theft or Damage of Assets (R-AM-1), Recovery Failure / Unacceptable Recovery Delay (R-OR-1), and most likely increases susceptibility to Human Error (MT-9), Technical / Mechanical Failure (MT-10), Manufacturing Capacity / Supply Disruption (MT-22), Supplier Financial Distress / Insolvency (MT-24), Transportation / Logistics Disruption (MT-26).", "compensating_control_1": { "control_id": "VPM-08", "name": "Software & Firmware Patching", "description": "Mechanisms exist to conduct software patching for all deployed Technology Assets, Applications and/or Services (TAAS), including firmware.", "justification": "Software & Firmware Patching (VPM-08) provides vulnerability management that compensates for the absence of Timely Maintenance (MNT-04) by reducing the exploitable attack surface by addressing known weaknesses before they are leveraged. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CHG-02", "name": "Change Management Program", "description": "Mechanisms exist to facilitate the implementation of a change management program.", "justification": "Change Management Program (CHG-02) provides policy-level governance that compensates for the absence of Timely Maintenance (MNT-04) by establishing documented expectations, accountability structures, and organizational guardrails. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "MNT-05", "risk_if_not_implemented": "Without Preventative Maintenance, maintenance activities may introduce unauthorized changes, expose systems to untrusted personnel or tools, or leave systems in an unsafe state. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss, Theft or Damage of Assets (R-AM-1), and most likely increases susceptibility to Human Error (MT-9), Technical / Mechanical Failure (MT-10), Workforce Shortage / Loss of Critical Skills / Labor Disruption (MT-25).", "compensating_control_1": { "control_id": "CHG-02", "name": "Change Management Program", "description": "Mechanisms exist to facilitate the implementation of a change management program.", "justification": "Change Management Program (CHG-02) provides policy-level governance that compensates for the absence of Preventative Maintenance (MNT-05) by establishing documented expectations, accountability structures, and organizational guardrails. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "VPM-08", "name": "Software & Firmware Patching", "description": "Mechanisms exist to conduct software patching for all deployed Technology Assets, Applications and/or Services (TAAS), including firmware.", "justification": "Software & Firmware Patching (VPM-08) provides vulnerability management that compensates for the absence of Preventative Maintenance (MNT-05) by reducing the exploitable attack surface by addressing known weaknesses before they are leveraged. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "MNT-06", "risk_if_not_implemented": "Without Predictive Maintenance, the organization's understanding of the threat environment may become stale, leaving defenses misaligned with active adversary tactics. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss, Theft or Damage of Assets (R-AM-1), and most likely increases susceptibility to Human Error (MT-9), Technical / Mechanical Failure (MT-10), Data Quality Degradation / Data Poisoning (MT-12).", "compensating_control_1": { "control_id": "VPM-08", "name": "Software & Firmware Patching", "description": "Mechanisms exist to conduct software patching for all deployed Technology Assets, Applications and/or Services (TAAS), including firmware.", "justification": "Software & Firmware Patching (VPM-08) provides vulnerability management that compensates for the absence of Predictive Maintenance (MNT-06) by reducing the exploitable attack surface by addressing known weaknesses before they are leveraged. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "MNT-04", "name": "Timely Maintenance", "description": "Mechanisms exist to obtain maintenance support and/or spare parts for Technology Assets, Applications and/or Services (TAAS) within a defined Recovery Time Objective (RTO).", "justification": "Timely Maintenance (MNT-04) provides overlapping security capability that compensates for the absence of Predictive Maintenance (MNT-06) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "MNT-07", "risk_if_not_implemented": "Without Maintenance Validation, maintenance activities may introduce unauthorized changes, expose systems to untrusted personnel or tools, or leave systems in an unsafe state. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Modification / Loss of System Integrity (R-AM-2), Lack of oversight of internal controls (R-GV-6), and most likely increases susceptibility to Human Error (MT-9).", "compensating_control_1": { "control_id": "MON-02", "name": "Continuous Monitoring", "description": "Mechanisms exist to facilitate the implementation of enterprise-wide monitoring controls.", "justification": "Continuous Monitoring (MON-02) provides detective monitoring capability that compensates for the absence of Maintenance Validation (MNT-07) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CHG-09", "name": "Control Functionality Verification", "description": "Mechanisms exist to verify the functionality of security, compliance and resilience controls following implemented changes to ensure applicable controls operate as designed.", "justification": "Control Functionality Verification (CHG-09) provides overlapping security capability that compensates for the absence of Maintenance Validation (MNT-07) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "MNT-08", "risk_if_not_implemented": "Without Maintenance Monitoring, malicious, anomalous or unauthorized activity may go undetected or be detected too late to prevent or limit harm. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Undetected / Delayed Detection of Adverse Activity (R-SA-1), and most likely increases susceptibility to Human Error (MT-9), Technical / Mechanical Failure (MT-10), Data Quality Degradation / Data Poisoning (MT-12).", "compensating_control_1": { "control_id": "MON-02", "name": "Continuous Monitoring", "description": "Mechanisms exist to facilitate the implementation of enterprise-wide monitoring controls.", "justification": "Continuous Monitoring (MON-02) provides detective monitoring capability that compensates for the absence of Maintenance Monitoring (MNT-08) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CHG-09", "name": "Control Functionality Verification", "description": "Mechanisms exist to verify the functionality of security, compliance and resilience controls following implemented changes to ensure applicable controls operate as designed.", "justification": "Control Functionality Verification (CHG-09) provides overlapping security capability that compensates for the absence of Maintenance Monitoring (MNT-08) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "MNT-09", "risk_if_not_implemented": "Without Prevent Unauthorized Removal, maintenance activities may introduce unauthorized changes, expose systems to untrusted personnel or tools, or leave systems in an unsafe state. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Access (R-AC-4), Loss, Theft or Damage of Assets (R-AM-1), System / Data Compromise (Non-Technical Vector) (R-BC-5), Loss of Confidentiality (R-IP-2), and most likely increases susceptibility to Physical Crime (MT-5), Human Error (MT-9), Fraud, Corruption and/or Intentional Criminal Conduct (MT-14).", "compensating_control_1": { "control_id": "MON-02", "name": "Continuous Monitoring", "description": "Mechanisms exist to facilitate the implementation of enterprise-wide monitoring controls.", "justification": "Continuous Monitoring (MON-02) provides detective monitoring capability that compensates for the absence of Prevent Unauthorized Removal (MNT-09) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "MNT-11", "name": "Maintenance Tools", "description": "Mechanisms exist to control and monitor the use of system maintenance tools.", "justification": "Maintenance Tools (MNT-11) provides overlapping security capability that compensates for the absence of Prevent Unauthorized Removal (MNT-09) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "MNT-10", "risk_if_not_implemented": "Without Automated Maintenance Activities, maintenance activities may introduce unauthorized changes, expose systems to untrusted personnel or tools, or leave systems in an unsafe state. Based on the risk and threat mapping for this control, no risk is rated Likely; risks rated Possible include Loss, Theft or Damage of Assets (R-AM-1), Unauthorized Modification / Loss of System Integrity (R-AM-2), Business / Service Interruption (R-BC-1), and most likely increases susceptibility to Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "MON-18.1", "name": "Session Audit", "description": "Mechanisms exist to provide session audit capabilities that can: \n(1) Capture and log all content related to a user session; and\n(2) Remotely view all content related to an established user session in real time.", "justification": "Session Audit (MON-18.1) provides detective monitoring capability that compensates for the absence of Automated Maintenance Activities (MNT-10) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "IAC-30", "name": "Least Privilege", "description": "Mechanisms exist to utilize the concept of least privilege, allowing only authorized access to processes necessary to accomplish assigned tasks in accordance with organizational business functions.", "justification": "Least Privilege (IAC-30) provides access control enforcement that compensates for the absence of Automated Maintenance Activities (MNT-10) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "MNT-10.1", "risk_if_not_implemented": "Without Automated Support For Predictive Maintenance, the organization's understanding of the threat environment may become stale, leaving defenses misaligned with active adversary tactics. Based on the risk and threat mapping for this control, no risk is rated Likely; risks rated Possible include Loss, Theft or Damage of Assets (R-AM-1), Unauthorized Modification / Loss of System Integrity (R-AM-2), Business / Service Interruption (R-BC-1), and most likely increases susceptibility to Technical / Mechanical Failure (MT-10), Data Quality Degradation / Data Poisoning (MT-12).", "compensating_control_1": { "control_id": "CHG-02", "name": "Change Management Program", "description": "Mechanisms exist to facilitate the implementation of a change management program.", "justification": "Change Management Program (CHG-02) provides policy-level governance that compensates for the absence of Automated Support For Predictive Maintenance (MNT-10.1) by establishing documented expectations, accountability structures, and organizational guardrails. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "MNT-04", "name": "Timely Maintenance", "description": "Mechanisms exist to obtain maintenance support and/or spare parts for Technology Assets, Applications and/or Services (TAAS) within a defined Recovery Time Objective (RTO).", "justification": "Timely Maintenance (MNT-04) provides overlapping security capability that compensates for the absence of Automated Support For Predictive Maintenance (MNT-10.1) by addressing related risk objectives through an alternative control mechanism aligned with Technology applicability. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "MNT-11", "risk_if_not_implemented": "Without Maintenance Tools, maintenance activities may introduce unauthorized changes, expose systems to untrusted personnel or tools, or leave systems in an unsafe state. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Access (R-AC-4), Unauthorized Modification / Loss of System Integrity (R-AM-2), Undetected / Delayed Detection of Adverse Activity (R-SA-1), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Fraud, Corruption and/or Intentional Criminal Conduct (MT-14).", "compensating_control_1": { "control_id": "CFG-08.2", "name": "Integrity Assurance & Enforcement (IAE)", "description": "Automated mechanisms exist to:\n(1) Identify unauthorized deviations from an approved secure baseline configuration; and\n(2) Implement automated resiliency actions to remediate the unauthorized change.", "justification": "Integrity Assurance & Enforcement (IAE) (CFG-08.2) provides configuration hardening that compensates for the absence of Maintenance Tools (MNT-11) by eliminating unnecessary services and enforcing secure settings to reduce inherent exposure. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "MON-02", "name": "Continuous Monitoring", "description": "Mechanisms exist to facilitate the implementation of enterprise-wide monitoring controls.", "justification": "Continuous Monitoring (MON-02) provides detective monitoring capability that compensates for the absence of Maintenance Tools (MNT-11) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "MNT-11.1", "risk_if_not_implemented": "Without Inspect Tools, maintenance activities may introduce unauthorized changes, expose systems to untrusted personnel or tools, or leave systems in an unsafe state. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Modification / Loss of System Integrity (R-AM-2), System / Data Compromise (Technical Vector) (R-BC-4), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9), Fraud, Corruption and/or Intentional Criminal Conduct (MT-14), Counterfeit / Non-Conforming Products (MT-20).", "compensating_control_1": { "control_id": "MON-02", "name": "Continuous Monitoring", "description": "Mechanisms exist to facilitate the implementation of enterprise-wide monitoring controls.", "justification": "Continuous Monitoring (MON-02) provides detective monitoring capability that compensates for the absence of Inspect Tools (MNT-11.1) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CFG-08.2", "name": "Integrity Assurance & Enforcement (IAE)", "description": "Automated mechanisms exist to:\n(1) Identify unauthorized deviations from an approved secure baseline configuration; and\n(2) Implement automated resiliency actions to remediate the unauthorized change.", "justification": "Integrity Assurance & Enforcement (IAE) (CFG-08.2) provides configuration hardening that compensates for the absence of Inspect Tools (MNT-11.1) by eliminating unnecessary services and enforcing secure settings to reduce inherent exposure. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "MNT-11.2", "risk_if_not_implemented": "Without Inspect Media, sensitive and/or regulated data may be disclosed, altered or lost through inadequate classification, handling or protection. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Modification / Loss of System Integrity (R-AM-2), System / Data Compromise (Technical Vector) (R-BC-4), Undetected / Delayed Detection of Adverse Activity (R-SA-1), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9), Fraud, Corruption and/or Intentional Criminal Conduct (MT-14).", "compensating_control_1": { "control_id": "CFG-08.2", "name": "Integrity Assurance & Enforcement (IAE)", "description": "Automated mechanisms exist to:\n(1) Identify unauthorized deviations from an approved secure baseline configuration; and\n(2) Implement automated resiliency actions to remediate the unauthorized change.", "justification": "Integrity Assurance & Enforcement (IAE) (CFG-08.2) provides configuration hardening that compensates for the absence of Inspect Media (MNT-11.2) by eliminating unnecessary services and enforcing secure settings to reduce inherent exposure. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "MNT-11", "name": "Maintenance Tools", "description": "Mechanisms exist to control and monitor the use of system maintenance tools.", "justification": "Maintenance Tools (MNT-11) provides overlapping security capability that compensates for the absence of Inspect Media (MNT-11.2) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "MNT-11.3", "risk_if_not_implemented": "Without Restrict Tool Usage, maintenance activities may introduce unauthorized changes, expose systems to untrusted personnel or tools, or leave systems in an unsafe state. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Excessive or Unauthorized Privilege (R-AC-2), Unauthorized Privilege Elevation (R-AC-3), Unauthorized Access (R-AC-4), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Technical / Mechanical Failure (MT-10), Fraud, Corruption and/or Intentional Criminal Conduct (MT-14).", "compensating_control_1": { "control_id": "CFG-08.2", "name": "Integrity Assurance & Enforcement (IAE)", "description": "Automated mechanisms exist to:\n(1) Identify unauthorized deviations from an approved secure baseline configuration; and\n(2) Implement automated resiliency actions to remediate the unauthorized change.", "justification": "Integrity Assurance & Enforcement (IAE) (CFG-08.2) provides configuration hardening that compensates for the absence of Restrict Tool Usage (MNT-11.3) by eliminating unnecessary services and enforcing secure settings to reduce inherent exposure. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "MON-02", "name": "Continuous Monitoring", "description": "Mechanisms exist to facilitate the implementation of enterprise-wide monitoring controls.", "justification": "Continuous Monitoring (MON-02) provides detective monitoring capability that compensates for the absence of Restrict Tool Usage (MNT-11.3) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "MNT-12", "risk_if_not_implemented": "Without Remote Maintenance, maintenance activities may introduce unauthorized changes, expose systems to untrusted personnel or tools, or leave systems in an unsafe state. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Access (R-AC-4), Undetected / Delayed Detection of Adverse Activity (R-SA-1), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Fraud, Corruption and/or Intentional Criminal Conduct (MT-14).", "compensating_control_1": { "control_id": "IAC-37", "name": "Multi-Factor Authentication (MFA)", "description": "Automated mechanisms exist to enforce Multi-Factor Authentication (MFA) for:\n(1) Remote network access; \n(2) Third-party Technology Assets, Applications and/or Services (TAAS); and/ or\n(3) Non-console access to critical TAAS that store, transmit and/or process sensitive and/or regulated data.", "justification": "Multi-Factor Authentication (MFA) (IAC-37) provides access control enforcement that compensates for the absence of Remote Maintenance (MNT-12) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CFG-04.7", "name": "Non-Console Administrative Access", "description": "Cryptographic mechanisms exist to protect the confidentiality and integrity of non-console administrative access.", "justification": "Non-Console Administrative Access (CFG-04.7) provides access control enforcement that compensates for the absence of Remote Maintenance (MNT-12) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "MNT-12.1", "risk_if_not_implemented": "Without Remote Maintenance Notifications, maintenance activities may introduce unauthorized changes, expose systems to untrusted personnel or tools, or leave systems in an unsafe state. Based on the risk and threat mapping for this control, no risk is rated Likely; risks rated Possible include Loss of Accountability / Attribution (R-AC-1), Business / Service Interruption (R-BC-1), Reduced Operational Productivity (R-BC-3), and most likely increases susceptibility to Human Error (MT-9).", "compensating_control_1": { "control_id": "IAC-37", "name": "Multi-Factor Authentication (MFA)", "description": "Automated mechanisms exist to enforce Multi-Factor Authentication (MFA) for:\n(1) Remote network access; \n(2) Third-party Technology Assets, Applications and/or Services (TAAS); and/ or\n(3) Non-console access to critical TAAS that store, transmit and/or process sensitive and/or regulated data.", "justification": "Multi-Factor Authentication (MFA) (IAC-37) provides access control enforcement that compensates for the absence of Remote Maintenance Notifications (MNT-12.1) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "MNT-12", "name": "Remote Maintenance", "description": "Mechanisms exist to authorize, monitor and control remote, non-local maintenance and diagnostic activities.", "justification": "Remote Maintenance (MNT-12) provides overlapping security capability that compensates for the absence of Remote Maintenance Notifications (MNT-12.1) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "MNT-12.2", "risk_if_not_implemented": "Without Remote Maintenance Pre-Approval, maintenance activities may introduce unauthorized changes, expose systems to untrusted personnel or tools, or leave systems in an unsafe state. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Access (R-AC-4), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Fraud, Corruption and/or Intentional Criminal Conduct (MT-14).", "compensating_control_1": { "control_id": "CFG-04.7", "name": "Non-Console Administrative Access", "description": "Cryptographic mechanisms exist to protect the confidentiality and integrity of non-console administrative access.", "justification": "Non-Console Administrative Access (CFG-04.7) provides access control enforcement that compensates for the absence of Remote Maintenance Pre-Approval (MNT-12.2) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "IAC-37", "name": "Multi-Factor Authentication (MFA)", "description": "Automated mechanisms exist to enforce Multi-Factor Authentication (MFA) for:\n(1) Remote network access; \n(2) Third-party Technology Assets, Applications and/or Services (TAAS); and/ or\n(3) Non-console access to critical TAAS that store, transmit and/or process sensitive and/or regulated data.", "justification": "Multi-Factor Authentication (MFA) (IAC-37) provides access control enforcement that compensates for the absence of Remote Maintenance Pre-Approval (MNT-12.2) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "MNT-12.3", "risk_if_not_implemented": "Without Remote Maintenance Disconnect Verification, maintenance activities may introduce unauthorized changes, expose systems to untrusted personnel or tools, or leave systems in an unsafe state. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Access (R-AC-4), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "IAC-37", "name": "Multi-Factor Authentication (MFA)", "description": "Automated mechanisms exist to enforce Multi-Factor Authentication (MFA) for:\n(1) Remote network access; \n(2) Third-party Technology Assets, Applications and/or Services (TAAS); and/ or\n(3) Non-console access to critical TAAS that store, transmit and/or process sensitive and/or regulated data.", "justification": "Multi-Factor Authentication (MFA) (IAC-37) provides access control enforcement that compensates for the absence of Remote Maintenance Disconnect Verification (MNT-12.3) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CFG-04.7", "name": "Non-Console Administrative Access", "description": "Cryptographic mechanisms exist to protect the confidentiality and integrity of non-console administrative access.", "justification": "Non-Console Administrative Access (CFG-04.7) provides access control enforcement that compensates for the absence of Remote Maintenance Disconnect Verification (MNT-12.3) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "MNT-12.4", "risk_if_not_implemented": "Without Remote Maintenance Cryptographic Protection, data in transit and at rest may be exposed through weak, misconfigured or compromised cryptographic protections. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss of Confidentiality (R-IP-2), Loss of Data Integrity (R-IP-3), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Harvest Now / Decrypt Later (HNDL) (MT-28), Cryptographic Compromise / Cryptanalytic Capability Advancement (MT-31).", "compensating_control_1": { "control_id": "CFG-04.7", "name": "Non-Console Administrative Access", "description": "Cryptographic mechanisms exist to protect the confidentiality and integrity of non-console administrative access.", "justification": "Non-Console Administrative Access (CFG-04.7) provides access control enforcement that compensates for the absence of Remote Maintenance Cryptographic Protection (MNT-12.4) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the data-handling focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "MNT-12", "name": "Remote Maintenance", "description": "Mechanisms exist to authorize, monitor and control remote, non-local maintenance and diagnostic activities.", "justification": "Remote Maintenance (MNT-12) provides overlapping security capability that compensates for the absence of Remote Maintenance Cryptographic Protection (MNT-12.4) by addressing related risk objectives through an alternative control mechanism aligned with Data applicability. Given the data-handling focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "MNT-12.5", "risk_if_not_implemented": "Without Auditing Remote Maintenance, the organization may fail to meet statutory, regulatory or contractual obligations, or be unable to demonstrate conformity when required. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss of Accountability / Attribution (R-AC-1), Loss of Investigative / Evidentiary Capability (R-IR-1), Undetected / Delayed Detection of Adverse Activity (R-SA-1), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "CFG-04.7", "name": "Non-Console Administrative Access", "description": "Cryptographic mechanisms exist to protect the confidentiality and integrity of non-console administrative access.", "justification": "Non-Console Administrative Access (CFG-04.7) provides access control enforcement that compensates for the absence of Auditing Remote Maintenance (MNT-12.5) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "IAC-37", "name": "Multi-Factor Authentication (MFA)", "description": "Automated mechanisms exist to enforce Multi-Factor Authentication (MFA) for:\n(1) Remote network access; \n(2) Third-party Technology Assets, Applications and/or Services (TAAS); and/ or\n(3) Non-console access to critical TAAS that store, transmit and/or process sensitive and/or regulated data.", "justification": "Multi-Factor Authentication (MFA) (IAC-37) provides access control enforcement that compensates for the absence of Auditing Remote Maintenance (MNT-12.5) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "MNT-13", "risk_if_not_implemented": "Without Remote Maintenance Comparable Security & Sanitization, sensitive and/or regulated data may be retained beyond authorized periods or recovered from improperly disposed media and equipment. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Access (R-AC-4), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "MNT-12", "name": "Remote Maintenance", "description": "Mechanisms exist to authorize, monitor and control remote, non-local maintenance and diagnostic activities.", "justification": "Remote Maintenance (MNT-12) provides overlapping security capability that compensates for the absence of Remote Maintenance Comparable Security & Sanitization (MNT-13) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "IAC-37", "name": "Multi-Factor Authentication (MFA)", "description": "Automated mechanisms exist to enforce Multi-Factor Authentication (MFA) for:\n(1) Remote network access; \n(2) Third-party Technology Assets, Applications and/or Services (TAAS); and/ or\n(3) Non-console access to critical TAAS that store, transmit and/or process sensitive and/or regulated data.", "justification": "Multi-Factor Authentication (MFA) (IAC-37) provides access control enforcement that compensates for the absence of Remote Maintenance Comparable Security & Sanitization (MNT-13) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "MNT-13.1", "risk_if_not_implemented": "Without Separation of Maintenance Sessions, security may be bolted on rather than designed in, resulting in structural weaknesses that are costly to remediate and easy to exploit. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Access (R-AC-4), Identity Compromise / Impersonation (R-AC-5), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "IAC-37", "name": "Multi-Factor Authentication (MFA)", "description": "Automated mechanisms exist to enforce Multi-Factor Authentication (MFA) for:\n(1) Remote network access; \n(2) Third-party Technology Assets, Applications and/or Services (TAAS); and/ or\n(3) Non-console access to critical TAAS that store, transmit and/or process sensitive and/or regulated data.", "justification": "Multi-Factor Authentication (MFA) (IAC-37) provides access control enforcement that compensates for the absence of Separation of Maintenance Sessions (MNT-13.1) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CFG-04.7", "name": "Non-Console Administrative Access", "description": "Cryptographic mechanisms exist to protect the confidentiality and integrity of non-console administrative access.", "justification": "Non-Console Administrative Access (CFG-04.7) provides access control enforcement that compensates for the absence of Separation of Maintenance Sessions (MNT-13.1) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "MNT-14", "risk_if_not_implemented": "Without Authorized Maintenance Personnel, maintenance activities may introduce unauthorized changes, expose systems to untrusted personnel or tools, or leave systems in an unsafe state. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Access (R-AC-4), and most likely increases susceptibility to Human Error (MT-9), Data Quality Degradation / Data Poisoning (MT-12).", "compensating_control_1": { "control_id": "IAC-30", "name": "Least Privilege", "description": "Mechanisms exist to utilize the concept of least privilege, allowing only authorized access to processes necessary to accomplish assigned tasks in accordance with organizational business functions.", "justification": "Least Privilege (IAC-30) provides access control enforcement that compensates for the absence of Authorized Maintenance Personnel (MNT-14) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "MNT-02", "name": "Maintenance Operations", "description": "Mechanisms exist to develop, disseminate, review & update procedures to facilitate the implementation of maintenance controls across the enterprise.", "justification": "Maintenance Operations (MNT-02) provides overlapping security capability that compensates for the absence of Authorized Maintenance Personnel (MNT-14) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "MNT-14.1", "risk_if_not_implemented": "Without Maintenance Personnel Without Appropriate Access, maintenance activities may introduce unauthorized changes, expose systems to untrusted personnel or tools, or leave systems in an unsafe state. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Access (R-AC-4), Loss of Confidentiality (R-IP-2), and most likely increases susceptibility to Human Error (MT-9), Workforce Shortage / Loss of Critical Skills / Labor Disruption (MT-25).", "compensating_control_1": { "control_id": "MNT-02", "name": "Maintenance Operations", "description": "Mechanisms exist to develop, disseminate, review & update procedures to facilitate the implementation of maintenance controls across the enterprise.", "justification": "Maintenance Operations (MNT-02) provides overlapping security capability that compensates for the absence of Maintenance Personnel Without Appropriate Access (MNT-14.1) by addressing related risk objectives through an alternative control mechanism aligned with People applicability. Given the people-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "IAC-30", "name": "Least Privilege", "description": "Mechanisms exist to utilize the concept of least privilege, allowing only authorized access to processes necessary to accomplish assigned tasks in accordance with organizational business functions.", "justification": "Least Privilege (IAC-30) provides access control enforcement that compensates for the absence of Maintenance Personnel Without Appropriate Access (MNT-14.1) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the people-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "MNT-15", "risk_if_not_implemented": "Without Non-System Related Maintenance, maintenance activities may introduce unauthorized changes, expose systems to untrusted personnel or tools, or leave systems in an unsafe state. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Access (R-AC-4), and most likely increases susceptibility to Physical Crime (MT-5), Human Error (MT-9).", "compensating_control_1": { "control_id": "IAC-30", "name": "Least Privilege", "description": "Mechanisms exist to utilize the concept of least privilege, allowing only authorized access to processes necessary to accomplish assigned tasks in accordance with organizational business functions.", "justification": "Least Privilege (IAC-30) provides access control enforcement that compensates for the absence of Non-System Related Maintenance (MNT-15) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "MNT-14", "name": "Authorized Maintenance Personnel", "description": "Mechanisms exist to maintain a current list of authorized maintenance organizations or personnel.", "justification": "Authorized Maintenance Personnel (MNT-14) provides overlapping security capability that compensates for the absence of Non-System Related Maintenance (MNT-15) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "MNT-16", "risk_if_not_implemented": "Without Maintain Configuration Control During Maintenance, Technology Assets, Applications and/or Services (TAAS) may operate with insecure, unauthorized or drifted configurations that expand the attack surface. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss, Theft or Damage of Assets (R-AM-1), Unauthorized Modification / Loss of System Integrity (R-AM-2), and most likely increases susceptibility to natural threats NT-2, NT-3, NT-4, NT-5, NT-6, NT-8, NT-11, NT-12, NT-13, NT-14; Physical Crime (MT-5), Human Error (MT-9).", "compensating_control_1": { "control_id": "CFG-08.2", "name": "Integrity Assurance & Enforcement (IAE)", "description": "Automated mechanisms exist to:\n(1) Identify unauthorized deviations from an approved secure baseline configuration; and\n(2) Implement automated resiliency actions to remediate the unauthorized change.", "justification": "Integrity Assurance & Enforcement (IAE) (CFG-08.2) provides configuration hardening that compensates for the absence of Maintain Configuration Control During Maintenance (MNT-16) by eliminating unnecessary services and enforcing secure settings to reduce inherent exposure. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CHG-03", "name": "Configuration Change Control", "description": "Mechanisms exist to govern the technical configuration change control processes.", "justification": "Configuration Change Control (CHG-03) provides configuration hardening that compensates for the absence of Maintain Configuration Control During Maintenance (MNT-16) by eliminating unnecessary services and enforcing secure settings to reduce inherent exposure. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "MNT-17", "risk_if_not_implemented": "Without Field Maintenance, maintenance activities may introduce unauthorized changes, expose systems to untrusted personnel or tools, or leave systems in an unsafe state. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Modification / Loss of System Integrity (R-AM-2), and most likely increases susceptibility to natural threats NT-2, NT-3, NT-4, NT-5, NT-6, NT-8, NT-11, NT-12, NT-13, NT-14; Human Error (MT-9), Hazardous / Degraded Operational Environment (MT-21), Workforce Shortage / Loss of Critical Skills / Labor Disruption (MT-25), Transportation / Logistics Disruption (MT-26).", "compensating_control_1": { "control_id": "PES-15", "name": "Delivery & Removal", "description": "Physical security mechanisms exist to isolate information processing facilities from points such as delivery and loading areas and other points to avoid unauthorized access.", "justification": "Delivery & Removal (PES-15) provides overlapping security capability that compensates for the absence of Field Maintenance (MNT-17) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "MNT-02", "name": "Maintenance Operations", "description": "Mechanisms exist to develop, disseminate, review & update procedures to facilitate the implementation of maintenance controls across the enterprise.", "justification": "Maintenance Operations (MNT-02) provides overlapping security capability that compensates for the absence of Field Maintenance (MNT-17) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "MNT-18", "risk_if_not_implemented": "Without Off-Site Maintenance, maintenance activities may introduce unauthorized changes, expose systems to untrusted personnel or tools, or leave systems in an unsafe state. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss, Theft or Damage of Assets (R-AM-1), Loss of Confidentiality (R-IP-2), and most likely increases susceptibility to Physical Crime (MT-5), Human Error (MT-9), Transportation / Logistics Disruption (MT-26).", "compensating_control_1": { "control_id": "MNT-12", "name": "Remote Maintenance", "description": "Mechanisms exist to authorize, monitor and control remote, non-local maintenance and diagnostic activities.", "justification": "Remote Maintenance (MNT-12) provides overlapping security capability that compensates for the absence of Off-Site Maintenance (MNT-18) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "IAC-37", "name": "Multi-Factor Authentication (MFA)", "description": "Automated mechanisms exist to enforce Multi-Factor Authentication (MFA) for:\n(1) Remote network access; \n(2) Third-party Technology Assets, Applications and/or Services (TAAS); and/ or\n(3) Non-console access to critical TAAS that store, transmit and/or process sensitive and/or regulated data.", "justification": "Multi-Factor Authentication (MFA) (IAC-37) provides access control enforcement that compensates for the absence of Off-Site Maintenance (MNT-18) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "MDM-03", "risk_if_not_implemented": "Without Restricting Access To Authorized Technology Assets, Applications and/or Services (TAAS), mobile and portable devices may expose organizational data through loss, theft, insecure configuration or unauthorized use. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Access (R-AC-4), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "CFG-11", "name": "Software Usage Restrictions", "description": "Mechanisms exist to enforce software usage restrictions to comply with applicable contract agreements and copyright laws.", "justification": "Software Usage Restrictions (CFG-11) provides overlapping security capability that compensates for the absence of Restricting Access To Authorized Technology Assets, Applications and/or Services (TAAS) (MDM-03) by addressing related risk objectives through an alternative control mechanism aligned with Technology applicability. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "NET-03", "name": "Boundary Protection", "description": "Mechanisms exist to monitor and control communications at the external network boundary and at key internal boundaries within the network.", "justification": "Boundary Protection (NET-03) provides network-level access restriction that compensates for the absence of Restricting Access To Authorized Technology Assets, Applications and/or Services (TAAS) (MDM-03) by limiting attacker reach and lateral movement opportunities across the environment. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "MDM-04", "risk_if_not_implemented": "Without Full Device & Container-Based Encryption, data in transit and at rest may be exposed through weak, misconfigured or compromised cryptographic protections. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss of Confidentiality (R-IP-2), Loss of Data Integrity (R-IP-3), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Technical / Mechanical Failure (MT-10), Cryptographic Compromise / Cryptanalytic Capability Advancement (MT-31).", "compensating_control_1": { "control_id": "CRY-07", "name": "Encrypting Data At Rest", "description": "Cryptographic mechanisms exist to prevent the unauthorized disclosure of data at rest.", "justification": "Encrypting Data At Rest (CRY-07) provides cryptographic protection that compensates for the absence of Full Device & Container-Based Encryption (MDM-04) by ensuring data confidentiality and integrity through alternative technical means. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "IAC-30", "name": "Least Privilege", "description": "Mechanisms exist to utilize the concept of least privilege, allowing only authorized access to processes necessary to accomplish assigned tasks in accordance with organizational business functions.", "justification": "Least Privilege (IAC-30) provides access control enforcement that compensates for the absence of Full Device & Container-Based Encryption (MDM-04) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "MDM-05", "risk_if_not_implemented": "Without Separate Mobile Device Profiles, mobile and portable devices may expose organizational data through loss, theft, insecure configuration or unauthorized use. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss of Confidentiality (R-IP-2), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "CFG-03", "name": "Least Functionality", "description": "Mechanisms exist to configure Technology Assets, Applications and/or Services (TAAS) to provide only essential capabilities by specifically prohibiting or restricting the use of ports, protocols, and/or services.", "justification": "Least Functionality (CFG-03) provides configuration hardening that compensates for the absence of Separate Mobile Device Profiles (MDM-05) by eliminating unnecessary services and enforcing secure settings to reduce inherent exposure. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "MDM-02", "name": "Centralized Management Of Mobile Devices", "description": "Mechanisms exist to implement and govern Mobile Device Management (MDM) controls.", "justification": "Centralized Management Of Mobile Devices (MDM-02) provides overlapping security capability that compensates for the absence of Separate Mobile Device Profiles (MDM-05) by addressing related risk objectives through an alternative control mechanism aligned with Technology applicability. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "MDM-06", "risk_if_not_implemented": "Without Personally-Owned Mobile Devices, mobile and portable devices may expose organizational data through loss, theft, insecure configuration or unauthorized use. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Access (R-AC-4), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "MDM-02", "name": "Centralized Management Of Mobile Devices", "description": "Mechanisms exist to implement and govern Mobile Device Management (MDM) controls.", "justification": "Centralized Management Of Mobile Devices (MDM-02) provides overlapping security capability that compensates for the absence of Personally-Owned Mobile Devices (MDM-06) by addressing related risk objectives through an alternative control mechanism aligned with Technology applicability. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CFG-11", "name": "Software Usage Restrictions", "description": "Mechanisms exist to enforce software usage restrictions to comply with applicable contract agreements and copyright laws.", "justification": "Software Usage Restrictions (CFG-11) provides overlapping security capability that compensates for the absence of Personally-Owned Mobile Devices (MDM-06) by addressing related risk objectives through an alternative control mechanism aligned with Technology applicability. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "MDM-07", "risk_if_not_implemented": "Without Organization-Owned Mobile Devices, mobile and portable devices may expose organizational data through loss, theft, insecure configuration or unauthorized use. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Modification / Loss of System Integrity (R-AM-2), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "MDM-02", "name": "Centralized Management Of Mobile Devices", "description": "Mechanisms exist to implement and govern Mobile Device Management (MDM) controls.", "justification": "Centralized Management Of Mobile Devices (MDM-02) provides overlapping security capability that compensates for the absence of Organization-Owned Mobile Devices (MDM-07) by addressing related risk objectives through an alternative control mechanism aligned with Technology applicability. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CFG-04", "name": "Secure Baseline Configurations", "description": "Mechanisms exist to develop, document and maintain secure baseline configurations for Technology Assets, Applications and/or Services (TAAS) that are consistent with industry-accepted hardening standards.", "justification": "Secure Baseline Configurations (CFG-04) provides configuration hardening that compensates for the absence of Organization-Owned Mobile Devices (MDM-07) by eliminating unnecessary services and enforcing secure settings to reduce inherent exposure. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "MDM-08", "risk_if_not_implemented": "Without Mobile Device Geofencing, mobile and portable devices may expose organizational data through loss, theft, insecure configuration or unauthorized use. Based on the risk and threat mapping for this control, no risk is rated Likely; risks rated Possible include Unauthorized Access (R-AC-4), Loss, Theft or Damage of Assets (R-AM-1), System / Data Compromise (Technical Vector) (R-BC-4), and most likely increases susceptibility to Space Weather (NT-9); Malicious Cyber Activity (MT-2), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "NET-24", "name": "Wireless Networking", "description": "Mechanisms exist to control authorized wireless usage and monitor for unauthorized wireless access.", "justification": "Wireless Networking (NET-24) provides network-level access restriction that compensates for the absence of Mobile Device Geofencing (MDM-08) by limiting attacker reach and lateral movement opportunities across the environment. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "PES-02", "name": "Physical & Environmental Protections", "description": "Mechanisms exist to facilitate the operation of physical and environmental protection controls.", "justification": "Physical & Environmental Protections (PES-02) provides physical access control that compensates for the absence of Mobile Device Geofencing (MDM-08) by preventing unauthorized physical interaction with systems and infrastructure. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "MDM-09", "risk_if_not_implemented": "Without Remote Purging, mobile and portable devices may expose organizational data through loss, theft, insecure configuration or unauthorized use. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Retention / Inability to Dispose of Data (R-AM-3), Delayed Containment / Increased Incident Impact (R-IR-2), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Utility Service Disruption (MT-7), Human Error (MT-9), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "MDM-02", "name": "Centralized Management Of Mobile Devices", "description": "Mechanisms exist to implement and govern Mobile Device Management (MDM) controls.", "justification": "Centralized Management Of Mobile Devices (MDM-02) provides overlapping security capability that compensates for the absence of Remote Purging (MDM-09) by addressing related risk objectives through an alternative control mechanism aligned with Technology applicability. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "IAC-02", "name": "Identity & Access Management (IAM)", "description": "Mechanisms exist to facilitate the implementation of Identification and Access Management (IAM) controls.", "justification": "Identity & Access Management (IAM) (IAC-02) provides access control enforcement that compensates for the absence of Remote Purging (MDM-09) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "MDM-10", "risk_if_not_implemented": "Without Mobile Device Tampering, counterfeit, non-conforming or compromised components and services may enter the environment through the supply chain. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Modification / Loss of System Integrity (R-AM-2), Undetected / Delayed Detection of Adverse Activity (R-SA-1), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9).", "compensating_control_1": { "control_id": "MON-02", "name": "Continuous Monitoring", "description": "Mechanisms exist to facilitate the implementation of enterprise-wide monitoring controls.", "justification": "Continuous Monitoring (MON-02) provides detective monitoring capability that compensates for the absence of Mobile Device Tampering (MDM-10) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "PES-13", "name": "Monitoring Physical Access", "description": "Physical access control mechanisms exist to monitor for, detect and respond to physical security incidents.", "justification": "Monitoring Physical Access (PES-13) provides detective monitoring capability that compensates for the absence of Mobile Device Tampering (MDM-10) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "NET-03.1", "risk_if_not_implemented": "Without Limit Network Connections, adversaries may move laterally, exfiltrate data or reach systems that should have been isolated from untrusted networks. Based on the risk and threat mapping for this control, no risk is rated Likely; risks rated Possible include Unauthorized Access (R-AC-4), Business / Service Interruption (R-BC-1), Reduced Operational Productivity (R-BC-3), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "NET-06", "name": "Network Segmentation (macrosegmentation)", "description": "Mechanisms exist to implement network segmentation within network architectures to isolate Technology Assets, Applications and/or Services (TAAS) from other network resources.", "justification": "Network Segmentation (macrosegmentation) (NET-06) provides network-level access restriction that compensates for the absence of Limit Network Connections (NET-03.1) by limiting attacker reach and lateral movement opportunities across the environment. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "END-07", "name": "Software Firewall", "description": "Mechanisms exist to utilize host-based firewall software, or a similar technology, on all endpoint devices, where technically feasible.", "justification": "Software Firewall (END-07) provides network-level access restriction that compensates for the absence of Limit Network Connections (NET-03.1) by limiting attacker reach and lateral movement opportunities across the environment. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "NET-03.2", "risk_if_not_implemented": "Without External Telecommunications Services, adversaries may move laterally, exfiltrate data or reach systems that should have been isolated from untrusted networks. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss of Confidentiality (R-IP-2), Loss of Data Integrity (R-IP-3), and most likely increases susceptibility to man-made threats MT-2, MT-7, MT-10, MT-27, MT-28, MT-31.", "compensating_control_1": { "control_id": "NET-04", "name": "Data Flow Enforcement – Access Control Lists (ACLs)", "description": "Mechanisms exist to implement and govern Access Control Lists (ACLs) to provide data flow enforcement that explicitly restrict network traffic to only what is authorized.", "justification": "Data Flow Enforcement – Access Control Lists (ACLs) (NET-04) provides access control enforcement that compensates for the absence of External Telecommunications Services (NET-03.2) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "NET-06", "name": "Network Segmentation (macrosegmentation)", "description": "Mechanisms exist to implement network segmentation within network architectures to isolate Technology Assets, Applications and/or Services (TAAS) from other network resources.", "justification": "Network Segmentation (macrosegmentation) (NET-06) provides network-level access restriction that compensates for the absence of External Telecommunications Services (NET-03.2) by limiting attacker reach and lateral movement opportunities across the environment. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "NET-03.3", "risk_if_not_implemented": "Without Prevent Discovery of Internal Information, adversaries may move laterally, exfiltrate data or reach systems that should have been isolated from untrusted networks. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss of Confidentiality (R-IP-2), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "NET-06", "name": "Network Segmentation (macrosegmentation)", "description": "Mechanisms exist to implement network segmentation within network architectures to isolate Technology Assets, Applications and/or Services (TAAS) from other network resources.", "justification": "Network Segmentation (macrosegmentation) (NET-06) provides network-level access restriction that compensates for the absence of Prevent Discovery of Internal Information (NET-03.3) by limiting attacker reach and lateral movement opportunities across the environment. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "MON-02", "name": "Continuous Monitoring", "description": "Mechanisms exist to facilitate the implementation of enterprise-wide monitoring controls.", "justification": "Continuous Monitoring (MON-02) provides detective monitoring capability that compensates for the absence of Prevent Discovery of Internal Information (NET-03.3) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "NET-03.4", "risk_if_not_implemented": "Without Direct Internet Access Restrictions, adversaries may move laterally, exfiltrate data or reach systems that should have been isolated from untrusted networks. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Access (R-AC-4), System / Data Compromise (Technical Vector) (R-BC-4), System / Service Compromise (R-EX-7), Loss of Confidentiality (R-IP-2), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "NET-03", "name": "Boundary Protection", "description": "Mechanisms exist to monitor and control communications at the external network boundary and at key internal boundaries within the network.", "justification": "Boundary Protection (NET-03) provides network-level access restriction that compensates for the absence of Direct Internet Access Restrictions (NET-03.4) by limiting attacker reach and lateral movement opportunities across the environment. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "NET-06", "name": "Network Segmentation (macrosegmentation)", "description": "Mechanisms exist to implement network segmentation within network architectures to isolate Technology Assets, Applications and/or Services (TAAS) from other network resources.", "justification": "Network Segmentation (macrosegmentation) (NET-06) provides network-level access restriction that compensates for the absence of Direct Internet Access Restrictions (NET-03.4) by limiting attacker reach and lateral movement opportunities across the environment. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "NET-03.5", "risk_if_not_implemented": "Without Prevent Unauthorized Exfiltration, sensitive and/or regulated data may be exfiltrated, leaked or transferred outside authorized boundaries without detection. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Intellectual Property / Trade Secret Loss (R-EX-9), Loss of Confidentiality (R-IP-2), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "MON-02", "name": "Continuous Monitoring", "description": "Mechanisms exist to facilitate the implementation of enterprise-wide monitoring controls.", "justification": "Continuous Monitoring (MON-02) provides detective monitoring capability that compensates for the absence of Prevent Unauthorized Exfiltration (NET-03.5) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "NET-06", "name": "Network Segmentation (macrosegmentation)", "description": "Mechanisms exist to implement network segmentation within network architectures to isolate Technology Assets, Applications and/or Services (TAAS) from other network resources.", "justification": "Network Segmentation (macrosegmentation) (NET-06) provides network-level access restriction that compensates for the absence of Prevent Unauthorized Exfiltration (NET-03.5) by limiting attacker reach and lateral movement opportunities across the environment. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "NET-03.6", "risk_if_not_implemented": "Without Protocol Compliance Enforcement, the organization may fail to meet statutory, regulatory or contractual obligations, or be unable to demonstrate conformity when required. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to System / Data Compromise (Technical Vector) (R-BC-4), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "NET-17", "name": "DNS & Content Filtering", "description": "Mechanisms exist to force Internet-bound network traffic through a proxy device (e.g., Policy Enforcement Point (PEP)) for URL content filtering and DNS filtering to limit a user's ability to connect to dangerous or prohibited Internet sites.", "justification": "DNS & Content Filtering (NET-17) provides network-level access restriction that compensates for the absence of Protocol Compliance Enforcement (NET-03.6) by limiting attacker reach and lateral movement opportunities across the environment. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "NET-03", "name": "Boundary Protection", "description": "Mechanisms exist to monitor and control communications at the external network boundary and at key internal boundaries within the network.", "justification": "Boundary Protection (NET-03) provides network-level access restriction that compensates for the absence of Protocol Compliance Enforcement (NET-03.6) by limiting attacker reach and lateral movement opportunities across the environment. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "NET-03.7", "risk_if_not_implemented": "Without Domain Name Verification, adversaries may move laterally, exfiltrate data or reach systems that should have been isolated from untrusted networks. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to System / Data Compromise (Technical Vector) (R-BC-4), Loss of Authenticity / Provenance (R-IP-5), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Technical / Mechanical Failure (MT-10), Data Quality Degradation / Data Poisoning (MT-12), Cryptographic Compromise / Cryptanalytic Capability Advancement (MT-31).", "compensating_control_1": { "control_id": "NET-03", "name": "Boundary Protection", "description": "Mechanisms exist to monitor and control communications at the external network boundary and at key internal boundaries within the network.", "justification": "Boundary Protection (NET-03) provides network-level access restriction that compensates for the absence of Domain Name Verification (NET-03.7) by limiting attacker reach and lateral movement opportunities across the environment. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "NET-40.2", "name": "Phishing & Spam Protection", "description": "Mechanisms exist to utilize anti-phishing and spam protection technologies to detect and take action on unsolicited messages transported by electronic mail.", "justification": "Phishing & Spam Protection (NET-40.2) provides overlapping security capability that compensates for the absence of Domain Name Verification (NET-03.7) by addressing related risk objectives through an alternative control mechanism aligned with Technology applicability. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "NET-03.8", "risk_if_not_implemented": "Without Bandwidth Control, adversaries may move laterally, exfiltrate data or reach systems that should have been isolated from untrusted networks. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Reduced Operational Productivity (R-BC-3), and most likely increases susceptibility to Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "NET-17", "name": "DNS & Content Filtering", "description": "Mechanisms exist to force Internet-bound network traffic through a proxy device (e.g., Policy Enforcement Point (PEP)) for URL content filtering and DNS filtering to limit a user's ability to connect to dangerous or prohibited Internet sites.", "justification": "DNS & Content Filtering (NET-17) provides network-level access restriction that compensates for the absence of Bandwidth Control (NET-03.8) by limiting attacker reach and lateral movement opportunities across the environment. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "NET-40.2", "name": "Phishing & Spam Protection", "description": "Mechanisms exist to utilize anti-phishing and spam protection technologies to detect and take action on unsolicited messages transported by electronic mail.", "justification": "Phishing & Spam Protection (NET-40.2) provides overlapping security capability that compensates for the absence of Bandwidth Control (NET-03.8) by addressing related risk objectives through an alternative control mechanism aligned with Technology applicability. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "NET-03.9", "risk_if_not_implemented": "Without Internet Address Denylisting, adversaries may move laterally, exfiltrate data or reach systems that should have been isolated from untrusted networks. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to System / Data Compromise (Technical Vector) (R-BC-4), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "NET-40.2", "name": "Phishing & Spam Protection", "description": "Mechanisms exist to utilize anti-phishing and spam protection technologies to detect and take action on unsolicited messages transported by electronic mail.", "justification": "Phishing & Spam Protection (NET-40.2) provides overlapping security capability that compensates for the absence of Internet Address Denylisting (NET-03.9) by addressing related risk objectives through an alternative control mechanism aligned with Technology applicability. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "NET-03", "name": "Boundary Protection", "description": "Mechanisms exist to monitor and control communications at the external network boundary and at key internal boundaries within the network.", "justification": "Boundary Protection (NET-03) provides network-level access restriction that compensates for the absence of Internet Address Denylisting (NET-03.9) by limiting attacker reach and lateral movement opportunities across the environment. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "NET-03.10", "risk_if_not_implemented": "Without Certificate Denylisting, data in transit and at rest may be exposed through weak, misconfigured or compromised cryptographic protections. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Identity Compromise / Impersonation (R-AC-5), Loss of Authenticity / Provenance (R-IP-5), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "NET-31", "name": "Network Intrusion Detection / Prevention Systems (NIDS / NIPS)", "description": "Mechanisms exist to employ Network Intrusion Detection / Prevention Systems (NIDS/NIPS) to detect and/or prevent intrusions into the network.", "justification": "Network Intrusion Detection / Prevention Systems (NIDS / NIPS) (NET-31) provides detective monitoring capability that compensates for the absence of Certificate Denylisting (NET-03.10) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "NET-17", "name": "DNS & Content Filtering", "description": "Mechanisms exist to force Internet-bound network traffic through a proxy device (e.g., Policy Enforcement Point (PEP)) for URL content filtering and DNS filtering to limit a user's ability to connect to dangerous or prohibited Internet sites.", "justification": "DNS & Content Filtering (NET-17) provides network-level access restriction that compensates for the absence of Certificate Denylisting (NET-03.10) by limiting attacker reach and lateral movement opportunities across the environment. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "NET-03.11", "risk_if_not_implemented": "Without Content Disarm and Reconstruction (CDR), adversaries may move laterally, exfiltrate data or reach systems that should have been isolated from untrusted networks. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to System / Data Compromise (Technical Vector) (R-BC-4), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "NET-40.2", "name": "Phishing & Spam Protection", "description": "Mechanisms exist to utilize anti-phishing and spam protection technologies to detect and take action on unsolicited messages transported by electronic mail.", "justification": "Phishing & Spam Protection (NET-40.2) provides overlapping security capability that compensates for the absence of Content Disarm and Reconstruction (CDR) (NET-03.11) by addressing related risk objectives through an alternative control mechanism aligned with Technology applicability. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "NET-40.3", "name": "Email Content Protections", "description": "Mechanisms exist to implement an email filtering security service to detect malicious attachments in emails and prevent users from accessing them.", "justification": "Email Content Protections (NET-40.3) provides overlapping security capability that compensates for the absence of Content Disarm and Reconstruction (CDR) (NET-03.11) by addressing related risk objectives through an alternative control mechanism aligned with Technology applicability. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "NET-03.12", "risk_if_not_implemented": "Without Network Processing Rules For Personal Data (PD), Personal Data (PD) may be collected, processed, retained or shared without lawful authority or adequate safeguards, harming individuals and exposing the organization to regulatory action. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Privacy Harm / Unauthorized Processing (R-IP-6), and most likely increases susceptibility to Technical / Mechanical Failure (MT-10), Statutory / Regulatory / Contractual Change (MT-11).", "compensating_control_1": { "control_id": "NET-31", "name": "Network Intrusion Detection / Prevention Systems (NIDS / NIPS)", "description": "Mechanisms exist to employ Network Intrusion Detection / Prevention Systems (NIDS/NIPS) to detect and/or prevent intrusions into the network.", "justification": "Network Intrusion Detection / Prevention Systems (NIDS / NIPS) (NET-31) provides detective monitoring capability that compensates for the absence of Personal Data (PD) (NET-03.12) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "MON-02", "name": "Continuous Monitoring", "description": "Mechanisms exist to facilitate the implementation of enterprise-wide monitoring controls.", "justification": "Continuous Monitoring (MON-02) provides detective monitoring capability that compensates for the absence of Personal Data (PD) (NET-03.12) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "NET-03.13", "risk_if_not_implemented": "Without Split Tunneling, adversaries may move laterally, exfiltrate data or reach systems that should have been isolated from untrusted networks. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Access (R-AC-4), System / Data Compromise (Technical Vector) (R-BC-4), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "CFG-04", "name": "Secure Baseline Configurations", "description": "Mechanisms exist to develop, document and maintain secure baseline configurations for Technology Assets, Applications and/or Services (TAAS) that are consistent with industry-accepted hardening standards.", "justification": "Secure Baseline Configurations (CFG-04) provides configuration hardening that compensates for the absence of Split Tunneling (NET-03.13) by eliminating unnecessary services and enforcing secure settings to reduce inherent exposure. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CFG-03", "name": "Least Functionality", "description": "Mechanisms exist to configure Technology Assets, Applications and/or Services (TAAS) to provide only essential capabilities by specifically prohibiting or restricting the use of ports, protocols, and/or services.", "justification": "Least Functionality (CFG-03) provides configuration hardening that compensates for the absence of Split Tunneling (NET-03.13) by eliminating unnecessary services and enforcing secure settings to reduce inherent exposure. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "NET-04.2", "risk_if_not_implemented": "Without Human Reviews, adversaries may move laterally, exfiltrate data or reach systems that should have been isolated from untrusted networks. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Excessive or Unauthorized Privilege (R-AC-2), Lack of oversight of internal controls (R-GV-6), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Workforce Shortage / Loss of Critical Skills / Labor Disruption (MT-25).", "compensating_control_1": { "control_id": "NET-04", "name": "Data Flow Enforcement – Access Control Lists (ACLs)", "description": "Mechanisms exist to implement and govern Access Control Lists (ACLs) to provide data flow enforcement that explicitly restrict network traffic to only what is authorized.", "justification": "Data Flow Enforcement – Access Control Lists (ACLs) (NET-04) provides access control enforcement that compensates for the absence of Human Reviews (NET-04.2) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "MON-02", "name": "Continuous Monitoring", "description": "Mechanisms exist to facilitate the implementation of enterprise-wide monitoring controls.", "justification": "Continuous Monitoring (MON-02) provides detective monitoring capability that compensates for the absence of Human Reviews (NET-04.2) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "NET-05", "risk_if_not_implemented": "Without Interconnection Security Agreements (ISAs), adversaries may move laterally, exfiltrate data or reach systems that should have been isolated from untrusted networks. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Uncontrolled Third-Party Security / Privacy Exposure (R-GV-5), Inability to Demonstrate Due Diligence / Due Care (R-GV-9), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9).", "compensating_control_1": { "control_id": "TPM-02", "name": "Third-Party Management", "description": "Mechanisms exist to facilitate the implementation of third-party management controls.", "justification": "Third-Party Management (TPM-02) provides third-party oversight that compensates for the absence of Interconnection Security Agreements (ISAs) (NET-05) by extending security obligations contractually and monitoring third-party risk in lieu of direct control. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CPL-02", "name": "Statutory, Regulatory & Contractual Compliance", "description": "Mechanisms exist to facilitate the identification and implementation of relevant statutory, regulatory and contractual controls.", "justification": "Statutory, Regulatory & Contractual Compliance (CPL-02) provides overlapping security capability that compensates for the absence of Interconnection Security Agreements (ISAs) (NET-05) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "NET-05.1", "risk_if_not_implemented": "Without External System Connections, adversaries may move laterally, exfiltrate data or reach systems that should have been isolated from untrusted networks. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Access (R-AC-4), System / Data Compromise (Technical Vector) (R-BC-4), System / Service Compromise (R-EX-7), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "CPL-02", "name": "Statutory, Regulatory & Contractual Compliance", "description": "Mechanisms exist to facilitate the identification and implementation of relevant statutory, regulatory and contractual controls.", "justification": "Statutory, Regulatory & Contractual Compliance (CPL-02) provides overlapping security capability that compensates for the absence of External System Connections (NET-05.1) by addressing related risk objectives through an alternative control mechanism aligned with Technology applicability. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "TPM-02", "name": "Third-Party Management", "description": "Mechanisms exist to facilitate the implementation of third-party management controls.", "justification": "Third-Party Management (TPM-02) provides third-party oversight that compensates for the absence of External System Connections (NET-05.1) by extending security obligations contractually and monitoring third-party risk in lieu of direct control. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "NET-05.2", "risk_if_not_implemented": "Without Internal System Connections, adversaries may move laterally, exfiltrate data or reach systems that should have been isolated from untrusted networks. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Access (R-AC-4), and most likely increases susceptibility to Human Error (MT-9).", "compensating_control_1": { "control_id": "TPM-02", "name": "Third-Party Management", "description": "Mechanisms exist to facilitate the implementation of third-party management controls.", "justification": "Third-Party Management (TPM-02) provides third-party oversight that compensates for the absence of Internal System Connections (NET-05.2) by extending security obligations contractually and monitoring third-party risk in lieu of direct control. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "NET-05", "name": "Interconnection Security Agreements (ISAs)", "description": "Mechanisms exist to authorize connections from systems to other systems using Interconnection Security Agreements (ISAs), or similar methods, that document, for each interconnection:\n(1) Interface characteristics;\n(2) Security, compliance and resilience requirements; and;\n(3) The nature of the information communicated.", "justification": "Interconnection Security Agreements (ISAs) (NET-05) provides overlapping security capability that compensates for the absence of Internal System Connections (NET-05.2) by addressing related risk objectives through an alternative control mechanism aligned with Technology applicability. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "NET-06.1", "risk_if_not_implemented": "Without Security Management Subnets, adversaries may move laterally, exfiltrate data or reach systems that should have been isolated from untrusted networks. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Access (R-AC-4), System / Data Compromise (Technical Vector) (R-BC-4), System / Service Compromise (R-EX-7), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "NET-03", "name": "Boundary Protection", "description": "Mechanisms exist to monitor and control communications at the external network boundary and at key internal boundaries within the network.", "justification": "Boundary Protection (NET-03) provides network-level access restriction that compensates for the absence of Security Management Subnets (NET-06.1) by limiting attacker reach and lateral movement opportunities across the environment. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "MON-12", "name": "Protection of Event Logs & Security-Relevant Telemetry", "description": "Mechanisms exist to protect event logs, security-relevant telemetry and audit tools from unauthorized access, modification and deletion.", "justification": "Protection of Event Logs & Security-Relevant Telemetry (MON-12) provides detective monitoring capability that compensates for the absence of Security Management Subnets (NET-06.1) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "NET-07", "risk_if_not_implemented": "Without Out-of-Band Channels, adversaries may move laterally, exfiltrate data or reach systems that should have been isolated from untrusted networks. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss of Confidentiality (R-IP-2), and most likely increases susceptibility to Human Error (MT-9), Transportation / Logistics Disruption (MT-26).", "compensating_control_1": { "control_id": "BCD-17", "name": "Telecommunications Services Availability", "description": "Mechanisms exist to reduce the likelihood of a single point of failure with primary telecommunications services.", "justification": "Telecommunications Services Availability (BCD-17) provides overlapping security capability that compensates for the absence of Out-of-Band Channels (NET-07) by addressing related risk objectives through an alternative control mechanism aligned with Technology applicability. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "NET-26", "name": "Remote Access", "description": "Mechanisms exist to define, control and review organization-approved, secure remote access methods.", "justification": "Remote Access (NET-26) provides access control enforcement that compensates for the absence of Out-of-Band Channels (NET-07) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "NET-08", "risk_if_not_implemented": "Without Separate Subnets To Isolate Functions, adversaries may move laterally, exfiltrate data or reach systems that should have been isolated from untrusted networks. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Access (R-AC-4), System / Data Compromise (Technical Vector) (R-BC-4), System / Service Compromise (R-EX-7), Delayed Containment / Increased Incident Impact (R-IR-2), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "NET-06", "name": "Network Segmentation (macrosegmentation)", "description": "Mechanisms exist to implement network segmentation within network architectures to isolate Technology Assets, Applications and/or Services (TAAS) from other network resources.", "justification": "Network Segmentation (macrosegmentation) (NET-06) provides network-level access restriction that compensates for the absence of Separate Subnets To Isolate Functions (NET-08) by limiting attacker reach and lateral movement opportunities across the environment. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "NET-04", "name": "Data Flow Enforcement – Access Control Lists (ACLs)", "description": "Mechanisms exist to implement and govern Access Control Lists (ACLs) to provide data flow enforcement that explicitly restrict network traffic to only what is authorized.", "justification": "Data Flow Enforcement – Access Control Lists (ACLs) (NET-04) provides access control enforcement that compensates for the absence of Separate Subnets To Isolate Functions (NET-08) by restricting system and data access through alternative identity and access management mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "NET-08.2", "risk_if_not_implemented": "Without Segregation From Enterprise Services, adversaries may move laterally, exfiltrate data or reach systems that should have been isolated from untrusted networks. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Access (R-AC-4), System / Data Compromise (Technical Vector) (R-BC-4), System / Service Compromise (R-EX-7), Delayed Containment / Increased Incident Impact (R-IR-2), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "MON-12", "name": "Protection of Event Logs & Security-Relevant Telemetry", "description": "Mechanisms exist to protect event logs, security-relevant telemetry and audit tools from unauthorized access, modification and deletion.", "justification": "Protection of Event Logs & Security-Relevant Telemetry (MON-12) provides detective monitoring capability that compensates for the absence of Segregation From Enterprise Services (NET-08.2) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "NET-06", "name": "Network Segmentation (macrosegmentation)", "description": "Mechanisms exist to implement network segmentation within network architectures to isolate Technology Assets, Applications and/or Services (TAAS) from other network resources.", "justification": "Network Segmentation (macrosegmentation) (NET-06) provides network-level access restriction that compensates for the absence of Segregation From Enterprise Services (NET-08.2) by limiting attacker reach and lateral movement opportunities across the environment. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "NET-09", "risk_if_not_implemented": "Without Network Device Plane Segmentation, adversaries may move laterally, exfiltrate data or reach systems that should have been isolated from untrusted networks. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Access (R-AC-4), System / Data Compromise (Technical Vector) (R-BC-4), System / Service Compromise (R-EX-7), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "NET-06", "name": "Network Segmentation (macrosegmentation)", "description": "Mechanisms exist to implement network segmentation within network architectures to isolate Technology Assets, Applications and/or Services (TAAS) from other network resources.", "justification": "Network Segmentation (macrosegmentation) (NET-06) provides network-level access restriction that compensates for the absence of Network Device Plane Segmentation (NET-09) by limiting attacker reach and lateral movement opportunities across the environment. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "IAC-30", "name": "Least Privilege", "description": "Mechanisms exist to utilize the concept of least privilege, allowing only authorized access to processes necessary to accomplish assigned tasks in accordance with organizational business functions.", "justification": "Least Privilege (IAC-30) provides access control enforcement that compensates for the absence of Network Device Plane Segmentation (NET-09) by restricting system and data access through alternative identity and access management mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "NET-10", "risk_if_not_implemented": "Without Virtual Local Area Network (VLAN) Separation, adversaries may move laterally, exfiltrate data or reach systems that should have been isolated from untrusted networks. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Access (R-AC-4), System / Data Compromise (Technical Vector) (R-BC-4), System / Service Compromise (R-EX-7), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "MON-02", "name": "Continuous Monitoring", "description": "Mechanisms exist to facilitate the implementation of enterprise-wide monitoring controls.", "justification": "Continuous Monitoring (MON-02) provides detective monitoring capability that compensates for the absence of Virtual Local Area Network (VLAN) Separation (NET-10) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "NET-06", "name": "Network Segmentation (macrosegmentation)", "description": "Mechanisms exist to implement network segmentation within network architectures to isolate Technology Assets, Applications and/or Services (TAAS) from other network resources.", "justification": "Network Segmentation (macrosegmentation) (NET-06) provides network-level access restriction that compensates for the absence of Virtual Local Area Network (VLAN) Separation (NET-10) by limiting attacker reach and lateral movement opportunities across the environment. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "NET-11", "risk_if_not_implemented": "Without Microsegmentation, adversaries may move laterally, exfiltrate data or reach systems that should have been isolated from untrusted networks. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Access (R-AC-4), System / Data Compromise (Technical Vector) (R-BC-4), System / Service Compromise (R-EX-7), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "NET-06", "name": "Network Segmentation (macrosegmentation)", "description": "Mechanisms exist to implement network segmentation within network architectures to isolate Technology Assets, Applications and/or Services (TAAS) from other network resources.", "justification": "Network Segmentation (macrosegmentation) (NET-06) provides network-level access restriction that compensates for the absence of Microsegmentation (NET-11) by limiting attacker reach and lateral movement opportunities across the environment. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "MON-02", "name": "Continuous Monitoring", "description": "Mechanisms exist to facilitate the implementation of enterprise-wide monitoring controls.", "justification": "Continuous Monitoring (MON-02) provides detective monitoring capability that compensates for the absence of Microsegmentation (NET-11) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "NET-12", "risk_if_not_implemented": "Without Software Defined Networking (SDN), adversaries may move laterally, exfiltrate data or reach systems that should have been isolated from untrusted networks. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Access (R-AC-4), System / Data Compromise (Technical Vector) (R-BC-4), System / Service Compromise (R-EX-7), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "MON-02", "name": "Continuous Monitoring", "description": "Mechanisms exist to facilitate the implementation of enterprise-wide monitoring controls.", "justification": "Continuous Monitoring (MON-02) provides detective monitoring capability that compensates for the absence of Software Defined Networking (SDN) (NET-12) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "NET-03", "name": "Boundary Protection", "description": "Mechanisms exist to monitor and control communications at the external network boundary and at key internal boundaries within the network.", "justification": "Boundary Protection (NET-03) provides network-level access restriction that compensates for the absence of Software Defined Networking (SDN) (NET-12) by limiting attacker reach and lateral movement opportunities across the environment. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "NET-13.1", "risk_if_not_implemented": "Without Architecture & Provisioning for Name / Address Resolution Service, unauthorized individuals, devices or services may gain access to Technology Assets, Applications, Services, Data and/or Facilities (TAASDF). Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Business / Service Interruption (R-BC-1), Concentration / Single-Point Dependency Failure (R-OR-2), Loss of Data / Service Availability (R-IP-4), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "CRY-05", "name": "Encrypting Data In Transit", "description": "Cryptographic mechanisms exist to prevent the unauthorized disclosure of data in transit.", "justification": "Encrypting Data In Transit (CRY-05) provides cryptographic protection that compensates for the absence of Architecture & Provisioning for Name / Address Resolution Service (NET-13.1) by ensuring data confidentiality and integrity through alternative technical means. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "NET-13", "name": "Domain Name Service (DNS) Resolution", "description": "Mechanisms exist to ensure Domain Name Service (DNS) resolution is designed, implemented and managed to protect the security of name / address resolution.", "justification": "Domain Name Service (DNS) Resolution (NET-13) provides overlapping security capability that compensates for the absence of Architecture & Provisioning for Name / Address Resolution Service (NET-13.1) by addressing related risk objectives through an alternative control mechanism aligned with Technology applicability. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "NET-13.2", "risk_if_not_implemented": "Without Secure Name / Address Resolution Service (Recursive or Caching Resolver), adversaries may move laterally, exfiltrate data or reach systems that should have been isolated from untrusted networks. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss of Data Integrity (R-IP-3), Loss of Authenticity / Provenance (R-IP-5), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9), Technical / Mechanical Failure (MT-10), Cryptographic Compromise / Cryptanalytic Capability Advancement (MT-31).", "compensating_control_1": { "control_id": "NET-13", "name": "Domain Name Service (DNS) Resolution", "description": "Mechanisms exist to ensure Domain Name Service (DNS) resolution is designed, implemented and managed to protect the security of name / address resolution.", "justification": "Domain Name Service (DNS) Resolution (NET-13) provides overlapping security capability that compensates for the absence of Secure Name / Address Resolution Service (Recursive or Caching Resolver) (NET-13.2) by addressing related risk objectives through an alternative control mechanism aligned with Technology applicability. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "NET-03", "name": "Boundary Protection", "description": "Mechanisms exist to monitor and control communications at the external network boundary and at key internal boundaries within the network.", "justification": "Boundary Protection (NET-03) provides network-level access restriction that compensates for the absence of Secure Name / Address Resolution Service (Recursive or Caching Resolver) (NET-13.2) by limiting attacker reach and lateral movement opportunities across the environment. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "NET-13.3", "risk_if_not_implemented": "Without Domain Registrar Security, adversaries may move laterally, exfiltrate data or reach systems that should have been isolated from untrusted networks. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Modification / Loss of System Integrity (R-AM-2), Business / Service Interruption (R-BC-1), Loss of Data / Service Availability (R-IP-4), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9).", "compensating_control_1": { "control_id": "NET-03", "name": "Boundary Protection", "description": "Mechanisms exist to monitor and control communications at the external network boundary and at key internal boundaries within the network.", "justification": "Boundary Protection (NET-03) provides network-level access restriction that compensates for the absence of Domain Registrar Security (NET-13.3) by limiting attacker reach and lateral movement opportunities across the environment. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "NET-13", "name": "Domain Name Service (DNS) Resolution", "description": "Mechanisms exist to ensure Domain Name Service (DNS) resolution is designed, implemented and managed to protect the security of name / address resolution.", "justification": "Domain Name Service (DNS) Resolution (NET-13) provides overlapping security capability that compensates for the absence of Domain Registrar Security (NET-13.3) by addressing related risk objectives through an alternative control mechanism aligned with Technology applicability. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "NET-14", "risk_if_not_implemented": "Without Zero Trust Architecture (ZTA), adversaries may move laterally, exfiltrate data or reach systems that should have been isolated from untrusted networks. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Access (R-AC-4), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "NET-03", "name": "Boundary Protection", "description": "Mechanisms exist to monitor and control communications at the external network boundary and at key internal boundaries within the network.", "justification": "Boundary Protection (NET-03) provides network-level access restriction that compensates for the absence of Zero Trust Architecture (ZTA) (NET-14) by limiting attacker reach and lateral movement opportunities across the environment. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "MON-02", "name": "Continuous Monitoring", "description": "Mechanisms exist to facilitate the implementation of enterprise-wide monitoring controls.", "justification": "Continuous Monitoring (MON-02) provides detective monitoring capability that compensates for the absence of Zero Trust Architecture (ZTA) (NET-14) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "NET-15", "risk_if_not_implemented": "Without Policy Decision Point (PDP), security, compliance and resilience activities may lack direction, ownership and executive support, leaving required controls unperformed. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Excessive or Unauthorized Privilege (R-AC-2), Unauthorized Access (R-AC-4), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9), Technical / Mechanical Failure (MT-10), Data Quality Degradation / Data Poisoning (MT-12).", "compensating_control_1": { "control_id": "NET-03", "name": "Boundary Protection", "description": "Mechanisms exist to monitor and control communications at the external network boundary and at key internal boundaries within the network.", "justification": "Boundary Protection (NET-03) provides network-level access restriction that compensates for the absence of Policy Decision Point (PDP) (NET-15) by limiting attacker reach and lateral movement opportunities across the environment. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "NET-04", "name": "Data Flow Enforcement – Access Control Lists (ACLs)", "description": "Mechanisms exist to implement and govern Access Control Lists (ACLs) to provide data flow enforcement that explicitly restrict network traffic to only what is authorized.", "justification": "Data Flow Enforcement – Access Control Lists (ACLs) (NET-04) provides access control enforcement that compensates for the absence of Policy Decision Point (PDP) (NET-15) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "NET-16", "risk_if_not_implemented": "Without Network Access Control (NAC), unauthorized individuals, devices or services may gain access to Technology Assets, Applications, Services, Data and/or Facilities (TAASDF). Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Access (R-AC-4), Undetected / Delayed Detection of Adverse Activity (R-SA-1), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "MON-02", "name": "Continuous Monitoring", "description": "Mechanisms exist to facilitate the implementation of enterprise-wide monitoring controls.", "justification": "Continuous Monitoring (MON-02) provides detective monitoring capability that compensates for the absence of Network Access Control (NAC) (NET-16) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "AST-04", "name": "Asset Inventories", "description": "Mechanisms exist to perform inventories of Technology Assets, Applications, Services and/or Data (TAASD) that:\n(1) Accurately reflects the current TAASD in use; \n(2) Identifies authorized software products, including business justification details;\n(3) Is at the level of granularity deemed necessary for tracking and reporting;\n(4) Includes organization-defined information deemed necessary to achieve effective property accountability; and\n(5) Is available for review and audit by designated organizational personnel.", "justification": "Asset Inventories (AST-04) provides overlapping security capability that compensates for the absence of Network Access Control (NAC) (NET-16) by addressing related risk objectives through an alternative control mechanism aligned with Technology applicability. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "NET-17", "risk_if_not_implemented": "Without DNS & Content Filtering, adversaries may move laterally, exfiltrate data or reach systems that should have been isolated from untrusted networks. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to System / Data Compromise (Technical Vector) (R-BC-4), System / Service Compromise (R-EX-7), Harm from Illegal, Abusive or Unsafe Content / Conduct (R-GV-8), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9), Technical / Mechanical Failure (MT-10), Data Quality Degradation / Data Poisoning (MT-12).", "compensating_control_1": { "control_id": "NET-03", "name": "Boundary Protection", "description": "Mechanisms exist to monitor and control communications at the external network boundary and at key internal boundaries within the network.", "justification": "Boundary Protection (NET-03) provides network-level access restriction that compensates for the absence of DNS & Content Filtering (NET-17) by limiting attacker reach and lateral movement opportunities across the environment. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "NET-40.2", "name": "Phishing & Spam Protection", "description": "Mechanisms exist to utilize anti-phishing and spam protection technologies to detect and take action on unsolicited messages transported by electronic mail.", "justification": "Phishing & Spam Protection (NET-40.2) provides overlapping security capability that compensates for the absence of DNS & Content Filtering (NET-17) by addressing related risk objectives through an alternative control mechanism aligned with Technology applicability. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "NET-18", "risk_if_not_implemented": "Without Authenticated Proxy, credentials may be phished, replayed, guessed or stolen, allowing unauthorized actors to authenticate as trusted identities. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss of Accountability / Attribution (R-AC-1), Unauthorized Access (R-AC-4), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "NET-03", "name": "Boundary Protection", "description": "Mechanisms exist to monitor and control communications at the external network boundary and at key internal boundaries within the network.", "justification": "Boundary Protection (NET-03) provides network-level access restriction that compensates for the absence of Authenticated Proxy (NET-18) by limiting attacker reach and lateral movement opportunities across the environment. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "NET-31", "name": "Network Intrusion Detection / Prevention Systems (NIDS / NIPS)", "description": "Mechanisms exist to employ Network Intrusion Detection / Prevention Systems (NIDS/NIPS) to detect and/or prevent intrusions into the network.", "justification": "Network Intrusion Detection / Prevention Systems (NIDS / NIPS) (NET-31) provides detective monitoring capability that compensates for the absence of Authenticated Proxy (NET-18) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "NET-18.1", "risk_if_not_implemented": "Without Route Internal Traffic to Proxy Servers, adversaries may move laterally, exfiltrate data or reach systems that should have been isolated from untrusted networks. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Undetected / Delayed Detection of Adverse Activity (R-SA-1), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "NET-40.2", "name": "Phishing & Spam Protection", "description": "Mechanisms exist to utilize anti-phishing and spam protection technologies to detect and take action on unsolicited messages transported by electronic mail.", "justification": "Phishing & Spam Protection (NET-40.2) provides overlapping security capability that compensates for the absence of Route Internal Traffic to Proxy Servers (NET-18.1) by addressing related risk objectives through an alternative control mechanism aligned with Technology applicability. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "NET-03", "name": "Boundary Protection", "description": "Mechanisms exist to monitor and control communications at the external network boundary and at key internal boundaries within the network.", "justification": "Boundary Protection (NET-03) provides network-level access restriction that compensates for the absence of Route Internal Traffic to Proxy Servers (NET-18.1) by limiting attacker reach and lateral movement opportunities across the environment. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "NET-18.2", "risk_if_not_implemented": "Without Route Privileged Network Access, users, services and processes may obtain or retain access beyond authorized need, enabling misuse or escalation. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss of Accountability / Attribution (R-AC-1), Unauthorized Access (R-AC-4), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "NET-40.2", "name": "Phishing & Spam Protection", "description": "Mechanisms exist to utilize anti-phishing and spam protection technologies to detect and take action on unsolicited messages transported by electronic mail.", "justification": "Phishing & Spam Protection (NET-40.2) provides overlapping security capability that compensates for the absence of Route Privileged Network Access (NET-18.2) by addressing related risk objectives through an alternative control mechanism aligned with Technology applicability. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "NET-17", "name": "DNS & Content Filtering", "description": "Mechanisms exist to force Internet-bound network traffic through a proxy device (e.g., Policy Enforcement Point (PEP)) for URL content filtering and DNS filtering to limit a user's ability to connect to dangerous or prohibited Internet sites.", "justification": "DNS & Content Filtering (NET-17) provides network-level access restriction that compensates for the absence of Route Privileged Network Access (NET-18.2) by limiting attacker reach and lateral movement opportunities across the environment. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "NET-19", "risk_if_not_implemented": "Without Application Proxy, adversaries may move laterally, exfiltrate data or reach systems that should have been isolated from untrusted networks. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Access (R-AC-4), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "MON-02", "name": "Continuous Monitoring", "description": "Mechanisms exist to facilitate the implementation of enterprise-wide monitoring controls.", "justification": "Continuous Monitoring (MON-02) provides detective monitoring capability that compensates for the absence of Application Proxy (NET-19) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "NET-03", "name": "Boundary Protection", "description": "Mechanisms exist to monitor and control communications at the external network boundary and at key internal boundaries within the network.", "justification": "Boundary Protection (NET-03) provides network-level access restriction that compensates for the absence of Application Proxy (NET-19) by limiting attacker reach and lateral movement opportunities across the environment. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "NET-20", "risk_if_not_implemented": "Without Visibility of Encrypted Communications, data in transit and at rest may be exposed through weak, misconfigured or compromised cryptographic protections. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Undetected / Delayed Detection of Adverse Activity (R-SA-1), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "NET-03", "name": "Boundary Protection", "description": "Mechanisms exist to monitor and control communications at the external network boundary and at key internal boundaries within the network.", "justification": "Boundary Protection (NET-03) provides network-level access restriction that compensates for the absence of Visibility of Encrypted Communications (NET-20) by limiting attacker reach and lateral movement opportunities across the environment. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "NET-17", "name": "DNS & Content Filtering", "description": "Mechanisms exist to force Internet-bound network traffic through a proxy device (e.g., Policy Enforcement Point (PEP)) for URL content filtering and DNS filtering to limit a user's ability to connect to dangerous or prohibited Internet sites.", "justification": "DNS & Content Filtering (NET-17) provides network-level access restriction that compensates for the absence of Visibility of Encrypted Communications (NET-20) by limiting attacker reach and lateral movement opportunities across the environment. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "NET-20.1", "risk_if_not_implemented": "Without Content Check for Encrypted Data, data in transit and at rest may be exposed through weak, misconfigured or compromised cryptographic protections. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Undetected / Delayed Detection of Adverse Activity (R-SA-1), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "NET-04", "name": "Data Flow Enforcement – Access Control Lists (ACLs)", "description": "Mechanisms exist to implement and govern Access Control Lists (ACLs) to provide data flow enforcement that explicitly restrict network traffic to only what is authorized.", "justification": "Data Flow Enforcement – Access Control Lists (ACLs) (NET-04) provides access control enforcement that compensates for the absence of Content Check for Encrypted Data (NET-20.1) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "NET-03", "name": "Boundary Protection", "description": "Mechanisms exist to monitor and control communications at the external network boundary and at key internal boundaries within the network.", "justification": "Boundary Protection (NET-03) provides network-level access restriction that compensates for the absence of Content Check for Encrypted Data (NET-20.1) by limiting attacker reach and lateral movement opportunities across the environment. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "NET-21", "risk_if_not_implemented": "Without Denial of Service (DoS) Protection, Technology Assets, Applications and/or Services (TAAS) may become unavailable, degraded or unable to meet demand when required. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Business / Service Interruption (R-BC-1), Loss of Data / Service Availability (R-IP-4), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "SEA-06", "name": "Defense-In-Depth (DiD) Architecture", "description": "Mechanisms exist to implement security functions as a layered structure minimizing interactions between layers of the design and avoiding any dependence by lower layers on the functionality or correctness of higher layers.", "justification": "Defense-In-Depth (DiD) Architecture (SEA-06) provides overlapping security capability that compensates for the absence of Denial of Service (DoS) Protection (NET-21) by addressing related risk objectives through an alternative control mechanism aligned with Technology applicability. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "NET-03", "name": "Boundary Protection", "description": "Mechanisms exist to monitor and control communications at the external network boundary and at key internal boundaries within the network.", "justification": "Boundary Protection (NET-03) provides network-level access restriction that compensates for the absence of Denial of Service (DoS) Protection (NET-21) by limiting attacker reach and lateral movement opportunities across the environment. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "NET-22", "risk_if_not_implemented": "Without Guest Networks, adversaries may move laterally, exfiltrate data or reach systems that should have been isolated from untrusted networks. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Access (R-AC-4), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "NET-03", "name": "Boundary Protection", "description": "Mechanisms exist to monitor and control communications at the external network boundary and at key internal boundaries within the network.", "justification": "Boundary Protection (NET-03) provides network-level access restriction that compensates for the absence of Guest Networks (NET-22) by limiting attacker reach and lateral movement opportunities across the environment. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "SEA-06", "name": "Defense-In-Depth (DiD) Architecture", "description": "Mechanisms exist to implement security functions as a layered structure minimizing interactions between layers of the design and avoiding any dependence by lower layers on the functionality or correctness of higher layers.", "justification": "Defense-In-Depth (DiD) Architecture (SEA-06) provides network-level access restriction that compensates for the absence of Guest Networks (NET-22) by limiting attacker reach and lateral movement opportunities across the environment. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "NET-23", "risk_if_not_implemented": "Without Intranets, adversaries may move laterally, exfiltrate data or reach systems that should have been isolated from untrusted networks. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Access (R-AC-4), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "NET-06", "name": "Network Segmentation (macrosegmentation)", "description": "Mechanisms exist to implement network segmentation within network architectures to isolate Technology Assets, Applications and/or Services (TAAS) from other network resources.", "justification": "Network Segmentation (macrosegmentation) (NET-06) provides network-level access restriction that compensates for the absence of Intranets (NET-23) by limiting attacker reach and lateral movement opportunities across the environment. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "IAC-25", "name": "Access Enforcement", "description": "Mechanisms exist to enforce Logical Access Control (LAC) permissions that conform to the principle of \"least privilege.\"", "justification": "Access Enforcement (IAC-25) provides access control enforcement that compensates for the absence of Intranets (NET-23) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "NET-24", "risk_if_not_implemented": "Without Wireless Networking, adversaries may move laterally, exfiltrate data or reach systems that should have been isolated from untrusted networks. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Access (R-AC-4), Undetected / Delayed Detection of Adverse Activity (R-SA-1), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "CFG-04.8", "name": "Wireless Access Authentication & Encryption", "description": "Mechanisms exist to protect the confidentiality and integrity of wireless networking technologies by implementing authentication and strong encryption.", "justification": "Wireless Access Authentication & Encryption (CFG-04.8) provides cryptographic protection that compensates for the absence of Wireless Networking (NET-24) by ensuring data confidentiality and integrity through alternative technical means. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "IAC-37", "name": "Multi-Factor Authentication (MFA)", "description": "Automated mechanisms exist to enforce Multi-Factor Authentication (MFA) for:\n(1) Remote network access; \n(2) Third-party Technology Assets, Applications and/or Services (TAAS); and/ or\n(3) Non-console access to critical TAAS that store, transmit and/or process sensitive and/or regulated data.", "justification": "Multi-Factor Authentication (MFA) (IAC-37) provides access control enforcement that compensates for the absence of Wireless Networking (NET-24) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "NET-24.1", "risk_if_not_implemented": "Without Wireless Networking Authentication & Encryption, data in transit and at rest may be exposed through weak, misconfigured or compromised cryptographic protections. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Access (R-AC-4), Identity Compromise / Impersonation (R-AC-5), Loss of Confidentiality (R-IP-2), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "CFG-04.8", "name": "Wireless Access Authentication & Encryption", "description": "Mechanisms exist to protect the confidentiality and integrity of wireless networking technologies by implementing authentication and strong encryption.", "justification": "Wireless Access Authentication & Encryption (CFG-04.8) provides cryptographic protection that compensates for the absence of Authentication & Encryption (NET-24.1) by ensuring data confidentiality and integrity through alternative technical means. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "NET-24", "name": "Wireless Networking", "description": "Mechanisms exist to control authorized wireless usage and monitor for unauthorized wireless access.", "justification": "Wireless Networking (NET-24) provides network-level access restriction that compensates for the absence of Authentication & Encryption (NET-24.1) by limiting attacker reach and lateral movement opportunities across the environment. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "NET-24.2", "risk_if_not_implemented": "Without Wireless Boundaries, adversaries may move laterally, exfiltrate data or reach systems that should have been isolated from untrusted networks. Based on the risk and threat mapping for this control, no risk is rated Likely; risks rated Possible include Unauthorized Access (R-AC-4), Identity Compromise / Impersonation (R-AC-5), Unauthorized Modification / Loss of System Integrity (R-AM-2), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "CFG-04.1", "name": "Account Lockout", "description": "Mechanisms exist to enforce a limit for consecutive invalid login attempts by a user during an organization-defined time period and automatically locks the account when the maximum number of unsuccessful attempts is exceeded.", "justification": "Account Lockout (CFG-04.1) provides access control enforcement that compensates for the absence of Wireless Boundaries (NET-24.2) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "NET-24", "name": "Wireless Networking", "description": "Mechanisms exist to control authorized wireless usage and monitor for unauthorized wireless access.", "justification": "Wireless Networking (NET-24) provides network-level access restriction that compensates for the absence of Wireless Boundaries (NET-24.2) by limiting attacker reach and lateral movement opportunities across the environment. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "NET-25", "risk_if_not_implemented": "Without Rogue Wireless Detection, malicious, anomalous or unauthorized activity may go undetected or be detected too late to prevent or limit harm. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Undetected / Delayed Detection of Adverse Activity (R-SA-1), and most likely increases susceptibility to natural threats NT-2, NT-3, NT-4, NT-5, NT-6, NT-8, NT-11, NT-12, NT-13, NT-14; Malicious Cyber Activity (MT-2), Human Error (MT-9), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "NET-24", "name": "Wireless Networking", "description": "Mechanisms exist to control authorized wireless usage and monitor for unauthorized wireless access.", "justification": "Wireless Networking (NET-24) provides network-level access restriction that compensates for the absence of Rogue Wireless Detection (NET-25) by limiting attacker reach and lateral movement opportunities across the environment. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "IAC-37", "name": "Multi-Factor Authentication (MFA)", "description": "Automated mechanisms exist to enforce Multi-Factor Authentication (MFA) for:\n(1) Remote network access; \n(2) Third-party Technology Assets, Applications and/or Services (TAAS); and/ or\n(3) Non-console access to critical TAAS that store, transmit and/or process sensitive and/or regulated data.", "justification": "Multi-Factor Authentication (MFA) (IAC-37) provides access control enforcement that compensates for the absence of Rogue Wireless Detection (NET-25) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "NET-26.1", "risk_if_not_implemented": "Without Remote Access Pathways, adversaries may move laterally, exfiltrate data or reach systems that should have been isolated from untrusted networks. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Access (R-AC-4), System / Data Compromise (Technical Vector) (R-BC-4), System / Service Compromise (R-EX-7), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "IAC-37", "name": "Multi-Factor Authentication (MFA)", "description": "Automated mechanisms exist to enforce Multi-Factor Authentication (MFA) for:\n(1) Remote network access; \n(2) Third-party Technology Assets, Applications and/or Services (TAAS); and/ or\n(3) Non-console access to critical TAAS that store, transmit and/or process sensitive and/or regulated data.", "justification": "Multi-Factor Authentication (MFA) (IAC-37) provides access control enforcement that compensates for the absence of Managed Access Control Points (NET-26.1) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "NET-26", "name": "Remote Access", "description": "Mechanisms exist to define, control and review organization-approved, secure remote access methods.", "justification": "Remote Access (NET-26) provides access control enforcement that compensates for the absence of Managed Access Control Points (NET-26.1) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "NET-26.2", "risk_if_not_implemented": "Without Expeditious Remote Access Disconnect / Disable Capability, adversaries may move laterally, exfiltrate data or reach systems that should have been isolated from untrusted networks. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Delayed Containment / Increased Incident Impact (R-IR-2), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "IAC-37", "name": "Multi-Factor Authentication (MFA)", "description": "Automated mechanisms exist to enforce Multi-Factor Authentication (MFA) for:\n(1) Remote network access; \n(2) Third-party Technology Assets, Applications and/or Services (TAAS); and/ or\n(3) Non-console access to critical TAAS that store, transmit and/or process sensitive and/or regulated data.", "justification": "Multi-Factor Authentication (MFA) (IAC-37) provides access control enforcement that compensates for the absence of Expeditious Disconnect / Disable Capability (NET-26.2) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "NET-26", "name": "Remote Access", "description": "Mechanisms exist to define, control and review organization-approved, secure remote access methods.", "justification": "Remote Access (NET-26) provides access control enforcement that compensates for the absence of Expeditious Disconnect / Disable Capability (NET-26.2) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "NET-26.3", "risk_if_not_implemented": "Without Remote Access Endpoint Security Validation, adversaries may move laterally, exfiltrate data or reach systems that should have been isolated from untrusted networks. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Exposure from Unaddressed Vulnerabilities (R-EX-6), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "CFG-04.7", "name": "Non-Console Administrative Access", "description": "Cryptographic mechanisms exist to protect the confidentiality and integrity of non-console administrative access.", "justification": "Non-Console Administrative Access (CFG-04.7) provides access control enforcement that compensates for the absence of Endpoint Security Validation (NET-26.3) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "NET-26", "name": "Remote Access", "description": "Mechanisms exist to define, control and review organization-approved, secure remote access methods.", "justification": "Remote Access (NET-26) provides access control enforcement that compensates for the absence of Endpoint Security Validation (NET-26.3) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "NET-26.4", "risk_if_not_implemented": "Without Remote Access Monitoring & Control, malicious, anomalous or unauthorized activity may go undetected or be detected too late to prevent or limit harm. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Undetected / Delayed Detection of Adverse Activity (R-SA-1), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "IAC-37", "name": "Multi-Factor Authentication (MFA)", "description": "Automated mechanisms exist to enforce Multi-Factor Authentication (MFA) for:\n(1) Remote network access; \n(2) Third-party Technology Assets, Applications and/or Services (TAAS); and/ or\n(3) Non-console access to critical TAAS that store, transmit and/or process sensitive and/or regulated data.", "justification": "Multi-Factor Authentication (MFA) (IAC-37) provides access control enforcement that compensates for the absence of Automated Monitoring & Control (NET-26.4) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CFG-04.7", "name": "Non-Console Administrative Access", "description": "Cryptographic mechanisms exist to protect the confidentiality and integrity of non-console administrative access.", "justification": "Non-Console Administrative Access (CFG-04.7) provides access control enforcement that compensates for the absence of Automated Monitoring & Control (NET-26.4) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "NET-26.5", "risk_if_not_implemented": "Without Remote Access Cryptographic Protections, data in transit and at rest may be exposed through weak, misconfigured or compromised cryptographic protections. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Long-Term Confidentiality Loss from Cryptographic Obsolescence (R-IP-1), Loss of Confidentiality (R-IP-2), Loss of Data Integrity (R-IP-3), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Technical / Mechanical Failure (MT-10), Harvest Now / Decrypt Later (HNDL) (MT-28), Cryptographic Compromise / Cryptanalytic Capability Advancement (MT-31).", "compensating_control_1": { "control_id": "NET-03", "name": "Boundary Protection", "description": "Mechanisms exist to monitor and control communications at the external network boundary and at key internal boundaries within the network.", "justification": "Boundary Protection (NET-03) provides network-level access restriction that compensates for the absence of Protection of Confidentiality / Integrity Using Encryption (NET-26.5) by limiting attacker reach and lateral movement opportunities across the environment. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "IAC-37", "name": "Multi-Factor Authentication (MFA)", "description": "Automated mechanisms exist to enforce Multi-Factor Authentication (MFA) for:\n(1) Remote network access; \n(2) Third-party Technology Assets, Applications and/or Services (TAAS); and/ or\n(3) Non-console access to critical TAAS that store, transmit and/or process sensitive and/or regulated data.", "justification": "Multi-Factor Authentication (MFA) (IAC-37) provides access control enforcement that compensates for the absence of Protection of Confidentiality / Integrity Using Encryption (NET-26.5) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "NET-26.6", "risk_if_not_implemented": "Without Remote Access Privileged Commands & Sensitive Data Access, users, services and processes may obtain or retain access beyond authorized need, enabling misuse or escalation. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Excessive or Unauthorized Privilege (R-AC-2), Unauthorized Access (R-AC-4), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Dysfunctional Management Practices (MT-8), Human Error (MT-9).", "compensating_control_1": { "control_id": "NET-03", "name": "Boundary Protection", "description": "Mechanisms exist to monitor and control communications at the external network boundary and at key internal boundaries within the network.", "justification": "Boundary Protection (NET-03) provides network-level access restriction that compensates for the absence of Remote Privileged Commands & Sensitive Data Access (NET-26.6) by limiting attacker reach and lateral movement opportunities across the environment. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "IAC-37", "name": "Multi-Factor Authentication (MFA)", "description": "Automated mechanisms exist to enforce Multi-Factor Authentication (MFA) for:\n(1) Remote network access; \n(2) Third-party Technology Assets, Applications and/or Services (TAAS); and/ or\n(3) Non-console access to critical TAAS that store, transmit and/or process sensitive and/or regulated data.", "justification": "Multi-Factor Authentication (MFA) (IAC-37) provides access control enforcement that compensates for the absence of Remote Privileged Commands & Sensitive Data Access (NET-26.6) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "NET-28", "risk_if_not_implemented": "Without Network Connection Termination, adversaries may move laterally, exfiltrate data or reach systems that should have been isolated from untrusted networks. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Access (R-AC-4), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "CFG-04.5", "name": "Session Termination", "description": "Automated mechanisms exist to log out users, both locally on the network and for remote sessions, at the end of the session or after an organization-defined period of inactivity.", "justification": "Session Termination (CFG-04.5) provides overlapping security capability that compensates for the absence of Network Connection Termination (NET-28) by addressing related risk objectives through an alternative control mechanism aligned with Technology applicability. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "NET-03", "name": "Boundary Protection", "description": "Mechanisms exist to monitor and control communications at the external network boundary and at key internal boundaries within the network.", "justification": "Boundary Protection (NET-03) provides network-level access restriction that compensates for the absence of Network Connection Termination (NET-28) by limiting attacker reach and lateral movement opportunities across the environment. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "NET-29", "risk_if_not_implemented": "Without Session Integrity, adversaries may move laterally, exfiltrate data or reach systems that should have been isolated from untrusted networks. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Identity Compromise / Impersonation (R-AC-5), Loss of Data Integrity (R-IP-3), Loss of Authenticity / Provenance (R-IP-5), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "CRY-06", "name": "Integrity of Data In Transit", "description": "Cryptographic mechanisms exist to detect unauthorized changes to data in transit.", "justification": "Integrity of Data In Transit (CRY-06) provides cryptographic protection that compensates for the absence of Session Integrity (NET-29) by ensuring data confidentiality and integrity through alternative technical means. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "MON-34", "name": "Non-Repudiation", "description": "Mechanisms exist to utilize a non-repudiation capability to protect against an individual falsely denying having performed a particular action.", "justification": "Non-Repudiation (MON-34) provides overlapping security capability that compensates for the absence of Session Integrity (NET-29) by addressing related risk objectives through an alternative control mechanism aligned with Technology applicability. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "NET-30", "risk_if_not_implemented": "Without Third-Party Remote Access Governance, supplier and External Service Provider (ESP) weaknesses, incidents or failures may propagate into the organization's environment unmanaged. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Access (R-AC-4), Uncontrolled Third-Party Security / Privacy Exposure (R-GV-5), Undetected / Delayed Detection of Adverse Activity (R-SA-1), Third-Party Cybersecurity Compromise / Exposure (R-SC-1), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9).", "compensating_control_1": { "control_id": "NET-26", "name": "Remote Access", "description": "Mechanisms exist to define, control and review organization-approved, secure remote access methods.", "justification": "Remote Access (NET-26) provides access control enforcement that compensates for the absence of Third-Party Remote Access Governance (NET-30) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "IAC-37", "name": "Multi-Factor Authentication (MFA)", "description": "Automated mechanisms exist to enforce Multi-Factor Authentication (MFA) for:\n(1) Remote network access; \n(2) Third-party Technology Assets, Applications and/or Services (TAAS); and/ or\n(3) Non-console access to critical TAAS that store, transmit and/or process sensitive and/or regulated data.", "justification": "Multi-Factor Authentication (MFA) (IAC-37) provides access control enforcement that compensates for the absence of Third-Party Remote Access Governance (NET-30) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "NET-31", "risk_if_not_implemented": "Without Network Intrusion Detection / Prevention Systems (NIDS / NIPS), malicious, anomalous or unauthorized activity may go undetected or be detected too late to prevent or limit harm. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to System / Data Compromise (Technical Vector) (R-BC-4), System / Service Compromise (R-EX-7), Undetected / Delayed Detection of Adverse Activity (R-SA-1), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9), Technical / Mechanical Failure (MT-10), Data Quality Degradation / Data Poisoning (MT-12).", "compensating_control_1": { "control_id": "MON-02", "name": "Continuous Monitoring", "description": "Mechanisms exist to facilitate the implementation of enterprise-wide monitoring controls.", "justification": "Continuous Monitoring (MON-02) provides detective monitoring capability that compensates for the absence of Network Intrusion Detection / Prevention Systems (NIDS / NIPS) (NET-31) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "NET-03", "name": "Boundary Protection", "description": "Mechanisms exist to monitor and control communications at the external network boundary and at key internal boundaries within the network.", "justification": "Boundary Protection (NET-03) provides network-level access restriction that compensates for the absence of Network Intrusion Detection / Prevention Systems (NIDS / NIPS) (NET-31) by limiting attacker reach and lateral movement opportunities across the environment. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "NET-32", "risk_if_not_implemented": "Without Wireless Intrusion Detection / Prevention Systems (WIDS / WIPS) Deployment, malicious, anomalous or unauthorized activity may go undetected or be detected too late to prevent or limit harm. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Access (R-AC-4), System / Data Compromise (Technical Vector) (R-BC-4), System / Service Compromise (R-EX-7), Undetected / Delayed Detection of Adverse Activity (R-SA-1), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "NET-03", "name": "Boundary Protection", "description": "Mechanisms exist to monitor and control communications at the external network boundary and at key internal boundaries within the network.", "justification": "Boundary Protection (NET-03) provides network-level access restriction that compensates for the absence of Wireless Intrusion Detection / Prevention Systems (WIDS / WIPS) Deployment (NET-32) by limiting attacker reach and lateral movement opportunities across the environment. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "NET-31", "name": "Network Intrusion Detection / Prevention Systems (NIDS / NIPS)", "description": "Mechanisms exist to employ Network Intrusion Detection / Prevention Systems (NIDS/NIPS) to detect and/or prevent intrusions into the network.", "justification": "Network Intrusion Detection / Prevention Systems (NIDS / NIPS) (NET-31) provides detective monitoring capability that compensates for the absence of Wireless Intrusion Detection / Prevention Systems (WIDS / WIPS) Deployment (NET-32) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "NET-33", "risk_if_not_implemented": "Without Demilitarized Zones (DMZ), adversaries may move laterally, exfiltrate data or reach systems that should have been isolated from untrusted networks. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Access (R-AC-4), System / Data Compromise (Technical Vector) (R-BC-4), System / Service Compromise (R-EX-7), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "NET-03", "name": "Boundary Protection", "description": "Mechanisms exist to monitor and control communications at the external network boundary and at key internal boundaries within the network.", "justification": "Boundary Protection (NET-03) provides network-level access restriction that compensates for the absence of Use of Demilitarized Zones (DMZ) (NET-33) by limiting attacker reach and lateral movement opportunities across the environment. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "NET-06", "name": "Network Segmentation (macrosegmentation)", "description": "Mechanisms exist to implement network segmentation within network architectures to isolate Technology Assets, Applications and/or Services (TAAS) from other network resources.", "justification": "Network Segmentation (macrosegmentation) (NET-06) provides network-level access restriction that compensates for the absence of Use of Demilitarized Zones (DMZ) (NET-33) by limiting attacker reach and lateral movement opportunities across the environment. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "NET-34", "risk_if_not_implemented": "Without Web Application Firewall (WAF), adversaries may move laterally, exfiltrate data or reach systems that should have been isolated from untrusted networks. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to System / Data Compromise (Technical Vector) (R-BC-4), System / Service Compromise (R-EX-7), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "NET-03", "name": "Boundary Protection", "description": "Mechanisms exist to monitor and control communications at the external network boundary and at key internal boundaries within the network.", "justification": "Boundary Protection (NET-03) provides network-level access restriction that compensates for the absence of Web Application Firewall (WAF) (NET-34) by limiting attacker reach and lateral movement opportunities across the environment. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "MON-02", "name": "Continuous Monitoring", "description": "Mechanisms exist to facilitate the implementation of enterprise-wide monitoring controls.", "justification": "Continuous Monitoring (MON-02) provides detective monitoring capability that compensates for the absence of Web Application Firewall (WAF) (NET-34) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "NET-35", "risk_if_not_implemented": "Without Application Programming Interface (API) Security, security, compliance and resilience activities may lack direction, ownership and executive support, leaving required controls unperformed. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Access (R-AC-4), System / Data Compromise (Technical Vector) (R-BC-4), System / Service Compromise (R-EX-7), Loss of Confidentiality (R-IP-2), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9).", "compensating_control_1": { "control_id": "IAC-25", "name": "Access Enforcement", "description": "Mechanisms exist to enforce Logical Access Control (LAC) permissions that conform to the principle of \"least privilege.\"", "justification": "Access Enforcement (IAC-25) provides access control enforcement that compensates for the absence of Application Programming Interface (API) Security (NET-35) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "MON-02", "name": "Continuous Monitoring", "description": "Mechanisms exist to facilitate the implementation of enterprise-wide monitoring controls.", "justification": "Continuous Monitoring (MON-02) provides detective monitoring capability that compensates for the absence of Application Programming Interface (API) Security (NET-35) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "NET-36", "risk_if_not_implemented": "Without API Gateway, adversaries may move laterally, exfiltrate data or reach systems that should have been isolated from untrusted networks. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Access (R-AC-4), System / Data Compromise (Technical Vector) (R-BC-4), System / Service Compromise (R-EX-7), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "IAC-30", "name": "Least Privilege", "description": "Mechanisms exist to utilize the concept of least privilege, allowing only authorized access to processes necessary to accomplish assigned tasks in accordance with organizational business functions.", "justification": "Least Privilege (IAC-30) provides access control enforcement that compensates for the absence of API Gateway (NET-36) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CRY-05", "name": "Encrypting Data In Transit", "description": "Cryptographic mechanisms exist to prevent the unauthorized disclosure of data in transit.", "justification": "Encrypting Data In Transit (CRY-05) provides cryptographic protection that compensates for the absence of API Gateway (NET-36) by ensuring data confidentiality and integrity through alternative technical means. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "NET-37", "risk_if_not_implemented": "Without Safeguarding Data Over Open Networks, adversaries may move laterally, exfiltrate data or reach systems that should have been isolated from untrusted networks. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to System / Data Compromise (Technical Vector) (R-BC-4), System / Service Compromise (R-EX-7), Long-Term Confidentiality Loss from Cryptographic Obsolescence (R-IP-1), Loss of Confidentiality (R-IP-2), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9), Harvest Now / Decrypt Later (HNDL) (MT-28), Cryptographic Compromise / Cryptanalytic Capability Advancement (MT-31).", "compensating_control_1": { "control_id": "CRY-05", "name": "Encrypting Data In Transit", "description": "Cryptographic mechanisms exist to prevent the unauthorized disclosure of data in transit.", "justification": "Encrypting Data In Transit (CRY-05) provides cryptographic protection that compensates for the absence of Safeguarding Data Over Open Networks (NET-37) by ensuring data confidentiality and integrity through alternative technical means. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "NET-03", "name": "Boundary Protection", "description": "Mechanisms exist to monitor and control communications at the external network boundary and at key internal boundaries within the network.", "justification": "Boundary Protection (NET-03) provides network-level access restriction that compensates for the absence of Safeguarding Data Over Open Networks (NET-37) by limiting attacker reach and lateral movement opportunities across the environment. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "NET-38", "risk_if_not_implemented": "Without Wireless Link Protection, adversaries may move laterally, exfiltrate data or reach systems that should have been isolated from untrusted networks. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Access (R-AC-4), System / Data Compromise (Technical Vector) (R-BC-4), System / Service Compromise (R-EX-7), Undetected / Delayed Detection of Adverse Activity (R-SA-1), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "CRY-05", "name": "Encrypting Data In Transit", "description": "Cryptographic mechanisms exist to prevent the unauthorized disclosure of data in transit.", "justification": "Encrypting Data In Transit (CRY-05) provides cryptographic protection that compensates for the absence of Wireless Link Protection (NET-38) by ensuring data confidentiality and integrity through alternative technical means. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "NET-03", "name": "Boundary Protection", "description": "Mechanisms exist to monitor and control communications at the external network boundary and at key internal boundaries within the network.", "justification": "Boundary Protection (NET-03) provides network-level access restriction that compensates for the absence of Wireless Link Protection (NET-38) by limiting attacker reach and lateral movement opportunities across the environment. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "NET-39", "risk_if_not_implemented": "Without Email Domain Reputation Protections, adversaries may move laterally, exfiltrate data or reach systems that should have been isolated from untrusted networks. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Reputational Harm / Loss of Stakeholder Trust (R-EX-4), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9).", "compensating_control_1": { "control_id": "CRY-05", "name": "Encrypting Data In Transit", "description": "Cryptographic mechanisms exist to prevent the unauthorized disclosure of data in transit.", "justification": "Encrypting Data In Transit (CRY-05) provides cryptographic protection that compensates for the absence of Email Domain Reputation Protections (NET-39) by ensuring data confidentiality and integrity through alternative technical means. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "NET-31", "name": "Network Intrusion Detection / Prevention Systems (NIDS / NIPS)", "description": "Mechanisms exist to employ Network Intrusion Detection / Prevention Systems (NIDS/NIPS) to detect and/or prevent intrusions into the network.", "justification": "Network Intrusion Detection / Prevention Systems (NIDS / NIPS) (NET-31) provides detective monitoring capability that compensates for the absence of Email Domain Reputation Protections (NET-39) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "NET-39.1", "risk_if_not_implemented": "Without Domain-Based Message Authentication Reporting and Conformance (DMARC), credentials may be phished, replayed, guessed or stolen, allowing unauthorized actors to authenticate as trusted identities. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Identity Compromise / Impersonation (R-AC-5), System / Data Compromise (Non-Technical Vector) (R-BC-5), Loss of Authenticity / Provenance (R-IP-5), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9).", "compensating_control_1": { "control_id": "NET-40.3", "name": "Email Content Protections", "description": "Mechanisms exist to implement an email filtering security service to detect malicious attachments in emails and prevent users from accessing them.", "justification": "Email Content Protections (NET-40.3) provides overlapping security capability that compensates for the absence of Domain-Based Message Authentication Reporting and Conformance (DMARC) (NET-39.1) by addressing related risk objectives through an alternative control mechanism aligned with Technology applicability. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "NET-40.2", "name": "Phishing & Spam Protection", "description": "Mechanisms exist to utilize anti-phishing and spam protection technologies to detect and take action on unsolicited messages transported by electronic mail.", "justification": "Phishing & Spam Protection (NET-40.2) provides overlapping security capability that compensates for the absence of Domain-Based Message Authentication Reporting and Conformance (DMARC) (NET-39.1) by addressing related risk objectives through an alternative control mechanism aligned with Technology applicability. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "NET-39.2", "risk_if_not_implemented": "Without Sender Policy Framework (SPF), security, compliance and resilience activities may lack direction, ownership and executive support, leaving required controls unperformed. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Identity Compromise / Impersonation (R-AC-5), Loss of Authenticity / Provenance (R-IP-5), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9).", "compensating_control_1": { "control_id": "CRY-05", "name": "Encrypting Data In Transit", "description": "Cryptographic mechanisms exist to prevent the unauthorized disclosure of data in transit.", "justification": "Encrypting Data In Transit (CRY-05) provides cryptographic protection that compensates for the absence of Sender Policy Framework (SPF) (NET-39.2) by ensuring data confidentiality and integrity through alternative technical means. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "NET-03", "name": "Boundary Protection", "description": "Mechanisms exist to monitor and control communications at the external network boundary and at key internal boundaries within the network.", "justification": "Boundary Protection (NET-03) provides network-level access restriction that compensates for the absence of Sender Policy Framework (SPF) (NET-39.2) by limiting attacker reach and lateral movement opportunities across the environment. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "NET-39.3", "risk_if_not_implemented": "Without Authenticated Received Chain (ARC), credentials may be phished, replayed, guessed or stolen, allowing unauthorized actors to authenticate as trusted identities. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss of Authenticity / Provenance (R-IP-5), and most likely increases susceptibility to Malicious Cyber Activity (MT-2).", "compensating_control_1": { "control_id": "CRY-05", "name": "Encrypting Data In Transit", "description": "Cryptographic mechanisms exist to prevent the unauthorized disclosure of data in transit.", "justification": "Encrypting Data In Transit (CRY-05) provides cryptographic protection that compensates for the absence of Authenticated Received Chain (ARC) (NET-39.3) by ensuring data confidentiality and integrity through alternative technical means. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "NET-40.3", "name": "Email Content Protections", "description": "Mechanisms exist to implement an email filtering security service to detect malicious attachments in emails and prevent users from accessing them.", "justification": "Email Content Protections (NET-40.3) provides overlapping security capability that compensates for the absence of Authenticated Received Chain (ARC) (NET-39.3) by addressing related risk objectives through an alternative control mechanism aligned with Technology applicability. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "NET-39.4", "risk_if_not_implemented": "Without Sender Denylisting, adversaries may move laterally, exfiltrate data or reach systems that should have been isolated from untrusted networks. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to System / Data Compromise (Non-Technical Vector) (R-BC-5), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9), Data Quality Degradation / Data Poisoning (MT-12).", "compensating_control_1": { "control_id": "NET-31", "name": "Network Intrusion Detection / Prevention Systems (NIDS / NIPS)", "description": "Mechanisms exist to employ Network Intrusion Detection / Prevention Systems (NIDS/NIPS) to detect and/or prevent intrusions into the network.", "justification": "Network Intrusion Detection / Prevention Systems (NIDS / NIPS) (NET-31) provides detective monitoring capability that compensates for the absence of Sender Denylisting (NET-39.4) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CRY-05", "name": "Encrypting Data In Transit", "description": "Cryptographic mechanisms exist to prevent the unauthorized disclosure of data in transit.", "justification": "Encrypting Data In Transit (CRY-05) provides cryptographic protection that compensates for the absence of Sender Denylisting (NET-39.4) by ensuring data confidentiality and integrity through alternative technical means. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "NET-40", "risk_if_not_implemented": "Without End-User Messaging Technologies, adversaries may move laterally, exfiltrate data or reach systems that should have been isolated from untrusted networks. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss of Confidentiality (R-IP-2), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "NET-03", "name": "Boundary Protection", "description": "Mechanisms exist to monitor and control communications at the external network boundary and at key internal boundaries within the network.", "justification": "Boundary Protection (NET-03) provides network-level access restriction that compensates for the absence of End-User Messaging Technologies (NET-40) by limiting attacker reach and lateral movement opportunities across the environment. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CFG-04.8", "name": "Wireless Access Authentication & Encryption", "description": "Mechanisms exist to protect the confidentiality and integrity of wireless networking technologies by implementing authentication and strong encryption.", "justification": "Wireless Access Authentication & Encryption (CFG-04.8) provides cryptographic protection that compensates for the absence of End-User Messaging Technologies (NET-40) by ensuring data confidentiality and integrity through alternative technical means. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "NET-40.4", "risk_if_not_implemented": "Without Adaptive Email Protections, adversaries may move laterally, exfiltrate data or reach systems that should have been isolated from untrusted networks. Based on the risk and threat mapping for this control, no risk is rated Likely; risks rated Possible include Identity Compromise / Impersonation (R-AC-5), System / Data Compromise (Technical Vector) (R-BC-4), System / Data Compromise (Non-Technical Vector) (R-BC-5), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Technical / Mechanical Failure (MT-10), Data Quality Degradation / Data Poisoning (MT-12).", "compensating_control_1": { "control_id": "CRY-05", "name": "Encrypting Data In Transit", "description": "Cryptographic mechanisms exist to prevent the unauthorized disclosure of data in transit.", "justification": "Encrypting Data In Transit (CRY-05) provides cryptographic protection that compensates for the absence of Adaptive Email Protections (NET-40.4) by ensuring data confidentiality and integrity through alternative technical means. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "NET-31", "name": "Network Intrusion Detection / Prevention Systems (NIDS / NIPS)", "description": "Mechanisms exist to employ Network Intrusion Detection / Prevention Systems (NIDS/NIPS) to detect and/or prevent intrusions into the network.", "justification": "Network Intrusion Detection / Prevention Systems (NIDS / NIPS) (NET-31) provides detective monitoring capability that compensates for the absence of Adaptive Email Protections (NET-40.4) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "NET-40.5", "risk_if_not_implemented": "Without Email Labeling, adversaries may move laterally, exfiltrate data or reach systems that should have been isolated from untrusted networks. Based on the risk and threat mapping for this control, no risk is rated Likely; risks rated Possible include Identity Compromise / Impersonation (R-AC-5), System / Data Compromise (Non-Technical Vector) (R-BC-5), Reputational Harm / Loss of Stakeholder Trust (R-EX-4), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "NET-31", "name": "Network Intrusion Detection / Prevention Systems (NIDS / NIPS)", "description": "Mechanisms exist to employ Network Intrusion Detection / Prevention Systems (NIDS/NIPS) to detect and/or prevent intrusions into the network.", "justification": "Network Intrusion Detection / Prevention Systems (NIDS / NIPS) (NET-31) provides detective monitoring capability that compensates for the absence of Email Labeling (NET-40.5) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "NET-40.3", "name": "Email Content Protections", "description": "Mechanisms exist to implement an email filtering security service to detect malicious attachments in emails and prevent users from accessing them.", "justification": "Email Content Protections (NET-40.3) provides overlapping security capability that compensates for the absence of Email Labeling (NET-40.5) by addressing related risk objectives through an alternative control mechanism aligned with Technology applicability. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "NET-40.6", "risk_if_not_implemented": "Without User Digital Signatures for Outgoing Email, adversaries may move laterally, exfiltrate data or reach systems that should have been isolated from untrusted networks. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Identity Compromise / Impersonation (R-AC-5), Loss of Authenticity / Provenance (R-IP-5), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9), Technical / Mechanical Failure (MT-10), Cryptographic Compromise / Cryptanalytic Capability Advancement (MT-31).", "compensating_control_1": { "control_id": "NET-40.2", "name": "Phishing & Spam Protection", "description": "Mechanisms exist to utilize anti-phishing and spam protection technologies to detect and take action on unsolicited messages transported by electronic mail.", "justification": "Phishing & Spam Protection (NET-40.2) provides overlapping security capability that compensates for the absence of User Digital Signatures for Outgoing Email (NET-40.6) by addressing related risk objectives through an alternative control mechanism aligned with Technology applicability. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "NET-40.3", "name": "Email Content Protections", "description": "Mechanisms exist to implement an email filtering security service to detect malicious attachments in emails and prevent users from accessing them.", "justification": "Email Content Protections (NET-40.3) provides overlapping security capability that compensates for the absence of User Digital Signatures for Outgoing Email (NET-40.6) by addressing related risk objectives through an alternative control mechanism aligned with Technology applicability. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "NET-40.7", "risk_if_not_implemented": "Without Encryption for Outgoing Email, data in transit and at rest may be exposed through weak, misconfigured or compromised cryptographic protections. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss of Confidentiality (R-IP-2), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Technical / Mechanical Failure (MT-10), Harvest Now / Decrypt Later (HNDL) (MT-28), Cryptographic Compromise / Cryptanalytic Capability Advancement (MT-31).", "compensating_control_1": { "control_id": "NET-40.3", "name": "Email Content Protections", "description": "Mechanisms exist to implement an email filtering security service to detect malicious attachments in emails and prevent users from accessing them.", "justification": "Email Content Protections (NET-40.3) provides overlapping security capability that compensates for the absence of Encryption for Outgoing Email (NET-40.7) by addressing related risk objectives through an alternative control mechanism aligned with Technology applicability. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CRY-05", "name": "Encrypting Data In Transit", "description": "Cryptographic mechanisms exist to prevent the unauthorized disclosure of data in transit.", "justification": "Encrypting Data In Transit (CRY-05) provides cryptographic protection that compensates for the absence of Encryption for Outgoing Email (NET-40.7) by ensuring data confidentiality and integrity through alternative technical means. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "NET-40.8", "risk_if_not_implemented": "Without User Threat Reporting, adversaries may move laterally, exfiltrate data or reach systems that should have been isolated from untrusted networks. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Undetected / Delayed Detection of Adverse Activity (R-SA-1), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9).", "compensating_control_1": { "control_id": "NET-40.3", "name": "Email Content Protections", "description": "Mechanisms exist to implement an email filtering security service to detect malicious attachments in emails and prevent users from accessing them.", "justification": "Email Content Protections (NET-40.3) provides overlapping security capability that compensates for the absence of User Threat Reporting (NET-40.8) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "NET-31", "name": "Network Intrusion Detection / Prevention Systems (NIDS / NIPS)", "description": "Mechanisms exist to employ Network Intrusion Detection / Prevention Systems (NIDS/NIPS) to detect and/or prevent intrusions into the network.", "justification": "Network Intrusion Detection / Prevention Systems (NIDS / NIPS) (NET-31) provides detective monitoring capability that compensates for the absence of User Threat Reporting (NET-40.8) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "NET-41", "risk_if_not_implemented": "Without Cross Domain Solution (CDS), adversaries may move laterally, exfiltrate data or reach systems that should have been isolated from untrusted networks. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Access (R-AC-4), Loss of Confidentiality (R-IP-2), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "END-03", "name": "Endpoint Protection Mechanisms", "description": "Mechanisms exist to protect the confidentiality, integrity, availability and safety of endpoint devices.", "justification": "Endpoint Protection Mechanisms (END-03) provides overlapping security capability that compensates for the absence of Cross Domain Solution (CDS) (NET-41) by addressing related risk objectives through an alternative control mechanism aligned with Technology applicability. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "NET-03", "name": "Boundary Protection", "description": "Mechanisms exist to monitor and control communications at the external network boundary and at key internal boundaries within the network.", "justification": "Boundary Protection (NET-03) provides network-level access restriction that compensates for the absence of Cross Domain Solution (CDS) (NET-41) by limiting attacker reach and lateral movement opportunities across the environment. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "NET-41.1", "risk_if_not_implemented": "Without Separate Subnet for Connecting to Different Security Domains, adversaries may move laterally, exfiltrate data or reach systems that should have been isolated from untrusted networks. Based on the risk and threat mapping for this control, no risk is rated Likely; risks rated Possible include Unauthorized Access (R-AC-4), Unauthorized Modification / Loss of System Integrity (R-AM-2), System / Data Compromise (Technical Vector) (R-BC-4), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "MON-02", "name": "Continuous Monitoring", "description": "Mechanisms exist to facilitate the implementation of enterprise-wide monitoring controls.", "justification": "Continuous Monitoring (MON-02) provides detective monitoring capability that compensates for the absence of Separate Subnet for Connecting to Different Security Domains (NET-41.1) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "NET-03", "name": "Boundary Protection", "description": "Mechanisms exist to monitor and control communications at the external network boundary and at key internal boundaries within the network.", "justification": "Boundary Protection (NET-03) provides network-level access restriction that compensates for the absence of Separate Subnet for Connecting to Different Security Domains (NET-41.1) by limiting attacker reach and lateral movement opportunities across the environment. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "NET-41.2", "risk_if_not_implemented": "Without Cross Domain Authentication, credentials may be phished, replayed, guessed or stolen, allowing unauthorized actors to authenticate as trusted identities. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Identity Compromise / Impersonation (R-AC-5), Loss of Authenticity / Provenance (R-IP-5), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "NET-04", "name": "Data Flow Enforcement – Access Control Lists (ACLs)", "description": "Mechanisms exist to implement and govern Access Control Lists (ACLs) to provide data flow enforcement that explicitly restrict network traffic to only what is authorized.", "justification": "Data Flow Enforcement – Access Control Lists (ACLs) (NET-04) provides access control enforcement that compensates for the absence of Cross Domain Authentication (NET-41.2) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "NET-03", "name": "Boundary Protection", "description": "Mechanisms exist to monitor and control communications at the external network boundary and at key internal boundaries within the network.", "justification": "Boundary Protection (NET-03) provides network-level access restriction that compensates for the absence of Cross Domain Authentication (NET-41.2) by limiting attacker reach and lateral movement opportunities across the environment. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "NET-41.3", "risk_if_not_implemented": "Without Data Type Identifiers, adversaries may move laterally, exfiltrate data or reach systems that should have been isolated from untrusted networks. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss of Confidentiality (R-IP-2), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9), Technical / Mechanical Failure (MT-10), Data Quality Degradation / Data Poisoning (MT-12).", "compensating_control_1": { "control_id": "MON-02", "name": "Continuous Monitoring", "description": "Mechanisms exist to facilitate the implementation of enterprise-wide monitoring controls.", "justification": "Continuous Monitoring (MON-02) provides detective monitoring capability that compensates for the absence of Data Type Identifiers (NET-41.3) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "NET-04", "name": "Data Flow Enforcement – Access Control Lists (ACLs)", "description": "Mechanisms exist to implement and govern Access Control Lists (ACLs) to provide data flow enforcement that explicitly restrict network traffic to only what is authorized.", "justification": "Data Flow Enforcement – Access Control Lists (ACLs) (NET-04) provides access control enforcement that compensates for the absence of Data Type Identifiers (NET-41.3) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "NET-41.4", "risk_if_not_implemented": "Without Decomposition Into Policy-Related Subcomponents, security, compliance and resilience activities may lack direction, ownership and executive support, leaving required controls unperformed. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss of Confidentiality (R-IP-2), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9), Technical / Mechanical Failure (MT-10), Data Quality Degradation / Data Poisoning (MT-12).", "compensating_control_1": { "control_id": "NET-04", "name": "Data Flow Enforcement – Access Control Lists (ACLs)", "description": "Mechanisms exist to implement and govern Access Control Lists (ACLs) to provide data flow enforcement that explicitly restrict network traffic to only what is authorized.", "justification": "Data Flow Enforcement – Access Control Lists (ACLs) (NET-04) provides access control enforcement that compensates for the absence of Decomposition Into Policy-Related Subcomponents (NET-41.4) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "NET-03", "name": "Boundary Protection", "description": "Mechanisms exist to monitor and control communications at the external network boundary and at key internal boundaries within the network.", "justification": "Boundary Protection (NET-03) provides network-level access restriction that compensates for the absence of Decomposition Into Policy-Related Subcomponents (NET-41.4) by limiting attacker reach and lateral movement opportunities across the environment. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "NET-41.5", "risk_if_not_implemented": "Without Detection of Unsanctioned Information, unapproved or ungoverned AI use may expose sensitive and/or regulated data and create unauthorized processing. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Access (R-AC-4), Undetected / Delayed Detection of Adverse Activity (R-SA-1), Loss of Confidentiality (R-IP-2), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9), Technical / Mechanical Failure (MT-10), Data Quality Degradation / Data Poisoning (MT-12).", "compensating_control_1": { "control_id": "NET-03", "name": "Boundary Protection", "description": "Mechanisms exist to monitor and control communications at the external network boundary and at key internal boundaries within the network.", "justification": "Boundary Protection (NET-03) provides network-level access restriction that compensates for the absence of Detection of Unsanctioned Information (NET-41.5) by limiting attacker reach and lateral movement opportunities across the environment. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "MON-02", "name": "Continuous Monitoring", "description": "Mechanisms exist to facilitate the implementation of enterprise-wide monitoring controls.", "justification": "Continuous Monitoring (MON-02) provides detective monitoring capability that compensates for the absence of Detection of Unsanctioned Information (NET-41.5) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "NET-42", "risk_if_not_implemented": "Without Cross Domain Content Transfer, adversaries may move laterally, exfiltrate data or reach systems that should have been isolated from untrusted networks. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Access (R-AC-4), Undetected / Delayed Detection of Adverse Activity (R-SA-1), Loss of Confidentiality (R-IP-2), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9), Technical / Mechanical Failure (MT-10), Data Quality Degradation / Data Poisoning (MT-12).", "compensating_control_1": { "control_id": "MON-02", "name": "Continuous Monitoring", "description": "Mechanisms exist to facilitate the implementation of enterprise-wide monitoring controls.", "justification": "Continuous Monitoring (MON-02) provides detective monitoring capability that compensates for the absence of Approved Solutions (NET-42) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "NET-04", "name": "Data Flow Enforcement – Access Control Lists (ACLs)", "description": "Mechanisms exist to implement and govern Access Control Lists (ACLs) to provide data flow enforcement that explicitly restrict network traffic to only what is authorized.", "justification": "Data Flow Enforcement – Access Control Lists (ACLs) (NET-04) provides access control enforcement that compensates for the absence of Approved Solutions (NET-42) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "NET-42.1", "risk_if_not_implemented": "Without Isolation of System Components, security may be bolted on rather than designed in, resulting in structural weaknesses that are costly to remediate and easy to exploit. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Access (R-AC-4), System / Service Compromise (R-EX-7), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "END-07", "name": "Software Firewall", "description": "Mechanisms exist to utilize host-based firewall software, or a similar technology, on all endpoint devices, where technically feasible.", "justification": "Software Firewall (END-07) provides network-level access restriction that compensates for the absence of Isolation of System Components (NET-42.1) by limiting attacker reach and lateral movement opportunities across the environment. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "NET-06", "name": "Network Segmentation (macrosegmentation)", "description": "Mechanisms exist to implement network segmentation within network architectures to isolate Technology Assets, Applications and/or Services (TAAS) from other network resources.", "justification": "Network Segmentation (macrosegmentation) (NET-06) provides network-level access restriction that compensates for the absence of Isolation of System Components (NET-42.1) by limiting attacker reach and lateral movement opportunities across the environment. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "NET-42.2", "risk_if_not_implemented": "Without Dynamic Isolation & Segregation (Sandboxing), security incidents may not be detected, contained, investigated or communicated in a timely manner, increasing their scope, duration and cost. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to System / Data Compromise (Technical Vector) (R-BC-4), System / Service Compromise (R-EX-7), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "NET-06", "name": "Network Segmentation (macrosegmentation)", "description": "Mechanisms exist to implement network segmentation within network architectures to isolate Technology Assets, Applications and/or Services (TAAS) from other network resources.", "justification": "Network Segmentation (macrosegmentation) (NET-06) provides network-level access restriction that compensates for the absence of Dynamic Isolation & Segregation (Sandboxing) (NET-42.2) by limiting attacker reach and lateral movement opportunities across the environment. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "NET-31", "name": "Network Intrusion Detection / Prevention Systems (NIDS / NIPS)", "description": "Mechanisms exist to employ Network Intrusion Detection / Prevention Systems (NIDS/NIPS) to detect and/or prevent intrusions into the network.", "justification": "Network Intrusion Detection / Prevention Systems (NIDS / NIPS) (NET-31) provides detective monitoring capability that compensates for the absence of Dynamic Isolation & Segregation (Sandboxing) (NET-42.2) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "NET-43", "risk_if_not_implemented": "Without Host Containment, adversaries may move laterally, exfiltrate data or reach systems that should have been isolated from untrusted networks. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to System / Data Compromise (Technical Vector) (R-BC-4), Delayed Containment / Increased Incident Impact (R-IR-2), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "MON-02", "name": "Continuous Monitoring", "description": "Mechanisms exist to facilitate the implementation of enterprise-wide monitoring controls.", "justification": "Continuous Monitoring (MON-02) provides detective monitoring capability that compensates for the absence of Host Containment (NET-43) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "NET-31", "name": "Network Intrusion Detection / Prevention Systems (NIDS / NIPS)", "description": "Mechanisms exist to employ Network Intrusion Detection / Prevention Systems (NIDS/NIPS) to detect and/or prevent intrusions into the network.", "justification": "Network Intrusion Detection / Prevention Systems (NIDS / NIPS) (NET-31) provides detective monitoring capability that compensates for the absence of Host Containment (NET-43) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "NET-44", "risk_if_not_implemented": "Without Resource Containment, adversaries may move laterally, exfiltrate data or reach systems that should have been isolated from untrusted networks. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to System / Data Compromise (Technical Vector) (R-BC-4), Delayed Containment / Increased Incident Impact (R-IR-2), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "NET-31", "name": "Network Intrusion Detection / Prevention Systems (NIDS / NIPS)", "description": "Mechanisms exist to employ Network Intrusion Detection / Prevention Systems (NIDS/NIPS) to detect and/or prevent intrusions into the network.", "justification": "Network Intrusion Detection / Prevention Systems (NIDS / NIPS) (NET-31) provides detective monitoring capability that compensates for the absence of Resource Containment (NET-44) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "NET-03", "name": "Boundary Protection", "description": "Mechanisms exist to monitor and control communications at the external network boundary and at key internal boundaries within the network.", "justification": "Boundary Protection (NET-03) provides network-level access restriction that compensates for the absence of Resource Containment (NET-44) by limiting attacker reach and lateral movement opportunities across the environment. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "NET-45", "risk_if_not_implemented": "Without Conceal / Randomize Communications, adversaries may move laterally, exfiltrate data or reach systems that should have been isolated from untrusted networks. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Long-Term Confidentiality Loss from Cryptographic Obsolescence (R-IP-1), Loss of Confidentiality (R-IP-2), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9), Technical / Mechanical Failure (MT-10), Harvest Now / Decrypt Later (HNDL) (MT-28), Cryptographic Compromise / Cryptanalytic Capability Advancement (MT-31).", "compensating_control_1": { "control_id": "CRY-10", "name": "Cryptographic Key Management", "description": "Mechanisms exist to facilitate cryptographic key management controls to protect the confidentiality, integrity and availability of keys.", "justification": "Cryptographic Key Management (CRY-10) provides cryptographic protection that compensates for the absence of Conceal / Randomize Communications (NET-45) by ensuring data confidentiality and integrity through alternative technical means. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CFG-04", "name": "Secure Baseline Configurations", "description": "Mechanisms exist to develop, document and maintain secure baseline configurations for Technology Assets, Applications and/or Services (TAAS) that are consistent with industry-accepted hardening standards.", "justification": "Secure Baseline Configurations (CFG-04) provides configuration hardening that compensates for the absence of Conceal / Randomize Communications (NET-45) by eliminating unnecessary services and enforcing secure settings to reduce inherent exposure. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "NET-45.1", "risk_if_not_implemented": "Without Object Security Attributes, adversaries may move laterally, exfiltrate data or reach systems that should have been isolated from untrusted networks. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Access (R-AC-4), Loss of Confidentiality (R-IP-2), Loss of Authenticity / Provenance (R-IP-5), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9), Technical / Mechanical Failure (MT-10), Data Quality Degradation / Data Poisoning (MT-12).", "compensating_control_1": { "control_id": "MON-02", "name": "Continuous Monitoring", "description": "Mechanisms exist to facilitate the implementation of enterprise-wide monitoring controls.", "justification": "Continuous Monitoring (MON-02) provides detective monitoring capability that compensates for the absence of Object Security Attributes (NET-45.1) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "NET-04", "name": "Data Flow Enforcement – Access Control Lists (ACLs)", "description": "Mechanisms exist to implement and govern Access Control Lists (ACLs) to provide data flow enforcement that explicitly restrict network traffic to only what is authorized.", "justification": "Data Flow Enforcement – Access Control Lists (ACLs) (NET-04) provides access control enforcement that compensates for the absence of Object Security Attributes (NET-45.1) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "NET-45.2", "risk_if_not_implemented": "Without Embedded Data Types, embedded and IoT technologies may operate with unknown, insecure or unmonitored configurations, creating exploitable footholds. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss of Confidentiality (R-IP-2), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9), Technical / Mechanical Failure (MT-10), Data Quality Degradation / Data Poisoning (MT-12).", "compensating_control_1": { "control_id": "NET-03", "name": "Boundary Protection", "description": "Mechanisms exist to monitor and control communications at the external network boundary and at key internal boundaries within the network.", "justification": "Boundary Protection (NET-03) provides network-level access restriction that compensates for the absence of Embedded Data Types (NET-45.2) by limiting attacker reach and lateral movement opportunities across the environment. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "MON-02", "name": "Continuous Monitoring", "description": "Mechanisms exist to facilitate the implementation of enterprise-wide monitoring controls.", "justification": "Continuous Monitoring (MON-02) provides detective monitoring capability that compensates for the absence of Embedded Data Types (NET-45.2) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "NET-46", "risk_if_not_implemented": "Without Metadata, adversaries may move laterally, exfiltrate data or reach systems that should have been isolated from untrusted networks. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Access (R-AC-4), Loss of Confidentiality (R-IP-2), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9), Technical / Mechanical Failure (MT-10), Data Quality Degradation / Data Poisoning (MT-12).", "compensating_control_1": { "control_id": "MON-02", "name": "Continuous Monitoring", "description": "Mechanisms exist to facilitate the implementation of enterprise-wide monitoring controls.", "justification": "Continuous Monitoring (MON-02) provides detective monitoring capability that compensates for the absence of Metadata (NET-46) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "NET-03", "name": "Boundary Protection", "description": "Mechanisms exist to monitor and control communications at the external network boundary and at key internal boundaries within the network.", "justification": "Boundary Protection (NET-03) provides network-level access restriction that compensates for the absence of Metadata (NET-46) by limiting attacker reach and lateral movement opportunities across the environment. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "NET-46.1", "risk_if_not_implemented": "Without Metadata Validation, adversaries may move laterally, exfiltrate data or reach systems that should have been isolated from untrusted networks. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to System / Data Compromise (Technical Vector) (R-BC-4), Loss of Confidentiality (R-IP-2), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "NET-03", "name": "Boundary Protection", "description": "Mechanisms exist to monitor and control communications at the external network boundary and at key internal boundaries within the network.", "justification": "Boundary Protection (NET-03) provides network-level access restriction that compensates for the absence of Metadata Validation (NET-46.1) by limiting attacker reach and lateral movement opportunities across the environment. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "NET-04", "name": "Data Flow Enforcement – Access Control Lists (ACLs)", "description": "Mechanisms exist to implement and govern Access Control Lists (ACLs) to provide data flow enforcement that explicitly restrict network traffic to only what is authorized.", "justification": "Data Flow Enforcement – Access Control Lists (ACLs) (NET-04) provides access control enforcement that compensates for the absence of Metadata Validation (NET-46.1) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "NET-47", "risk_if_not_implemented": "Without Side Channel Attack Prevention, adversaries may move laterally, exfiltrate data or reach systems that should have been isolated from untrusted networks. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Access (R-AC-4), System / Data Compromise (Technical Vector) (R-BC-4), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "NET-06", "name": "Network Segmentation (macrosegmentation)", "description": "Mechanisms exist to implement network segmentation within network architectures to isolate Technology Assets, Applications and/or Services (TAAS) from other network resources.", "justification": "Network Segmentation (macrosegmentation) (NET-06) provides network-level access restriction that compensates for the absence of Side Channel Attack Prevention (NET-47) by limiting attacker reach and lateral movement opportunities across the environment. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "SEA-05", "name": "Secure Engineering Principles", "description": "Mechanisms exist to facilitate the implementation of industry-recognized security, compliance and resilience practices in the specification, design, development, implementation and modification of Technology Assets, Applications and/or Services (TAAS).", "justification": "Secure Engineering Principles (SEA-05) provides overlapping security capability that compensates for the absence of Side Channel Attack Prevention (NET-47) by addressing related risk objectives through an alternative control mechanism aligned with Technology applicability. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "PES-02", "risk_if_not_implemented": "Without Physical & Environmental Protections, unauthorized individuals may gain physical access to facilities and equipment, enabling theft, tampering, damage or safety incidents. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unperformed / Unowned Control Responsibilities (R-GV-3), Uncontrolled Internal Security / Privacy Exposure (R-GV-4), and most likely increases susceptibility to natural threats NT-2, NT-3, NT-4, NT-5, NT-6, NT-8, NT-11, NT-12, NT-13, NT-14; man-made threats MT-1, MT-3, MT-4, MT-5, MT-6, MT-7, MT-9, MT-10, MT-14, MT-21, MT-27.", "compensating_control_1": { "control_id": "PES-08", "name": "Physical Access Control", "description": "Physical access control mechanisms exist to enforce physical access authorizations for all physical access points (including designated entry/exit points) to facilities (excluding those areas within the facility officially designated as publicly accessible).", "justification": "Physical Access Control (PES-08) provides access control enforcement that compensates for the absence of Physical & Environmental Protections (PES-02) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "MON-02", "name": "Continuous Monitoring", "description": "Mechanisms exist to facilitate the implementation of enterprise-wide monitoring controls.", "justification": "Continuous Monitoring (MON-02) provides detective monitoring capability that compensates for the absence of Physical & Environmental Protections (PES-02) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "PES-03", "risk_if_not_implemented": "Without Physical Security Plan (PSP), unauthorized individuals may gain physical access to facilities and equipment, enabling theft, tampering, damage or safety incidents. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unaddressed Security / Compliance Exposure (R-GV-2), Inability to Demonstrate Due Diligence / Due Care (R-GV-9), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9).", "compensating_control_1": { "control_id": "PES-13", "name": "Monitoring Physical Access", "description": "Physical access control mechanisms exist to monitor for, detect and respond to physical security incidents.", "justification": "Monitoring Physical Access (PES-13) provides detective monitoring capability that compensates for the absence of Physical Security Plan (PSP) (PES-03) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "MON-02", "name": "Continuous Monitoring", "description": "Mechanisms exist to facilitate the implementation of enterprise-wide monitoring controls.", "justification": "Continuous Monitoring (MON-02) provides detective monitoring capability that compensates for the absence of Physical Security Plan (PSP) (PES-03) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "PES-04", "risk_if_not_implemented": "Without Zone-Based Physical Security, unauthorized individuals may gain physical access to facilities and equipment, enabling theft, tampering, damage or safety incidents. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Access (R-AC-4), and most likely increases susceptibility to natural threats NT-2, NT-3, NT-4, NT-5, NT-6, NT-8, NT-11, NT-12, NT-13, NT-14; man-made threats MT-1, MT-3, MT-4, MT-5, MT-6, MT-7, MT-9, MT-10, MT-14, MT-27.", "compensating_control_1": { "control_id": "PES-08", "name": "Physical Access Control", "description": "Physical access control mechanisms exist to enforce physical access authorizations for all physical access points (including designated entry/exit points) to facilities (excluding those areas within the facility officially designated as publicly accessible).", "justification": "Physical Access Control (PES-08) provides access control enforcement that compensates for the absence of Zone-Based Physical Security (PES-04) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "PES-13", "name": "Monitoring Physical Access", "description": "Physical access control mechanisms exist to monitor for, detect and respond to physical security incidents.", "justification": "Monitoring Physical Access (PES-13) provides detective monitoring capability that compensates for the absence of Zone-Based Physical Security (PES-04) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "PES-05", "risk_if_not_implemented": "Without Alternate Work Site, unauthorized individuals may gain physical access to facilities and equipment, enabling theft, tampering, damage or safety incidents. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Access (R-AC-4), Loss, Theft or Damage of Assets (R-AM-1), and most likely increases susceptibility to Pandemic (Disease) Outbreaks (NT-7); Physical Crime (MT-5), Human Error (MT-9).", "compensating_control_1": { "control_id": "NET-26", "name": "Remote Access", "description": "Mechanisms exist to define, control and review organization-approved, secure remote access methods.", "justification": "Remote Access (NET-26) provides access control enforcement that compensates for the absence of Alternate Work Site (PES-05) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the facility and physical environment focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "PES-02", "name": "Physical & Environmental Protections", "description": "Mechanisms exist to facilitate the operation of physical and environmental protection controls.", "justification": "Physical & Environmental Protections (PES-02) provides physical access control that compensates for the absence of Alternate Work Site (PES-05) by preventing unauthorized physical interaction with systems and infrastructure. Given the facility and physical environment focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "PES-06", "risk_if_not_implemented": "Without Physical Access Authorizations, unauthorized individuals may gain physical access to facilities and equipment, enabling theft, tampering, damage or safety incidents. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Excessive or Unauthorized Privilege (R-AC-2), Unauthorized Access (R-AC-4), and most likely increases susceptibility to Human Error (MT-9), Data Quality Degradation / Data Poisoning (MT-12).", "compensating_control_1": { "control_id": "IAC-25", "name": "Access Enforcement", "description": "Mechanisms exist to enforce Logical Access Control (LAC) permissions that conform to the principle of \"least privilege.\"", "justification": "Access Enforcement (IAC-25) provides access control enforcement that compensates for the absence of Physical Access Authorizations (PES-06) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "PES-13", "name": "Monitoring Physical Access", "description": "Physical access control mechanisms exist to monitor for, detect and respond to physical security incidents.", "justification": "Monitoring Physical Access (PES-13) provides detective monitoring capability that compensates for the absence of Physical Access Authorizations (PES-06) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "PES-07", "risk_if_not_implemented": "Without Role-Based Physical Access, users, services and processes may obtain or retain access beyond authorized need, enabling misuse or escalation. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Excessive or Unauthorized Privilege (R-AC-2), Unauthorized Access (R-AC-4), and most likely increases susceptibility to Human Error (MT-9).", "compensating_control_1": { "control_id": "PES-13", "name": "Monitoring Physical Access", "description": "Physical access control mechanisms exist to monitor for, detect and respond to physical security incidents.", "justification": "Monitoring Physical Access (PES-13) provides detective monitoring capability that compensates for the absence of Role-Based Physical Access (PES-07) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the facility and physical environment focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "IAC-25", "name": "Access Enforcement", "description": "Mechanisms exist to enforce Logical Access Control (LAC) permissions that conform to the principle of \"least privilege.\"", "justification": "Access Enforcement (IAC-25) provides access control enforcement that compensates for the absence of Role-Based Physical Access (PES-07) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the facility and physical environment focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "PES-07.1", "risk_if_not_implemented": "Without Dual Authorization for Physical Access, users, services and processes may obtain or retain access beyond authorized need, enabling misuse or escalation. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Access (R-AC-4), and most likely increases susceptibility to natural threats NT-2, NT-3, NT-4, NT-5, NT-6, NT-7, NT-8, NT-11, NT-12, NT-13, NT-14; man-made threats MT-1, MT-3, MT-4, MT-5, MT-6, MT-7, MT-9, MT-10, MT-14, MT-15, MT-25, MT-27.", "compensating_control_1": { "control_id": "IAC-25", "name": "Access Enforcement", "description": "Mechanisms exist to enforce Logical Access Control (LAC) permissions that conform to the principle of \"least privilege.\"", "justification": "Access Enforcement (IAC-25) provides access control enforcement that compensates for the absence of Dual Authorization for Physical Access (PES-07.1) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "PES-06", "name": "Physical Access Authorizations", "description": "Physical access control mechanisms exist to maintain a current list of personnel with authorized access to organizational facilities (except for those areas within the facility officially designated as publicly accessible).", "justification": "Physical Access Authorizations (PES-06) provides access control enforcement that compensates for the absence of Dual Authorization for Physical Access (PES-07.1) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "PES-08.1", "risk_if_not_implemented": "Without Physical Access Device Inventories, unauthorized individuals may gain physical access to facilities and equipment, enabling theft, tampering, damage or safety incidents. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss of Accountability / Attribution (R-AC-1), Loss, Theft or Damage of Assets (R-AM-1), and most likely increases susceptibility to Human Error (MT-9), Data Quality Degradation / Data Poisoning (MT-12).", "compensating_control_1": { "control_id": "AST-04", "name": "Asset Inventories", "description": "Mechanisms exist to perform inventories of Technology Assets, Applications, Services and/or Data (TAASD) that:\n(1) Accurately reflects the current TAASD in use; \n(2) Identifies authorized software products, including business justification details;\n(3) Is at the level of granularity deemed necessary for tracking and reporting;\n(4) Includes organization-defined information deemed necessary to achieve effective property accountability; and\n(5) Is available for review and audit by designated organizational personnel.", "justification": "Asset Inventories (AST-04) provides overlapping security capability that compensates for the absence of Physical Access Device Inventories (PES-08.1) by addressing related risk objectives through an alternative control mechanism aligned with Facility applicability. Given the facility and physical environment focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "MON-02", "name": "Continuous Monitoring", "description": "Mechanisms exist to facilitate the implementation of enterprise-wide monitoring controls.", "justification": "Continuous Monitoring (MON-02) provides detective monitoring capability that compensates for the absence of Physical Access Device Inventories (PES-08.1) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the facility and physical environment focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "PES-09", "risk_if_not_implemented": "Without Controlled Ingress & Egress Points, unauthorized individuals may gain physical access to facilities and equipment, enabling theft, tampering, damage or safety incidents. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Access (R-AC-4), Loss, Theft or Damage of Assets (R-AM-1), Undetected / Delayed Detection of Adverse Activity (R-SA-1), and most likely increases susceptibility to natural threats NT-2, NT-3, NT-4, NT-5, NT-6, NT-8, NT-11, NT-12, NT-13, NT-14; man-made threats MT-3, MT-4, MT-5, MT-6, MT-7, MT-9, MT-10, MT-14.", "compensating_control_1": { "control_id": "PES-13", "name": "Monitoring Physical Access", "description": "Physical access control mechanisms exist to monitor for, detect and respond to physical security incidents.", "justification": "Monitoring Physical Access (PES-13) provides detective monitoring capability that compensates for the absence of Controlled Ingress & Egress Points (PES-09) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the facility and physical environment focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "MON-18.1", "name": "Session Audit", "description": "Mechanisms exist to provide session audit capabilities that can: \n(1) Capture and log all content related to a user session; and\n(2) Remotely view all content related to an established user session in real time.", "justification": "Session Audit (MON-18.1) provides detective monitoring capability that compensates for the absence of Controlled Ingress & Egress Points (PES-09) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the facility and physical environment focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "PES-09.1", "risk_if_not_implemented": "Without Physical Access Logs, malicious, anomalous or unauthorized activity may go undetected or be detected too late to prevent or limit harm. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss of Accountability / Attribution (R-AC-1), Loss of Investigative / Evidentiary Capability (R-IR-1), Undetected / Delayed Detection of Adverse Activity (R-SA-1), and most likely increases susceptibility to natural threats NT-2, NT-3, NT-4, NT-5, NT-6, NT-8, NT-11, NT-12, NT-13, NT-14; man-made threats MT-3, MT-4, MT-6, MT-7, MT-9, MT-10, MT-12, MT-14.", "compensating_control_1": { "control_id": "MON-02", "name": "Continuous Monitoring", "description": "Mechanisms exist to facilitate the implementation of enterprise-wide monitoring controls.", "justification": "Continuous Monitoring (MON-02) provides detective monitoring capability that compensates for the absence of Physical Access Logs (PES-09.1) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the facility and physical environment focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "PES-13", "name": "Monitoring Physical Access", "description": "Physical access control mechanisms exist to monitor for, detect and respond to physical security incidents.", "justification": "Monitoring Physical Access (PES-13) provides detective monitoring capability that compensates for the absence of Physical Access Logs (PES-09.1) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the facility and physical environment focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "PES-09.2", "risk_if_not_implemented": "Without Personnel Searches, unauthorized individuals may gain physical access to facilities and equipment, enabling theft, tampering, damage or safety incidents. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss, Theft or Damage of Assets (R-AM-1), System / Data Compromise (Non-Technical Vector) (R-BC-5), Intellectual Property / Trade Secret Loss (R-EX-9), Loss of Confidentiality (R-IP-2), and most likely increases susceptibility to natural threats NT-2, NT-3, NT-4, NT-5, NT-6, NT-7, NT-8, NT-11, NT-12, NT-13, NT-14; man-made threats MT-3, MT-4, MT-5, MT-6, MT-8, MT-9, MT-14, MT-25.", "compensating_control_1": { "control_id": "PES-10", "name": "Physical Security of Offices, Rooms & Facilities", "description": "Mechanisms exist to identify systems, equipment and respective operating environments that require limited physical access so that appropriate physical access controls are designed and implemented for offices, rooms and facilities.", "justification": "Physical Security of Offices, Rooms & Facilities (PES-10) provides physical access control that compensates for the absence of Searches (PES-09.2) by preventing unauthorized physical interaction with systems and infrastructure. Given the people-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "PES-08", "name": "Physical Access Control", "description": "Physical access control mechanisms exist to enforce physical access authorizations for all physical access points (including designated entry/exit points) to facilities (excluding those areas within the facility officially designated as publicly accessible).", "justification": "Physical Access Control (PES-08) provides access control enforcement that compensates for the absence of Searches (PES-09.2) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the people-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "PES-11.1", "risk_if_not_implemented": "Without On-Site Client Segregation, unauthorized individuals may gain physical access to facilities and equipment, enabling theft, tampering, damage or safety incidents. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Access (R-AC-4), Loss of Confidentiality (R-IP-2), and most likely increases susceptibility to Human Error (MT-9).", "compensating_control_1": { "control_id": "PES-08", "name": "Physical Access Control", "description": "Physical access control mechanisms exist to enforce physical access authorizations for all physical access points (including designated entry/exit points) to facilities (excluding those areas within the facility officially designated as publicly accessible).", "justification": "Physical Access Control (PES-08) provides access control enforcement that compensates for the absence of On-Site Client Segregation (PES-11.1) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the facility and physical environment focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "NET-06", "name": "Network Segmentation (macrosegmentation)", "description": "Mechanisms exist to implement network segmentation within network architectures to isolate Technology Assets, Applications and/or Services (TAAS) from other network resources.", "justification": "Network Segmentation (macrosegmentation) (NET-06) provides network-level access restriction that compensates for the absence of On-Site Client Segregation (PES-11.1) by limiting attacker reach and lateral movement opportunities across the environment. Given the facility and physical environment focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "PES-12", "risk_if_not_implemented": "Without Access To Critical Systems, unauthorized individuals may gain physical access to facilities and equipment, enabling theft, tampering, damage or safety incidents. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Access (R-AC-4), Loss, Theft or Damage of Assets (R-AM-1), Loss of Confidentiality (R-IP-2), and most likely increases susceptibility to natural threats NT-2, NT-3, NT-4, NT-5, NT-6, NT-8, NT-11, NT-12, NT-13, NT-14; man-made threats MT-3, MT-4, MT-5, MT-6, MT-7, MT-9, MT-10, MT-14.", "compensating_control_1": { "control_id": "PES-08", "name": "Physical Access Control", "description": "Physical access control mechanisms exist to enforce physical access authorizations for all physical access points (including designated entry/exit points) to facilities (excluding those areas within the facility officially designated as publicly accessible).", "justification": "Physical Access Control (PES-08) provides access control enforcement that compensates for the absence of Access To Critical Systems (PES-12) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the facility and physical environment focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "PES-13", "name": "Monitoring Physical Access", "description": "Physical access control mechanisms exist to monitor for, detect and respond to physical security incidents.", "justification": "Monitoring Physical Access (PES-13) provides detective monitoring capability that compensates for the absence of Access To Critical Systems (PES-12) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the facility and physical environment focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "PES-12.1", "risk_if_not_implemented": "Without Lockable Physical Casings, unauthorized individuals may gain physical access to facilities and equipment, enabling theft, tampering, damage or safety incidents. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Access (R-AC-4), Loss, Theft or Damage of Assets (R-AM-1), Unauthorized Modification / Loss of System Integrity (R-AM-2), and most likely increases susceptibility to natural threats NT-2, NT-3, NT-4, NT-5, NT-6, NT-8, NT-11, NT-12, NT-13, NT-14; man-made threats MT-3, MT-4, MT-5, MT-6, MT-9, MT-10, MT-14.", "compensating_control_1": { "control_id": "PES-13", "name": "Monitoring Physical Access", "description": "Physical access control mechanisms exist to monitor for, detect and respond to physical security incidents.", "justification": "Monitoring Physical Access (PES-13) provides detective monitoring capability that compensates for the absence of Lockable Physical Casings (PES-12.1) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the facility and physical environment focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "PES-08", "name": "Physical Access Control", "description": "Physical access control mechanisms exist to enforce physical access authorizations for all physical access points (including designated entry/exit points) to facilities (excluding those areas within the facility officially designated as publicly accessible).", "justification": "Physical Access Control (PES-08) provides access control enforcement that compensates for the absence of Lockable Physical Casings (PES-12.1) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the facility and physical environment focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "PES-13", "risk_if_not_implemented": "Without Monitoring Physical Access, malicious, anomalous or unauthorized activity may go undetected or be detected too late to prevent or limit harm. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Delayed Containment / Increased Incident Impact (R-IR-2), Undetected / Delayed Detection of Adverse Activity (R-SA-1), and most likely increases susceptibility to natural threats NT-2, NT-3, NT-4, NT-5, NT-6, NT-7, NT-8, NT-11, NT-12, NT-13, NT-14; man-made threats MT-3, MT-4, MT-5, MT-6, MT-7, MT-9, MT-10, MT-14, MT-25.", "compensating_control_1": { "control_id": "MON-02", "name": "Continuous Monitoring", "description": "Mechanisms exist to facilitate the implementation of enterprise-wide monitoring controls.", "justification": "Continuous Monitoring (MON-02) provides detective monitoring capability that compensates for the absence of Monitoring Physical Access (PES-13) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "PES-06", "name": "Physical Access Authorizations", "description": "Physical access control mechanisms exist to maintain a current list of personnel with authorized access to organizational facilities (except for those areas within the facility officially designated as publicly accessible).", "justification": "Physical Access Authorizations (PES-06) provides access control enforcement that compensates for the absence of Monitoring Physical Access (PES-13) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "PES-13.1", "risk_if_not_implemented": "Without Intrusion Alarms / Surveillance Equipment, malicious, anomalous or unauthorized activity may go undetected or be detected too late to prevent or limit harm. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Undetected / Delayed Detection of Adverse Activity (R-SA-1), and most likely increases susceptibility to natural threats NT-2, NT-3, NT-4, NT-5, NT-6, NT-7, NT-8, NT-11, NT-12, NT-13, NT-14; man-made threats MT-3, MT-4, MT-5, MT-6, MT-7, MT-9, MT-10, MT-14, MT-25.", "compensating_control_1": { "control_id": "PES-06", "name": "Physical Access Authorizations", "description": "Physical access control mechanisms exist to maintain a current list of personnel with authorized access to organizational facilities (except for those areas within the facility officially designated as publicly accessible).", "justification": "Physical Access Authorizations (PES-06) provides access control enforcement that compensates for the absence of Intrusion Alarms / Surveillance Equipment (PES-13.1) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the facility and physical environment focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "MON-02", "name": "Continuous Monitoring", "description": "Mechanisms exist to facilitate the implementation of enterprise-wide monitoring controls.", "justification": "Continuous Monitoring (MON-02) provides detective monitoring capability that compensates for the absence of Intrusion Alarms / Surveillance Equipment (PES-13.1) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the facility and physical environment focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "PES-13.2", "risk_if_not_implemented": "Without Monitoring Physical Access To Critical Systems, malicious, anomalous or unauthorized activity may go undetected or be detected too late to prevent or limit harm. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Undetected / Delayed Detection of Adverse Activity (R-SA-1), and most likely increases susceptibility to natural threats NT-2, NT-3, NT-4, NT-5, NT-6, NT-7, NT-8, NT-11, NT-12, NT-13, NT-14; man-made threats MT-3, MT-4, MT-5, MT-6, MT-7, MT-9, MT-10, MT-14, MT-25.", "compensating_control_1": { "control_id": "MON-02", "name": "Continuous Monitoring", "description": "Mechanisms exist to facilitate the implementation of enterprise-wide monitoring controls.", "justification": "Continuous Monitoring (MON-02) provides detective monitoring capability that compensates for the absence of Monitoring Physical Access To Critical Systems (PES-13.2) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "PES-13", "name": "Monitoring Physical Access", "description": "Physical access control mechanisms exist to monitor for, detect and respond to physical security incidents.", "justification": "Monitoring Physical Access (PES-13) provides detective monitoring capability that compensates for the absence of Monitoring Physical Access To Critical Systems (PES-13.2) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "PES-14", "risk_if_not_implemented": "Without Visitor Control, unauthorized individuals may gain physical access to facilities and equipment, enabling theft, tampering, damage or safety incidents. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss of Accountability / Attribution (R-AC-1), Unauthorized Access (R-AC-4), Undetected / Delayed Detection of Adverse Activity (R-SA-1), and most likely increases susceptibility to natural threats NT-2, NT-3, NT-4, NT-5, NT-6, NT-7, NT-8, NT-11, NT-12, NT-13, NT-14; man-made threats MT-3, MT-4, MT-5, MT-6, MT-9, MT-14, MT-25.", "compensating_control_1": { "control_id": "PES-08", "name": "Physical Access Control", "description": "Physical access control mechanisms exist to enforce physical access authorizations for all physical access points (including designated entry/exit points) to facilities (excluding those areas within the facility officially designated as publicly accessible).", "justification": "Physical Access Control (PES-08) provides access control enforcement that compensates for the absence of Visitor Control (PES-14) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the facility and physical environment focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "PES-13", "name": "Monitoring Physical Access", "description": "Physical access control mechanisms exist to monitor for, detect and respond to physical security incidents.", "justification": "Monitoring Physical Access (PES-13) provides detective monitoring capability that compensates for the absence of Visitor Control (PES-14) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the facility and physical environment focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "PES-14.1", "risk_if_not_implemented": "Without Distinguish Visitors from On-Site Personnel, unauthorized individuals may gain physical access to facilities and equipment, enabling theft, tampering, damage or safety incidents. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Access (R-AC-4), Identity Compromise / Impersonation (R-AC-5), System / Data Compromise (Non-Technical Vector) (R-BC-5), Undetected / Delayed Detection of Adverse Activity (R-SA-1), Loss of Confidentiality (R-IP-2), and most likely increases susceptibility to natural threats NT-2, NT-3, NT-4, NT-5, NT-6, NT-8, NT-11, NT-12, NT-13, NT-14; Physical Crime (MT-5), Dysfunctional Management Practices (MT-8), Human Error (MT-9), Fraud, Corruption and/or Intentional Criminal Conduct (MT-14).", "compensating_control_1": { "control_id": "IAC-25", "name": "Access Enforcement", "description": "Mechanisms exist to enforce Logical Access Control (LAC) permissions that conform to the principle of \"least privilege.\"", "justification": "Access Enforcement (IAC-25) provides access control enforcement that compensates for the absence of Distinguish Visitors from On-Site Personnel (PES-14.1) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the facility and physical environment focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "PES-14", "name": "Visitor Control", "description": "Physical access control mechanisms exist to identify, authorize and monitor visitors before allowing access to the facility (other than areas designated as publicly accessible).", "justification": "Visitor Control (PES-14) provides physical access control that compensates for the absence of Distinguish Visitors from On-Site Personnel (PES-14.1) by preventing unauthorized physical interaction with systems and infrastructure. Given the facility and physical environment focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "PES-14.2", "risk_if_not_implemented": "Without Identification Requirement, unauthorized individuals may gain physical access to facilities and equipment, enabling theft, tampering, damage or safety incidents. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss of Accountability / Attribution (R-AC-1), Unauthorized Access (R-AC-4), Identity Compromise / Impersonation (R-AC-5), System / Data Compromise (Non-Technical Vector) (R-BC-5), and most likely increases susceptibility to natural threats NT-2, NT-3, NT-4, NT-5, NT-6, NT-8, NT-11, NT-12, NT-13, NT-14; Physical Crime (MT-5), Dysfunctional Management Practices (MT-8), Human Error (MT-9), Fraud, Corruption and/or Intentional Criminal Conduct (MT-14).", "compensating_control_1": { "control_id": "PES-13", "name": "Monitoring Physical Access", "description": "Physical access control mechanisms exist to monitor for, detect and respond to physical security incidents.", "justification": "Monitoring Physical Access (PES-13) provides detective monitoring capability that compensates for the absence of Identification Requirement (PES-14.2) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the facility and physical environment focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "PES-14", "name": "Visitor Control", "description": "Physical access control mechanisms exist to identify, authorize and monitor visitors before allowing access to the facility (other than areas designated as publicly accessible).", "justification": "Visitor Control (PES-14) provides physical access control that compensates for the absence of Identification Requirement (PES-14.2) by preventing unauthorized physical interaction with systems and infrastructure. Given the facility and physical environment focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "PES-14.4", "risk_if_not_implemented": "Without Automated Records Management & Review, data may be retained longer than authorized or necessary, or may be unrecoverable when legally or operationally required. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss of Accountability / Attribution (R-AC-1), Inability to Demonstrate Due Diligence / Due Care (R-GV-9), Loss of Investigative / Evidentiary Capability (R-IR-1), Undetected / Delayed Detection of Adverse Activity (R-SA-1), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Technical / Mechanical Failure (MT-10), Data Quality Degradation / Data Poisoning (MT-12).", "compensating_control_1": { "control_id": "PES-08", "name": "Physical Access Control", "description": "Physical access control mechanisms exist to enforce physical access authorizations for all physical access points (including designated entry/exit points) to facilities (excluding those areas within the facility officially designated as publicly accessible).", "justification": "Physical Access Control (PES-08) provides access control enforcement that compensates for the absence of Automated Records Management & Review (PES-14.4) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "PES-14", "name": "Visitor Control", "description": "Physical access control mechanisms exist to identify, authorize and monitor visitors before allowing access to the facility (other than areas designated as publicly accessible).", "justification": "Visitor Control (PES-14) provides physical access control that compensates for the absence of Automated Records Management & Review (PES-14.4) by preventing unauthorized physical interaction with systems and infrastructure. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "PES-14.5", "risk_if_not_implemented": "Without Minimize Visitor Personal Data (PD), Personal Data (PD) may be collected, processed, retained or shared without lawful authority or adequate safeguards, harming individuals and exposing the organization to regulatory action. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Retention / Inability to Dispose of Data (R-AM-3), Regulatory / Legal / Contractual Financial Liability (R-EX-5), Privacy Harm / Unauthorized Processing (R-IP-6), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11).", "compensating_control_1": { "control_id": "PES-13", "name": "Monitoring Physical Access", "description": "Physical access control mechanisms exist to monitor for, detect and respond to physical security incidents.", "justification": "Monitoring Physical Access (PES-13) provides detective monitoring capability that compensates for the absence of Minimize Visitor Personal Data (PD) (PES-14.5) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the data-handling focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "PES-08", "name": "Physical Access Control", "description": "Physical access control mechanisms exist to enforce physical access authorizations for all physical access points (including designated entry/exit points) to facilities (excluding those areas within the facility officially designated as publicly accessible).", "justification": "Physical Access Control (PES-08) provides access control enforcement that compensates for the absence of Minimize Visitor Personal Data (PD) (PES-14.5) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the data-handling focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "PES-14.6", "risk_if_not_implemented": "Without Visitor Access Revocation, unauthorized individuals may gain physical access to facilities and equipment, enabling theft, tampering, damage or safety incidents. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Excessive or Unauthorized Privilege (R-AC-2), Unauthorized Access (R-AC-4), and most likely increases susceptibility to Physical Crime (MT-5), Dysfunctional Management Practices (MT-8), Human Error (MT-9), Fraud, Corruption and/or Intentional Criminal Conduct (MT-14).", "compensating_control_1": { "control_id": "PES-14", "name": "Visitor Control", "description": "Physical access control mechanisms exist to identify, authorize and monitor visitors before allowing access to the facility (other than areas designated as publicly accessible).", "justification": "Visitor Control (PES-14) provides physical access control that compensates for the absence of Visitor Access Revocation (PES-14.6) by preventing unauthorized physical interaction with systems and infrastructure. Given the facility and physical environment focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "PES-13", "name": "Monitoring Physical Access", "description": "Physical access control mechanisms exist to monitor for, detect and respond to physical security incidents.", "justification": "Monitoring Physical Access (PES-13) provides detective monitoring capability that compensates for the absence of Visitor Access Revocation (PES-14.6) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the facility and physical environment focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "PES-15", "risk_if_not_implemented": "Without Delivery & Removal, unauthorized individuals may gain physical access to facilities and equipment, enabling theft, tampering, damage or safety incidents. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Access (R-AC-4), System / Data Compromise (Non-Technical Vector) (R-BC-5), and most likely increases susceptibility to natural threats NT-2, NT-3, NT-4, NT-5, NT-6, NT-8, NT-11, NT-12, NT-13, NT-14; Physical Crime (MT-5), Human Error (MT-9), Fraud, Corruption and/or Intentional Criminal Conduct (MT-14).", "compensating_control_1": { "control_id": "PES-08", "name": "Physical Access Control", "description": "Physical access control mechanisms exist to enforce physical access authorizations for all physical access points (including designated entry/exit points) to facilities (excluding those areas within the facility officially designated as publicly accessible).", "justification": "Physical Access Control (PES-08) provides access control enforcement that compensates for the absence of Delivery & Removal (PES-15) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the facility and physical environment focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "PES-13", "name": "Monitoring Physical Access", "description": "Physical access control mechanisms exist to monitor for, detect and respond to physical security incidents.", "justification": "Monitoring Physical Access (PES-13) provides detective monitoring capability that compensates for the absence of Delivery & Removal (PES-15) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the facility and physical environment focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "PES-15.1", "risk_if_not_implemented": "Without Temporary Storage, unauthorized individuals may gain physical access to facilities and equipment, enabling theft, tampering, damage or safety incidents. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Access (R-AC-4), Loss, Theft or Damage of Assets (R-AM-1), and most likely increases susceptibility to natural threats NT-2, NT-3, NT-4, NT-5, NT-6, NT-8, NT-11, NT-12, NT-13, NT-14; Physical Crime (MT-5), Utility Service Disruption (MT-7), Human Error (MT-9), Fraud, Corruption and/or Intentional Criminal Conduct (MT-14).", "compensating_control_1": { "control_id": "PES-08", "name": "Physical Access Control", "description": "Physical access control mechanisms exist to enforce physical access authorizations for all physical access points (including designated entry/exit points) to facilities (excluding those areas within the facility officially designated as publicly accessible).", "justification": "Physical Access Control (PES-08) provides access control enforcement that compensates for the absence of Temporary Storage (PES-15.1) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the facility and physical environment focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "PES-10", "name": "Physical Security of Offices, Rooms & Facilities", "description": "Mechanisms exist to identify systems, equipment and respective operating environments that require limited physical access so that appropriate physical access controls are designed and implemented for offices, rooms and facilities.", "justification": "Physical Security of Offices, Rooms & Facilities (PES-10) provides physical access control that compensates for the absence of Temporary Storage (PES-15.1) by preventing unauthorized physical interaction with systems and infrastructure. Given the facility and physical environment focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "PES-16", "risk_if_not_implemented": "Without Equipment Siting & Protection, unauthorized individuals may gain physical access to facilities and equipment, enabling theft, tampering, damage or safety incidents. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Access (R-AC-4), Loss, Theft or Damage of Assets (R-AM-1), Physical / Environmental Damage (R-SF-2), and most likely increases susceptibility to natural threats NT-2, NT-3, NT-4, NT-5, NT-6, NT-8, NT-10, NT-11, NT-12, NT-13, NT-14; Hazardous Materials Emergencies (MT-3), Human Error (MT-9), Hazardous / Degraded Operational Environment (MT-21).", "compensating_control_1": { "control_id": "PES-08", "name": "Physical Access Control", "description": "Physical access control mechanisms exist to enforce physical access authorizations for all physical access points (including designated entry/exit points) to facilities (excluding those areas within the facility officially designated as publicly accessible).", "justification": "Physical Access Control (PES-08) provides access control enforcement that compensates for the absence of Equipment Siting & Protection (PES-16) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the facility and physical environment focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "PES-20", "name": "Supporting Utilities", "description": "Facility security mechanisms exist to protect power equipment and power cabling for the system from damage and destruction.", "justification": "Supporting Utilities (PES-20) provides overlapping security capability that compensates for the absence of Equipment Siting & Protection (PES-16) by addressing related risk objectives through an alternative control mechanism aligned with Facility applicability. Given the facility and physical environment focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "PES-16.1", "risk_if_not_implemented": "Without Transmission Medium Security, security, compliance and resilience activities may lack direction, ownership and executive support, leaving required controls unperformed. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Business / Service Interruption (R-BC-1), Loss of Confidentiality (R-IP-2), Loss of Data / Service Availability (R-IP-4), and most likely increases susceptibility to natural threats NT-2, NT-3, NT-4, NT-5, NT-6, NT-8, NT-10, NT-11, NT-12, NT-13, NT-14; Physical Crime (MT-5), Human Error (MT-9), Fraud, Corruption and/or Intentional Criminal Conduct (MT-14).", "compensating_control_1": { "control_id": "PES-20", "name": "Supporting Utilities", "description": "Facility security mechanisms exist to protect power equipment and power cabling for the system from damage and destruction.", "justification": "Supporting Utilities (PES-20) provides overlapping security capability that compensates for the absence of Transmission Medium Security (PES-16.1) by addressing related risk objectives through an alternative control mechanism aligned with Facility applicability. Given the facility and physical environment focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "PES-08", "name": "Physical Access Control", "description": "Physical access control mechanisms exist to enforce physical access authorizations for all physical access points (including designated entry/exit points) to facilities (excluding those areas within the facility officially designated as publicly accessible).", "justification": "Physical Access Control (PES-08) provides access control enforcement that compensates for the absence of Transmission Medium Security (PES-16.1) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the facility and physical environment focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "PES-17", "risk_if_not_implemented": "Without Access Control for Output Devices, unauthorized individuals, devices or services may gain access to Technology Assets, Applications, Services, Data and/or Facilities (TAASDF). Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Access (R-AC-4), Loss of Confidentiality (R-IP-2), and most likely increases susceptibility to natural threats NT-2, NT-3, NT-4, NT-5, NT-6, NT-8, NT-11, NT-12, NT-13, NT-14; Physical Crime (MT-5), Human Error (MT-9), Fraud, Corruption and/or Intentional Criminal Conduct (MT-14).", "compensating_control_1": { "control_id": "PES-08", "name": "Physical Access Control", "description": "Physical access control mechanisms exist to enforce physical access authorizations for all physical access points (including designated entry/exit points) to facilities (excluding those areas within the facility officially designated as publicly accessible).", "justification": "Physical Access Control (PES-08) provides access control enforcement that compensates for the absence of Access Control for Output Devices (PES-17) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the facility and physical environment focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "PES-16", "name": "Equipment Siting & Protection", "description": "Physical security mechanisms exist to locate system components within the facility to minimize potential damage from physical and environmental hazards and to minimize the opportunity for unauthorized access.", "justification": "Equipment Siting & Protection (PES-16) provides overlapping security capability that compensates for the absence of Access Control for Output Devices (PES-17) by addressing related risk objectives through an alternative control mechanism aligned with Facility applicability. Given the facility and physical environment focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "PES-18", "risk_if_not_implemented": "Without Component Marking, unauthorized individuals may gain physical access to facilities and equipment, enabling theft, tampering, damage or safety incidents. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unaddressed Security / Compliance Exposure (R-GV-2), and most likely increases susceptibility to Human Error (MT-9).", "compensating_control_1": { "control_id": "DCH-11", "name": "Media Marking", "description": "Mechanisms exist to mark media in accordance with data protection requirements so that personnel are alerted to distribution limitations, handling caveats and applicable security requirements.", "justification": "Media Marking (DCH-11) provides overlapping security capability that compensates for the absence of Component Marking (PES-18) by addressing related risk objectives through an alternative control mechanism aligned with Facility applicability. Given the facility and physical environment focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "AST-04", "name": "Asset Inventories", "description": "Mechanisms exist to perform inventories of Technology Assets, Applications, Services and/or Data (TAASD) that:\n(1) Accurately reflects the current TAASD in use; \n(2) Identifies authorized software products, including business justification details;\n(3) Is at the level of granularity deemed necessary for tracking and reporting;\n(4) Includes organization-defined information deemed necessary to achieve effective property accountability; and\n(5) Is available for review and audit by designated organizational personnel.", "justification": "Asset Inventories (AST-04) provides overlapping security capability that compensates for the absence of Component Marking (PES-18) by addressing related risk objectives through an alternative control mechanism aligned with Facility applicability. Given the facility and physical environment focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "PES-19", "risk_if_not_implemented": "Without Asset Monitoring and Tracking, malicious, anomalous or unauthorized activity may go undetected or be detected too late to prevent or limit harm. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss, Theft or Damage of Assets (R-AM-1), Undetected / Delayed Detection of Adverse Activity (R-SA-1), and most likely increases susceptibility to natural threats NT-2, NT-3, NT-4, NT-5, NT-6, NT-8, NT-11, NT-12, NT-13, NT-14; man-made threats MT-5, MT-6, MT-7, MT-9, MT-10, MT-12, MT-14.", "compensating_control_1": { "control_id": "MON-02", "name": "Continuous Monitoring", "description": "Mechanisms exist to facilitate the implementation of enterprise-wide monitoring controls.", "justification": "Continuous Monitoring (MON-02) provides detective monitoring capability that compensates for the absence of Asset Monitoring and Tracking (PES-19) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the facility and physical environment focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "AST-04", "name": "Asset Inventories", "description": "Mechanisms exist to perform inventories of Technology Assets, Applications, Services and/or Data (TAASD) that:\n(1) Accurately reflects the current TAASD in use; \n(2) Identifies authorized software products, including business justification details;\n(3) Is at the level of granularity deemed necessary for tracking and reporting;\n(4) Includes organization-defined information deemed necessary to achieve effective property accountability; and\n(5) Is available for review and audit by designated organizational personnel.", "justification": "Asset Inventories (AST-04) provides overlapping security capability that compensates for the absence of Asset Monitoring and Tracking (PES-19) by addressing related risk objectives through an alternative control mechanism aligned with Facility applicability. Given the facility and physical environment focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "PES-20", "risk_if_not_implemented": "Without Supporting Utilities, unauthorized individuals may gain physical access to facilities and equipment, enabling theft, tampering, damage or safety incidents. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss, Theft or Damage of Assets (R-AM-1), Business / Service Interruption (R-BC-1), Loss of Data / Service Availability (R-IP-4), Physical / Environmental Damage (R-SF-2), and most likely increases susceptibility to natural threats NT-2, NT-3, NT-4, NT-5, NT-6, NT-8, NT-10, NT-11, NT-12, NT-13, NT-14; man-made threats MT-5, MT-6, MT-7, MT-9, MT-10, MT-21, MT-27.", "compensating_control_1": { "control_id": "BCD-02", "name": "Business Continuity Management System (BCMS)", "description": "Mechanisms exist to operate a Business Continuity Management System (BCMS) to achieve resilient Technology Assets, Applications, Services and/or Data (TAASD) during:\n(1) Routine operations; and\n(2) Adverse conditions.", "justification": "Business Continuity Management System (BCMS) (BCD-02) provides resilience and recovery capability that compensates for the absence of Supporting Utilities (PES-20) by ensuring the organization can restore operations and data when the primary control is absent. Given the facility and physical environment focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "MON-02", "name": "Continuous Monitoring", "description": "Mechanisms exist to facilitate the implementation of enterprise-wide monitoring controls.", "justification": "Continuous Monitoring (MON-02) provides detective monitoring capability that compensates for the absence of Supporting Utilities (PES-20) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the facility and physical environment focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "PES-20.1", "risk_if_not_implemented": "Without Automatic Voltage Controls, unauthorized individuals may gain physical access to facilities and equipment, enabling theft, tampering, damage or safety incidents. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss, Theft or Damage of Assets (R-AM-1), Business / Service Interruption (R-BC-1), Loss of Data / Service Availability (R-IP-4), and most likely increases susceptibility to natural threats NT-2, NT-3, NT-4, NT-5, NT-6, NT-8, NT-10, NT-11, NT-12, NT-13, NT-14; Terrorism & Armed Attacks (MT-6), Utility Service Disruption (MT-7), Technical / Mechanical Failure (MT-10), Hazardous / Degraded Operational Environment (MT-21), Infrastructure Failure / Degradation (MT-27).", "compensating_control_1": { "control_id": "MON-02", "name": "Continuous Monitoring", "description": "Mechanisms exist to facilitate the implementation of enterprise-wide monitoring controls.", "justification": "Continuous Monitoring (MON-02) provides detective monitoring capability that compensates for the absence of Automatic Voltage Controls (PES-20.1) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the facility and physical environment focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "PES-20", "name": "Supporting Utilities", "description": "Facility security mechanisms exist to protect power equipment and power cabling for the system from damage and destruction.", "justification": "Supporting Utilities (PES-20) provides overlapping security capability that compensates for the absence of Automatic Voltage Controls (PES-20.1) by addressing related risk objectives through an alternative control mechanism aligned with Facility applicability. Given the facility and physical environment focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "PES-21", "risk_if_not_implemented": "Without Emergency Shutoff, unauthorized individuals may gain physical access to facilities and equipment, enabling theft, tampering, damage or safety incidents. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Business / Service Interruption (R-BC-1), Loss of Data / Service Availability (R-IP-4), Injury / Loss of Life (R-SF-1), Physical / Environmental Damage (R-SF-2), and most likely increases susceptibility to natural threats NT-2, NT-3, NT-4, NT-5, NT-6, NT-8, NT-11, NT-12, NT-13, NT-14; man-made threats MT-3, MT-5, MT-6, MT-9, MT-10, MT-14, MT-21.", "compensating_control_1": { "control_id": "BCD-02", "name": "Business Continuity Management System (BCMS)", "description": "Mechanisms exist to operate a Business Continuity Management System (BCMS) to achieve resilient Technology Assets, Applications, Services and/or Data (TAASD) during:\n(1) Routine operations; and\n(2) Adverse conditions.", "justification": "Business Continuity Management System (BCMS) (BCD-02) provides resilience and recovery capability that compensates for the absence of Emergency Shutoff (PES-21) by ensuring the organization can restore operations and data when the primary control is absent. Given the facility and physical environment focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "PES-20", "name": "Supporting Utilities", "description": "Facility security mechanisms exist to protect power equipment and power cabling for the system from damage and destruction.", "justification": "Supporting Utilities (PES-20) provides overlapping security capability that compensates for the absence of Emergency Shutoff (PES-21) by addressing related risk objectives through an alternative control mechanism aligned with Facility applicability. Given the facility and physical environment focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "PES-22", "risk_if_not_implemented": "Without Emergency Power, unauthorized individuals may gain physical access to facilities and equipment, enabling theft, tampering, damage or safety incidents. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Business / Service Interruption (R-BC-1), Recovery Failure / Unacceptable Recovery Delay (R-OR-1), Concentration / Single-Point Dependency Failure (R-OR-2), Loss of Data / Service Availability (R-IP-4), and most likely increases susceptibility to natural threats NT-2, NT-3, NT-4, NT-5, NT-6, NT-8, NT-10, NT-11, NT-12, NT-13, NT-14; man-made threats MT-5, MT-6, MT-7, MT-9, MT-10, MT-21, MT-26, MT-27.", "compensating_control_1": { "control_id": "PES-20", "name": "Supporting Utilities", "description": "Facility security mechanisms exist to protect power equipment and power cabling for the system from damage and destruction.", "justification": "Supporting Utilities (PES-20) provides overlapping security capability that compensates for the absence of Emergency Power (PES-22) by addressing related risk objectives through an alternative control mechanism aligned with Facility applicability. Given the facility and physical environment focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "BCD-02", "name": "Business Continuity Management System (BCMS)", "description": "Mechanisms exist to operate a Business Continuity Management System (BCMS) to achieve resilient Technology Assets, Applications, Services and/or Data (TAASD) during:\n(1) Routine operations; and\n(2) Adverse conditions.", "justification": "Business Continuity Management System (BCMS) (BCD-02) provides resilience and recovery capability that compensates for the absence of Emergency Power (PES-22) by ensuring the organization can restore operations and data when the primary control is absent. Given the facility and physical environment focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "PES-23", "risk_if_not_implemented": "Without Emergency Lighting, unauthorized individuals may gain physical access to facilities and equipment, enabling theft, tampering, damage or safety incidents. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Injury / Loss of Life (R-SF-1), and most likely increases susceptibility to natural threats NT-2, NT-3, NT-4, NT-5, NT-6, NT-8, NT-11, NT-12, NT-13, NT-14; man-made threats MT-6, MT-7, MT-9, MT-10, MT-21, MT-27.", "compensating_control_1": { "control_id": "MON-02", "name": "Continuous Monitoring", "description": "Mechanisms exist to facilitate the implementation of enterprise-wide monitoring controls.", "justification": "Continuous Monitoring (MON-02) provides detective monitoring capability that compensates for the absence of Emergency Lighting (PES-23) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the facility and physical environment focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "BCD-02", "name": "Business Continuity Management System (BCMS)", "description": "Mechanisms exist to operate a Business Continuity Management System (BCMS) to achieve resilient Technology Assets, Applications, Services and/or Data (TAASD) during:\n(1) Routine operations; and\n(2) Adverse conditions.", "justification": "Business Continuity Management System (BCMS) (BCD-02) provides resilience and recovery capability that compensates for the absence of Emergency Lighting (PES-23) by ensuring the organization can restore operations and data when the primary control is absent. Given the facility and physical environment focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "PES-24", "risk_if_not_implemented": "Without Water Damage Protection, unauthorized individuals may gain physical access to facilities and equipment, enabling theft, tampering, damage or safety incidents. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss, Theft or Damage of Assets (R-AM-1), Physical / Environmental Damage (R-SF-2), and most likely increases susceptibility to natural threats NT-2, NT-3, NT-4, NT-5, NT-6, NT-8, NT-11, NT-12, NT-13, NT-14; man-made threats MT-6, MT-7, MT-9, MT-10, MT-21, MT-25, MT-27.", "compensating_control_1": { "control_id": "BCD-02", "name": "Business Continuity Management System (BCMS)", "description": "Mechanisms exist to operate a Business Continuity Management System (BCMS) to achieve resilient Technology Assets, Applications, Services and/or Data (TAASD) during:\n(1) Routine operations; and\n(2) Adverse conditions.", "justification": "Business Continuity Management System (BCMS) (BCD-02) provides resilience and recovery capability that compensates for the absence of Water Damage Protection (PES-24) by ensuring the organization can restore operations and data when the primary control is absent. Given the facility and physical environment focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "MON-02", "name": "Continuous Monitoring", "description": "Mechanisms exist to facilitate the implementation of enterprise-wide monitoring controls.", "justification": "Continuous Monitoring (MON-02) provides detective monitoring capability that compensates for the absence of Water Damage Protection (PES-24) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the facility and physical environment focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "PES-24.1", "risk_if_not_implemented": "Without Automation Support for Water Damage Protection, unauthorized individuals may gain physical access to facilities and equipment, enabling theft, tampering, damage or safety incidents. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss, Theft or Damage of Assets (R-AM-1), Delayed Containment / Increased Incident Impact (R-IR-2), Undetected / Delayed Detection of Adverse Activity (R-SA-1), Physical / Environmental Damage (R-SF-2), and most likely increases susceptibility to natural threats NT-2, NT-3, NT-4, NT-5, NT-6, NT-8, NT-11, NT-12, NT-13, NT-14; man-made threats MT-6, MT-7, MT-9, MT-10, MT-21, MT-27.", "compensating_control_1": { "control_id": "PES-20", "name": "Supporting Utilities", "description": "Facility security mechanisms exist to protect power equipment and power cabling for the system from damage and destruction.", "justification": "Supporting Utilities (PES-20) provides overlapping security capability that compensates for the absence of Automation Support for Water Damage Protection (PES-24.1) by addressing related risk objectives through an alternative control mechanism aligned with Facility applicability. Given the facility and physical environment focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "MON-02", "name": "Continuous Monitoring", "description": "Mechanisms exist to facilitate the implementation of enterprise-wide monitoring controls.", "justification": "Continuous Monitoring (MON-02) provides detective monitoring capability that compensates for the absence of Automation Support for Water Damage Protection (PES-24.1) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the facility and physical environment focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "PES-25", "risk_if_not_implemented": "Without Redundant Cabling, data, software and system images cannot be reliably restored within required recovery objectives following a disruption. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Business / Service Interruption (R-BC-1), Concentration / Single-Point Dependency Failure (R-OR-2), Loss of Data / Service Availability (R-IP-4), and most likely increases susceptibility to natural threats NT-2, NT-3, NT-4, NT-5, NT-6, NT-8, NT-11, NT-12, NT-13, NT-14; man-made threats MT-5, MT-6, MT-7, MT-9, MT-10, MT-27.", "compensating_control_1": { "control_id": "BCD-02", "name": "Business Continuity Management System (BCMS)", "description": "Mechanisms exist to operate a Business Continuity Management System (BCMS) to achieve resilient Technology Assets, Applications, Services and/or Data (TAASD) during:\n(1) Routine operations; and\n(2) Adverse conditions.", "justification": "Business Continuity Management System (BCMS) (BCD-02) provides resilience and recovery capability that compensates for the absence of Redundant Cabling (PES-25) by ensuring the organization can restore operations and data when the primary control is absent. Given the facility and physical environment focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "PES-20", "name": "Supporting Utilities", "description": "Facility security mechanisms exist to protect power equipment and power cabling for the system from damage and destruction.", "justification": "Supporting Utilities (PES-20) provides overlapping security capability that compensates for the absence of Redundant Cabling (PES-25) by addressing related risk objectives through an alternative control mechanism aligned with Facility applicability. Given the facility and physical environment focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "PES-26", "risk_if_not_implemented": "Without Fire Protection, unauthorized individuals may gain physical access to facilities and equipment, enabling theft, tampering, damage or safety incidents. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss, Theft or Damage of Assets (R-AM-1), Undetected / Delayed Detection of Adverse Activity (R-SA-1), Injury / Loss of Life (R-SF-1), Physical / Environmental Damage (R-SF-2), and most likely increases susceptibility to natural threats NT-1, NT-2, NT-3, NT-4, NT-5, NT-6, NT-8, NT-11, NT-12, NT-13, NT-14; man-made threats MT-3, MT-6, MT-7, MT-9, MT-10, MT-21, MT-27.", "compensating_control_1": { "control_id": "PES-20", "name": "Supporting Utilities", "description": "Facility security mechanisms exist to protect power equipment and power cabling for the system from damage and destruction.", "justification": "Supporting Utilities (PES-20) provides overlapping security capability that compensates for the absence of Fire Protection (PES-26) by addressing related risk objectives through an alternative control mechanism aligned with Facility applicability. Given the facility and physical environment focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "MON-02", "name": "Continuous Monitoring", "description": "Mechanisms exist to facilitate the implementation of enterprise-wide monitoring controls.", "justification": "Continuous Monitoring (MON-02) provides detective monitoring capability that compensates for the absence of Fire Protection (PES-26) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the facility and physical environment focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "PES-27", "risk_if_not_implemented": "Without Fire Detection Devices, malicious, anomalous or unauthorized activity may go undetected or be detected too late to prevent or limit harm. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss, Theft or Damage of Assets (R-AM-1), Delayed Containment / Increased Incident Impact (R-IR-2), Undetected / Delayed Detection of Adverse Activity (R-SA-1), Injury / Loss of Life (R-SF-1), Physical / Environmental Damage (R-SF-2), and most likely increases susceptibility to natural threats NT-2, NT-3, NT-4, NT-5, NT-6, NT-8, NT-11, NT-12, NT-13, NT-14; man-made threats MT-3, MT-6, MT-7, MT-9, MT-10, MT-21, MT-27.", "compensating_control_1": { "control_id": "MON-02", "name": "Continuous Monitoring", "description": "Mechanisms exist to facilitate the implementation of enterprise-wide monitoring controls.", "justification": "Continuous Monitoring (MON-02) provides detective monitoring capability that compensates for the absence of Fire Detection Devices (PES-27) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the facility and physical environment focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "PES-26", "name": "Fire Protection", "description": "Facility security mechanisms exist to utilize and maintain fire suppression and detection devices/systems for the system that are supported by an independent energy source.", "justification": "Fire Protection (PES-26) provides overlapping security capability that compensates for the absence of Fire Detection Devices (PES-27) by addressing related risk objectives through an alternative control mechanism aligned with Facility applicability. Given the facility and physical environment focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "PES-28", "risk_if_not_implemented": "Without Fire Suppression Devices, unauthorized individuals may gain physical access to facilities and equipment, enabling theft, tampering, damage or safety incidents. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss, Theft or Damage of Assets (R-AM-1), Delayed Containment / Increased Incident Impact (R-IR-2), Injury / Loss of Life (R-SF-1), Physical / Environmental Damage (R-SF-2), and most likely increases susceptibility to natural threats NT-1, NT-2, NT-3, NT-4, NT-5, NT-6, NT-8, NT-11, NT-12, NT-13, NT-14; man-made threats MT-3, MT-6, MT-7, MT-9, MT-10, MT-21, MT-27.", "compensating_control_1": { "control_id": "PES-26", "name": "Fire Protection", "description": "Facility security mechanisms exist to utilize and maintain fire suppression and detection devices/systems for the system that are supported by an independent energy source.", "justification": "Fire Protection (PES-26) provides overlapping security capability that compensates for the absence of Fire Suppression Devices (PES-28) by addressing related risk objectives through an alternative control mechanism aligned with Facility applicability. Given the facility and physical environment focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "PES-20", "name": "Supporting Utilities", "description": "Facility security mechanisms exist to protect power equipment and power cabling for the system from damage and destruction.", "justification": "Supporting Utilities (PES-20) provides overlapping security capability that compensates for the absence of Fire Suppression Devices (PES-28) by addressing related risk objectives through an alternative control mechanism aligned with Facility applicability. Given the facility and physical environment focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "PES-28.1", "risk_if_not_implemented": "Without Automatic Fire Suppression, unauthorized individuals may gain physical access to facilities and equipment, enabling theft, tampering, damage or safety incidents. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss, Theft or Damage of Assets (R-AM-1), Physical / Environmental Damage (R-SF-2), and most likely increases susceptibility to natural threats NT-1, NT-2, NT-3, NT-4, NT-5, NT-6, NT-8, NT-10, NT-11, NT-12, NT-13, NT-14; Utility Service Disruption (MT-7), Technical / Mechanical Failure (MT-10), Product Defect / Design Failure (MT-23), Infrastructure Failure / Degradation (MT-27).", "compensating_control_1": { "control_id": "PES-20", "name": "Supporting Utilities", "description": "Facility security mechanisms exist to protect power equipment and power cabling for the system from damage and destruction.", "justification": "Supporting Utilities (PES-20) provides overlapping security capability that compensates for the absence of Automatic Fire Suppression (PES-28.1) by addressing related risk objectives through an alternative control mechanism aligned with Facility applicability. Given the facility and physical environment focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "PES-26", "name": "Fire Protection", "description": "Facility security mechanisms exist to utilize and maintain fire suppression and detection devices/systems for the system that are supported by an independent energy source.", "justification": "Fire Protection (PES-26) provides overlapping security capability that compensates for the absence of Automatic Fire Suppression (PES-28.1) by addressing related risk objectives through an alternative control mechanism aligned with Facility applicability. Given the facility and physical environment focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "PES-29", "risk_if_not_implemented": "Without Temperature & Humidity Controls Monitoring, malicious, anomalous or unauthorized activity may go undetected or be detected too late to prevent or limit harm. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss, Theft or Damage of Assets (R-AM-1), Physical / Environmental Damage (R-SF-2), and most likely increases susceptibility to natural threats NT-1, NT-2, NT-3, NT-4, NT-5, NT-6, NT-8, NT-10, NT-11, NT-12, NT-13, NT-14; Utility Service Disruption (MT-7), Technical / Mechanical Failure (MT-10), Hazardous / Degraded Operational Environment (MT-21), Product Defect / Design Failure (MT-23), Infrastructure Failure / Degradation (MT-27).", "compensating_control_1": { "control_id": "PES-20", "name": "Supporting Utilities", "description": "Facility security mechanisms exist to protect power equipment and power cabling for the system from damage and destruction.", "justification": "Supporting Utilities (PES-20) provides overlapping security capability that compensates for the absence of Temperature & Humidity Controls (PES-29) by addressing related risk objectives through an alternative control mechanism aligned with Facility applicability. Given the facility and physical environment focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "MON-02", "name": "Continuous Monitoring", "description": "Mechanisms exist to facilitate the implementation of enterprise-wide monitoring controls.", "justification": "Continuous Monitoring (MON-02) provides detective monitoring capability that compensates for the absence of Temperature & Humidity Controls (PES-29) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the facility and physical environment focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "PES-29.1", "risk_if_not_implemented": "Without Temperature & Humidity Controls Alerting, unauthorized individuals may gain physical access to facilities and equipment, enabling theft, tampering, damage or safety incidents. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss, Theft or Damage of Assets (R-AM-1), Undetected / Delayed Detection of Adverse Activity (R-SA-1), Physical / Environmental Damage (R-SF-2), and most likely increases susceptibility to natural threats NT-2, NT-3, NT-4, NT-5, NT-6, NT-8, NT-10, NT-11, NT-12, NT-13, NT-14; man-made threats MT-7, MT-9, MT-10, MT-12, MT-23, MT-27.", "compensating_control_1": { "control_id": "MON-02", "name": "Continuous Monitoring", "description": "Mechanisms exist to facilitate the implementation of enterprise-wide monitoring controls.", "justification": "Continuous Monitoring (MON-02) provides detective monitoring capability that compensates for the absence of Monitoring with Alarms / Notifications (PES-29.1) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "PES-29", "name": "Temperature & Humidity Controls Monitoring", "description": "Facility security mechanisms exist to maintain and monitor temperature and humidity levels within the facility.", "justification": "Temperature & Humidity Controls Monitoring (PES-29) provides overlapping security capability that compensates for the absence of Monitoring with Alarms / Notifications (PES-29.1) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "PES-30", "risk_if_not_implemented": "Without Information Leakage Due To Electromagnetic Signals Emanations, unauthorized individuals may gain physical access to facilities and equipment, enabling theft, tampering, damage or safety incidents. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss of Confidentiality (R-IP-2), and most likely increases susceptibility to natural threats NT-2, NT-3, NT-4, NT-5, NT-6, NT-8, NT-11, NT-12, NT-13, NT-14; Technical / Mechanical Failure (MT-10), Product Defect / Design Failure (MT-23).", "compensating_control_1": { "control_id": "PES-10", "name": "Physical Security of Offices, Rooms & Facilities", "description": "Mechanisms exist to identify systems, equipment and respective operating environments that require limited physical access so that appropriate physical access controls are designed and implemented for offices, rooms and facilities.", "justification": "Physical Security of Offices, Rooms & Facilities (PES-10) provides physical access control that compensates for the absence of Information Leakage Due To Electromagnetic Signals Emanations (PES-30) by preventing unauthorized physical interaction with systems and infrastructure. Given the facility and physical environment focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "NET-06", "name": "Network Segmentation (macrosegmentation)", "description": "Mechanisms exist to implement network segmentation within network architectures to isolate Technology Assets, Applications and/or Services (TAAS) from other network resources.", "justification": "Network Segmentation (macrosegmentation) (NET-06) provides network-level access restriction that compensates for the absence of Information Leakage Due To Electromagnetic Signals Emanations (PES-30) by limiting attacker reach and lateral movement opportunities across the environment. Given the facility and physical environment focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "PES-31", "risk_if_not_implemented": "Without Electromagnetic Pulse (EMP) Protection, unauthorized individuals may gain physical access to facilities and equipment, enabling theft, tampering, damage or safety incidents. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss, Theft or Damage of Assets (R-AM-1), Physical / Environmental Damage (R-SF-2), and most likely increases susceptibility to natural threats NT-2, NT-3, NT-4, NT-5, NT-6, NT-8, NT-9, NT-10, NT-11, NT-12, NT-13, NT-14; Nuclear, Biological and Chemical (NBC) Weapons (MT-4), Technical / Mechanical Failure (MT-10), Product Defect / Design Failure (MT-23).", "compensating_control_1": { "control_id": "PES-20", "name": "Supporting Utilities", "description": "Facility security mechanisms exist to protect power equipment and power cabling for the system from damage and destruction.", "justification": "Supporting Utilities (PES-20) provides overlapping security capability that compensates for the absence of Electromagnetic Pulse (EMP) Protection (PES-31) by addressing related risk objectives through an alternative control mechanism aligned with Facility applicability. Given the facility and physical environment focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "BCD-02", "name": "Business Continuity Management System (BCMS)", "description": "Mechanisms exist to operate a Business Continuity Management System (BCMS) to achieve resilient Technology Assets, Applications, Services and/or Data (TAASD) during:\n(1) Routine operations; and\n(2) Adverse conditions.", "justification": "Business Continuity Management System (BCMS) (BCD-02) provides resilience and recovery capability that compensates for the absence of Electromagnetic Pulse (EMP) Protection (PES-31) by ensuring the organization can restore operations and data when the primary control is absent. Given the facility and physical environment focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "PRI-03", "risk_if_not_implemented": "Without Data Privacy Accountability Structure, unauthorized individuals, devices or services may gain access to Technology Assets, Applications, Services, Data and/or Facilities (TAASDF). Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Regulatory / Legal / Contractual Financial Liability (R-EX-5), Unperformed / Unowned Control Responsibilities (R-GV-3), Inability to Demonstrate Due Diligence / Due Care (R-GV-9), Loss of Critical Knowledge / Capability (R-PE-1), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11), Conflict of Interest (COI) / Undue Influence / Insider Misconduct (MT-15), Workforce Shortage / Loss of Critical Skills / Labor Disruption (MT-25).", "compensating_control_1": { "control_id": "GOV-05", "name": "Assigned Security, Compliance & Resilience Responsibilities", "description": "Mechanisms exist to assign one or more qualified individuals with the mission and resources to centrally-manage, coordinate, develop, implement and maintain an enterprise-wide Security, Compliance & Resilience Program (SCRP).", "justification": "Assigned Security, Compliance & Resilience Responsibilities (GOV-05) provides resilience and recovery capability that compensates for the absence of Data Privacy Accountability Structure (PRI-03) by ensuring the organization can restore operations and data when the primary control is absent. Given the people-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "PRI-02", "name": "Data Privacy Program", "description": "Mechanisms exist to facilitate the implementation and operation of data protection controls throughout the data lifecycle to ensure all forms of Personal Data (PD) are processed lawfully, fairly and transparently.", "justification": "Data Privacy Program (PRI-02) provides policy-level governance that compensates for the absence of Data Privacy Accountability Structure (PRI-03) by establishing documented expectations, accountability structures and organizational guardrails. Given the people-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "PRI-03.1", "risk_if_not_implemented": "Without Chief Privacy Officer (CPO), Personal Data (PD) may be collected, processed, retained or shared without lawful authority or adequate safeguards, harming individuals and exposing the organization to regulatory action. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Regulatory / Legal / Contractual Financial Liability (R-EX-5), Unperformed / Unowned Control Responsibilities (R-GV-3), Inability to Demonstrate Due Diligence / Due Care (R-GV-9), Loss of Critical Knowledge / Capability (R-PE-1), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11), Conflict of Interest (COI) / Undue Influence / Insider Misconduct (MT-15), Workforce Shortage / Loss of Critical Skills / Labor Disruption (MT-25).", "compensating_control_1": { "control_id": "DCH-04", "name": "Data & Asset Classification", "description": "Mechanisms exist to ensure data and assets are categorized in accordance with applicable statutory, regulatory and contractual requirements.", "justification": "Data & Asset Classification (DCH-04) provides overlapping security capability that compensates for the absence of Chief Privacy Officer (CPO) (PRI-03.1) by addressing related risk objectives through an alternative control mechanism aligned with People applicability. Given the people-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "DCH-03", "name": "Sensitive / Regulated Data Governance", "description": "Mechanisms exist to facilitate data governance so that sensitive and/or regulated data is effectively managed and maintained in accordance with applicable statutory, regulatory and contractual obligations.", "justification": "Sensitive / Regulated Data Governance (DCH-03) provides policy-level governance that compensates for the absence of Chief Privacy Officer (CPO) (PRI-03.1) by establishing documented expectations, accountability structures, and organizational guardrails. Given the people-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "PRI-03.2", "risk_if_not_implemented": "Without Data Protection Officer (DPO), sensitive and/or regulated data may be disclosed, altered or lost through inadequate classification, handling or protection. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Regulatory / Legal / Contractual Financial Liability (R-EX-5), Unperformed / Unowned Control Responsibilities (R-GV-3), Inability to Demonstrate Due Diligence / Due Care (R-GV-9), Loss of Critical Knowledge / Capability (R-PE-1), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11), Conflict of Interest (COI) / Undue Influence / Insider Misconduct (MT-15), Workforce Shortage / Loss of Critical Skills / Labor Disruption (MT-25).", "compensating_control_1": { "control_id": "PRI-11", "name": "Personal Data (PD) Control Testing, Training & Monitoring", "description": "Mechanisms exist to conduct testing, training and monitoring activities for Personal Data (PD) controls.", "justification": "Personal Data (PD) Control Testing, Training & Monitoring (PRI-11) provides detective monitoring capability that compensates for the absence of Data Protection Officer (DPO) (PRI-03.2) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the people-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CPL-05", "name": "Conformity Monitoring", "description": "Mechanisms exist to validate that Technology Assets, Applications, Services and/or Data (TAASD) conform to the organization's security, compliance and/or resilience policies, standards and other applicable requirements.", "justification": "Conformity Monitoring (CPL-05) provides periodic assessment and assurance that compensates for the absence of Data Protection Officer (DPO) (PRI-03.2) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the people-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "PRI-03.3", "risk_if_not_implemented": "Without Personal Data Process Manager (PDPM), Personal Data (PD) may be collected, processed, retained or shared without lawful authority or adequate safeguards, harming individuals and exposing the organization to regulatory action. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Regulatory / Legal / Contractual Financial Liability (R-EX-5), Unperformed / Unowned Control Responsibilities (R-GV-3), Inability to Demonstrate Due Diligence / Due Care (R-GV-9), Privacy Harm / Unauthorized Processing (R-IP-6), Loss of Critical Knowledge / Capability (R-PE-1), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11), Workforce Shortage / Loss of Critical Skills / Labor Disruption (MT-25).", "compensating_control_1": { "control_id": "DCH-03", "name": "Sensitive / Regulated Data Governance", "description": "Mechanisms exist to facilitate data governance so that sensitive and/or regulated data is effectively managed and maintained in accordance with applicable statutory, regulatory and contractual obligations.", "justification": "Sensitive / Regulated Data Governance (DCH-03) provides policy-level governance that compensates for the absence of Personal Data (PD) Process Manager (PRI-03.3) by establishing documented expectations, accountability structures, and organizational guardrails. Given the people-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "PRI-02", "name": "Data Privacy Program", "description": "Mechanisms exist to facilitate the implementation and operation of data protection controls throughout the data lifecycle to ensure all forms of Personal Data (PD) are processed lawfully, fairly and transparently.", "justification": "Data Privacy Program (PRI-02) provides policy-level governance that compensates for the absence of Personal Data (PD) Process Manager (PRI-03.3) by establishing documented expectations, accountability structures, and organizational guardrails. Given the people-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "PRI-03.4", "risk_if_not_implemented": "Without Data Fiduciary, Personal Data (PD) may be collected, processed, retained or shared without lawful authority or adequate safeguards, harming individuals and exposing the organization to regulatory action. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Regulatory / Legal / Contractual Financial Liability (R-EX-5), Unperformed / Unowned Control Responsibilities (R-GV-3), Inability to Demonstrate Due Diligence / Due Care (R-GV-9), Privacy Harm / Unauthorized Processing (R-IP-6), Loss of Critical Knowledge / Capability (R-PE-1), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11), Workforce Shortage / Loss of Critical Skills / Labor Disruption (MT-25).", "compensating_control_1": { "control_id": "CPL-05", "name": "Conformity Monitoring", "description": "Mechanisms exist to validate that Technology Assets, Applications, Services and/or Data (TAASD) conform to the organization's security, compliance and/or resilience policies, standards and other applicable requirements.", "justification": "Conformity Monitoring (CPL-05) provides periodic assessment and assurance that compensates for the absence of Data Fiduciary (PRI-03.4) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "PRI-02", "name": "Data Privacy Program", "description": "Mechanisms exist to facilitate the implementation and operation of data protection controls throughout the data lifecycle to ensure all forms of Personal Data (PD) are processed lawfully, fairly and transparently.", "justification": "Data Privacy Program (PRI-02) provides policy-level governance that compensates for the absence of Data Fiduciary (PRI-03.4) by establishing documented expectations, accountability structures, and organizational guardrails. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "PRI-04", "risk_if_not_implemented": "Without Privacy-Aware Design, Personal Data (PD) may be collected, processed, retained or shared without lawful authority or adequate safeguards, harming individuals and exposing the organization to regulatory action. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Regulatory / Legal / Contractual Financial Liability (R-EX-5), Privacy Harm / Unauthorized Processing (R-IP-6), and most likely increases susceptibility to Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11).", "compensating_control_1": { "control_id": "PRI-02", "name": "Data Privacy Program", "description": "Mechanisms exist to facilitate the implementation and operation of data protection controls throughout the data lifecycle to ensure all forms of Personal Data (PD) are processed lawfully, fairly and transparently.", "justification": "Data Privacy Program (PRI-02) provides policy-level governance that compensates for the absence of Privacy-Aware Design (PRI-04) by establishing documented expectations, accountability structures, and organizational guardrails. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "SEA-05", "name": "Secure Engineering Principles", "description": "Mechanisms exist to facilitate the implementation of industry-recognized security, compliance and resilience practices in the specification, design, development, implementation and modification of Technology Assets, Applications and/or Services (TAAS).", "justification": "Secure Engineering Principles (SEA-05) provides secure engineering and architectural guidance that compensates for the absence of Privacy-Aware Design (PRI-04) by embedding security requirements into design processes as an alternative control mechanism. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "PRI-05", "risk_if_not_implemented": "Without Documenting Data Processing Activities, Personal Data (PD) may be collected, processed, retained or shared without lawful authority or adequate safeguards, harming individuals and exposing the organization to regulatory action. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Retention / Inability to Dispose of Data (R-AM-3), Regulatory / Legal / Contractual Financial Liability (R-EX-5), Unaddressed Security / Compliance Exposure (R-GV-2), Inability to Demonstrate Due Diligence / Due Care (R-GV-9), Privacy Harm / Unauthorized Processing (R-IP-6), and most likely increases susceptibility to Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11).", "compensating_control_1": { "control_id": "DCH-03", "name": "Sensitive / Regulated Data Governance", "description": "Mechanisms exist to facilitate data governance so that sensitive and/or regulated data is effectively managed and maintained in accordance with applicable statutory, regulatory and contractual obligations.", "justification": "Sensitive / Regulated Data Governance (DCH-03) provides policy-level governance that compensates for the absence of Documenting Data Processing Activities (PRI-05) by establishing documented expectations, accountability structures, and organizational guardrails. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CPL-02", "name": "Statutory, Regulatory & Contractual Compliance", "description": "Mechanisms exist to facilitate the identification and implementation of relevant statutory, regulatory and contractual controls.", "justification": "Statutory, Regulatory & Contractual Compliance (CPL-02) provides overlapping security capability that compensates for the absence of Documenting Data Processing Activities (PRI-05) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "PRI-05.1", "risk_if_not_implemented": "Without Personal Data (PD) Lineage, Personal Data (PD) may be collected, processed, retained or shared without lawful authority or adequate safeguards, harming individuals and exposing the organization to regulatory action. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Retention / Inability to Dispose of Data (R-AM-3), Regulatory / Legal / Contractual Financial Liability (R-EX-5), Loss of Authenticity / Provenance (R-IP-5), Privacy Harm / Unauthorized Processing (R-IP-6), and most likely increases susceptibility to Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11).", "compensating_control_1": { "control_id": "DCH-29", "name": "Logical Data Location", "description": "Mechanisms exist to identify and document the logical location of data and the specific Technology Assets, Applications and/or Services (TAAS) on which the data resides.", "justification": "Logical Data Location (DCH-29) provides overlapping security capability that compensates for the absence of Personal Data (PD) Lineage (PRI-05.1) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "AST-04", "name": "Asset Inventories", "description": "Mechanisms exist to perform inventories of Technology Assets, Applications, Services and/or Data (TAASD) that:\n(1) Accurately reflects the current TAASD in use; \n(2) Identifies authorized software products, including business justification details;\n(3) Is at the level of granularity deemed necessary for tracking and reporting;\n(4) Includes organization-defined information deemed necessary to achieve effective property accountability; and\n(5) Is available for review and audit by designated organizational personnel.", "justification": "Asset Inventories (AST-04) provides overlapping security capability that compensates for the absence of Personal Data (PD) Lineage (PRI-05.1) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "PRI-06", "risk_if_not_implemented": "Without Personal Data (PD) Categories, Personal Data (PD) may be collected, processed, retained or shared without lawful authority or adequate safeguards, harming individuals and exposing the organization to regulatory action. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Regulatory / Legal / Contractual Financial Liability (R-EX-5), Loss of Confidentiality (R-IP-2), Privacy Harm / Unauthorized Processing (R-IP-6), and most likely increases susceptibility to Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11).", "compensating_control_1": { "control_id": "DCH-27", "name": "Media & Data Retention", "description": "Mechanisms exist to retain media and data in accordance with applicable statutory, regulatory and contractual obligations.", "justification": "Media & Data Retention (DCH-27) provides overlapping security capability that compensates for the absence of Personal Data (PD) Categories (PRI-06) by addressing related risk objectives through an alternative control mechanism aligned with Data applicability. Given the data-handling focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "PRI-30", "name": "Personal Data (PD) Retention & Disposal", "description": "Mechanisms exist to: \n(1) Retain Personal Data (PD), including metadata, for an organization-defined time period to fulfill the purpose(s) identified in the notice or as required by law;\n(2) Dispose of, destroys, erases, and/or anonymizes the PD, regardless of the method of storage; and\n(3) Use organization-defined techniques or methods to ensure secure deletion or destruction of PD (including originals, copies and archived records).", "justification": "Personal Data (PD) Retention & Disposal (PRI-30) provides privacy protection that compensates for the absence of Personal Data (PD) Categories (PRI-06) by applying alternative privacy safeguards to protect personal data and honor data subject rights. Given the data-handling focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "PRI-07", "risk_if_not_implemented": "Without Inventory of Personal Data (PD), Personal Data (PD) may be collected, processed, retained or shared without lawful authority or adequate safeguards, harming individuals and exposing the organization to regulatory action. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Retention / Inability to Dispose of Data (R-AM-3), Regulatory / Legal / Contractual Financial Liability (R-EX-5), Unaddressed Security / Compliance Exposure (R-GV-2), Privacy Harm / Unauthorized Processing (R-IP-6), and most likely increases susceptibility to Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11).", "compensating_control_1": { "control_id": "PRI-30", "name": "Personal Data (PD) Retention & Disposal", "description": "Mechanisms exist to: \n(1) Retain Personal Data (PD), including metadata, for an organization-defined time period to fulfill the purpose(s) identified in the notice or as required by law;\n(2) Dispose of, destroys, erases, and/or anonymizes the PD, regardless of the method of storage; and\n(3) Use organization-defined techniques or methods to ensure secure deletion or destruction of PD (including originals, copies and archived records).", "justification": "Personal Data (PD) Retention & Disposal (PRI-30) provides privacy protection that compensates for the absence of Inventory of Personal Data (PD) (PRI-07) by applying alternative privacy safeguards to protect personal data and honor data subject rights. Given the data-handling focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "DCH-18", "name": "Digital Media Sanitization", "description": "Mechanisms exist to sanitize digital media with the strength and integrity commensurate with the classification or sensitivity of the information prior to disposal, release out of organizational control or release for reuse.", "justification": "Digital Media Sanitization (DCH-18) provides overlapping security capability that compensates for the absence of Inventory of Personal Data (PD) (PRI-07) by addressing related risk objectives through an alternative control mechanism aligned with Data applicability. Given the data-handling focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "PRI-07.1", "risk_if_not_implemented": "Without Personal Data (PD) Inventory Automation Support, Personal Data (PD) may be collected, processed, retained or shared without lawful authority or adequate safeguards, harming individuals and exposing the organization to regulatory action. Based on the risk and threat mapping for this control, no risk is rated Likely; risks rated Possible include Unauthorized Retention / Inability to Dispose of Data (R-AM-3), Regulatory / Legal / Contractual Financial Liability (R-EX-5), Loss of Authorization / Certification / License (R-EX-11), and most likely increases susceptibility to Technical / Mechanical Failure (MT-10), Statutory / Regulatory / Contractual Change (MT-11).", "compensating_control_1": { "control_id": "DCH-18", "name": "Digital Media Sanitization", "description": "Mechanisms exist to sanitize digital media with the strength and integrity commensurate with the classification or sensitivity of the information prior to disposal, release out of organizational control or release for reuse.", "justification": "Digital Media Sanitization (DCH-18) provides overlapping security capability that compensates for the absence of Personal Data (PD) Inventory Automation Support (PRI-07.1) by addressing related risk objectives through an alternative control mechanism aligned with Technology applicability. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "DCH-27", "name": "Media & Data Retention", "description": "Mechanisms exist to retain media and data in accordance with applicable statutory, regulatory and contractual obligations.", "justification": "Media & Data Retention (DCH-27) provides overlapping security capability that compensates for the absence of Personal Data (PD) Inventory Automation Support (PRI-07.1) by addressing related risk objectives through an alternative control mechanism aligned with Technology applicability. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "PRI-08", "risk_if_not_implemented": "Without Updating Personal Data (PD) Process, Personal Data (PD) may be collected, processed, retained or shared without lawful authority or adequate safeguards, harming individuals and exposing the organization to regulatory action. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Privacy Harm / Unauthorized Processing (R-IP-6), and most likely increases susceptibility to Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11).", "compensating_control_1": { "control_id": "DCH-33", "name": "Data Quality Operations", "description": "Mechanisms exist to check for Redundant, Obsolete/Outdated, Toxic or Trivial (ROTT) data to ensure the accuracy, relevance, timeliness, impact, completeness and de-identification of information throughout the information lifecycle.", "justification": "Data Quality Operations (DCH-33) provides overlapping security capability that compensates for the absence of Updating Personal Data (PD) Process (PRI-08) by addressing related risk objectives through an alternative control mechanism aligned with Data applicability. Given the data-handling focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "DCH-33.2", "name": "Data Quality Management", "description": "Mechanisms exist to manage the quality, utility, objectivity, integrity and impact determination and de-identification of sensitive and/or regulated data across the information lifecycle.", "justification": "Data Quality Management (DCH-33.2) provides overlapping security capability that compensates for the absence of Updating Personal Data (PD) Process (PRI-08) by addressing related risk objectives through an alternative control mechanism aligned with Data applicability. Given the data-handling focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "PRI-08.1", "risk_if_not_implemented": "Without Updating & Correcting Personal Data (PD), Personal Data (PD) may be collected, processed, retained or shared without lawful authority or adequate safeguards, harming individuals and exposing the organization to regulatory action. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Regulatory / Legal / Contractual Financial Liability (R-EX-5), Loss of Data Integrity (R-IP-3), Privacy Harm / Unauthorized Processing (R-IP-6), and most likely increases susceptibility to Technical / Mechanical Failure (MT-10), Statutory / Regulatory / Contractual Change (MT-11).", "compensating_control_1": { "control_id": "DCH-33.2", "name": "Data Quality Management", "description": "Mechanisms exist to manage the quality, utility, objectivity, integrity and impact determination and de-identification of sensitive and/or regulated data across the information lifecycle.", "justification": "Data Quality Management (DCH-33.2) provides overlapping security capability that compensates for the absence of Updating & Correcting Personal Data (PD) (PRI-08.1) by addressing related risk objectives through an alternative control mechanism aligned with Data applicability. Given the data-handling focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "DCH-03", "name": "Sensitive / Regulated Data Governance", "description": "Mechanisms exist to facilitate data governance so that sensitive and/or regulated data is effectively managed and maintained in accordance with applicable statutory, regulatory and contractual obligations.", "justification": "Sensitive / Regulated Data Governance (DCH-03) provides policy-level governance that compensates for the absence of Updating & Correcting Personal Data (PD) (PRI-08.1) by establishing documented expectations, accountability structures, and organizational guardrails. Given the data-handling focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "PRI-08.2", "risk_if_not_implemented": "Without Flaw Remediation with Personal Data (PD), Personal Data (PD) may be collected, processed, retained or shared without lawful authority or adequate safeguards, harming individuals and exposing the organization to regulatory action. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Regulatory / Legal / Contractual Financial Liability (R-EX-5), Loss of Confidentiality (R-IP-2), Privacy Harm / Unauthorized Processing (R-IP-6), and most likely increases susceptibility to Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11).", "compensating_control_1": { "control_id": "VPM-06.2", "name": "Continuous Vulnerability Remediation Activities", "description": "Mechanisms exist to address new threats and vulnerabilities on an ongoing basis and ensure assets are protected against known attacks.", "justification": "Continuous Vulnerability Remediation Activities (VPM-06.2) provides vulnerability management that compensates for the absence of Flaw Remediation with Personal Data (PD) (PRI-08.2) by reducing the exploitable attack surface by addressing known weaknesses before they are leveraged. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "VPM-08", "name": "Software & Firmware Patching", "description": "Mechanisms exist to conduct software patching for all deployed Technology Assets, Applications and/or Services (TAAS), including firmware.", "justification": "Software & Firmware Patching (VPM-08) provides vulnerability management that compensates for the absence of Flaw Remediation with Personal Data (PD) (PRI-08.2) by reducing the exploitable attack surface by addressing known weaknesses before they are leveraged. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "PRI-09", "risk_if_not_implemented": "Without Reasonable Data Privacy Practices, Personal Data (PD) may be collected, processed, retained or shared without lawful authority or adequate safeguards, harming individuals and exposing the organization to regulatory action. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Retention / Inability to Dispose of Data (R-AM-3), Regulatory / Legal / Contractual Financial Liability (R-EX-5), Loss of Confidentiality (R-IP-2), Privacy Harm / Unauthorized Processing (R-IP-6), and most likely increases susceptibility to Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11).", "compensating_control_1": { "control_id": "CPL-02", "name": "Statutory, Regulatory & Contractual Compliance", "description": "Mechanisms exist to facilitate the identification and implementation of relevant statutory, regulatory and contractual controls.", "justification": "Statutory, Regulatory & Contractual Compliance (CPL-02) provides overlapping security capability that compensates for the absence of Reasonable Data Privacy Practices (PRI-09) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "PRI-02", "name": "Data Privacy Program", "description": "Mechanisms exist to facilitate the implementation and operation of data protection controls throughout the data lifecycle to ensure all forms of Personal Data (PD) are processed lawfully, fairly and transparently.", "justification": "Data Privacy Program (PRI-02) provides policy-level governance that compensates for the absence of Reasonable Data Privacy Practices (PRI-09) by establishing documented expectations, accountability structures, and organizational guardrails. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "PRI-10", "risk_if_not_implemented": "Without Security of Personal Data (PD), Personal Data (PD) may be collected, processed, retained or shared without lawful authority or adequate safeguards, harming individuals and exposing the organization to regulatory action. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to R-AC-4, R-EX-5, R-GV-2, R-IP-2, R-IP-3, R-IP-6, and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Physical Crime (MT-5), Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11).", "compensating_control_1": { "control_id": "PRI-02", "name": "Data Privacy Program", "description": "Mechanisms exist to facilitate the implementation and operation of data protection controls throughout the data lifecycle to ensure all forms of Personal Data (PD) are processed lawfully, fairly and transparently.", "justification": "Data Privacy Program (PRI-02) provides policy-level governance that compensates for the absence of Security of Personal Data (PD) (PRI-10) by establishing documented expectations, accountability structures, and organizational guardrails. Given the data-handling focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CPL-05", "name": "Conformity Monitoring", "description": "Mechanisms exist to validate that Technology Assets, Applications, Services and/or Data (TAASD) conform to the organization's security, compliance and/or resilience policies, standards and other applicable requirements.", "justification": "Conformity Monitoring (CPL-05) provides periodic assessment and assurance that compensates for the absence of Security of Personal Data (PD) (PRI-10) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the data-handling focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "PRI-11", "risk_if_not_implemented": "Without Personal Data (PD) Control Testing, Training & Monitoring, personnel are more likely to make unsafe decisions, fall victim to social engineering, mishandle data or violate requirements. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Regulatory / Legal / Contractual Financial Liability (R-EX-5), Lack of oversight of internal controls (R-GV-6), Inability to Demonstrate Due Diligence / Due Care (R-GV-9), Undetected / Delayed Detection of Adverse Activity (R-SA-1), Lack of a security-minded workforce (R-SA-2), and most likely increases susceptibility to Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11).", "compensating_control_1": { "control_id": "CPL-05", "name": "Conformity Monitoring", "description": "Mechanisms exist to validate that Technology Assets, Applications, Services and/or Data (TAASD) conform to the organization's security, compliance and/or resilience policies, standards and other applicable requirements.", "justification": "Conformity Monitoring (CPL-05) provides periodic assessment and assurance that compensates for the absence of Personal Data (PD) Control Testing, Training & Monitoring (PRI-11) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "MON-02", "name": "Continuous Monitoring", "description": "Mechanisms exist to facilitate the implementation of enterprise-wide monitoring controls.", "justification": "Continuous Monitoring (MON-02) provides detective monitoring capability that compensates for the absence of Personal Data (PD) Control Testing, Training & Monitoring (PRI-11) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "PRI-12", "risk_if_not_implemented": "Without Authority To Collect, Process, Store & Share Personal Data (PD), Personal Data (PD) may be collected, processed, retained or shared without lawful authority or adequate safeguards, harming individuals and exposing the organization to regulatory action. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Regulatory / Legal / Contractual Financial Liability (R-EX-5), Inability to Demonstrate Due Diligence / Due Care (R-GV-9), Privacy Harm / Unauthorized Processing (R-IP-6), and most likely increases susceptibility to Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11).", "compensating_control_1": { "control_id": "DCH-24.1", "name": "Data Mining Protection", "description": "Mechanisms exist to protect data storage objects against unauthorized data mining and data harvesting techniques.", "justification": "Data Mining Protection (DCH-24.1) provides overlapping security capability that compensates for the absence of Authority To Collect, Process, Store & Share Personal Data (PD) (PRI-12) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "IAC-25", "name": "Access Enforcement", "description": "Mechanisms exist to enforce Logical Access Control (LAC) permissions that conform to the principle of \"least privilege.\"", "justification": "Access Enforcement (IAC-25) provides access control enforcement that compensates for the absence of Authority To Collect, Process, Store & Share Personal Data (PD) (PRI-12) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "PRI-13", "risk_if_not_implemented": "Without Product or Service Delivery Restrictions, delivered products or services may contain defects, unsafe behavior or unverified components that cause downstream harm. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Regulatory / Legal / Contractual Financial Liability (R-EX-5), Privacy Harm / Unauthorized Processing (R-IP-6), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11), Data Quality Degradation / Data Poisoning (MT-12).", "compensating_control_1": { "control_id": "PRI-21", "name": "Data Privacy Notice", "description": "Mechanisms exist to:\n(1) Make data privacy notice(s) available to individuals upon first interacting with an organization and subsequently as necessary; \n(2) Ensure that data privacy notices are clear and easy-to-understand, expressing relevant information about how Personal Data (PD) is collected, received, processed, stored, transmitted, shared, updated and/or disposed;\n(3) Contain all necessary notice-related criteria required by applicable statutory, regulatory and contractual obligations;\n(4) Define the scope of PD processing activities, including the geographic locations and third-party recipients that process the PD within the scope of the data privacy notice;\n(5) Periodically, review and update the content of the privacy notice, as necessary; and\n(6) Retain prior versions of the privacy notice, in accordance with data retention requirements.", "justification": "Data Privacy Notice (PRI-21) provides privacy protection that compensates for the absence of Product or Service Delivery Restrictions (PRI-13) by applying alternative privacy safeguards to protect personal data and honor data subject rights. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "PRI-24", "name": "Data Subject Consent", "description": "Mechanisms exist to enable data subjects to authorize the collection, receipt, processing, storage, transmission, sharing, updating and/or disposal of their Personal Data (PD), where the data subject is provided, prior to collection, with:\n(1) Plain language explaining the potential data privacy risks of the authorization;\n(2) A means to decline the authorization; and\n(3) Necessary choice and consent-related criteria required by applicable statutory, regulatory and contractual obligations.", "justification": "Data Subject Consent (PRI-24) provides privacy protection that compensates for the absence of Product or Service Delivery Restrictions (PRI-13) by applying alternative privacy safeguards to protect personal data and honor data subject rights. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "PRI-15", "risk_if_not_implemented": "Without Binding Corporate Rules (BCR), Personal Data (PD) may be collected, processed, retained or shared without lawful authority or adequate safeguards, harming individuals and exposing the organization to regulatory action. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Contractual Default / Termination (R-EX-2), Regulatory / Legal / Contractual Financial Liability (R-EX-5), Loss of Authorization / Certification / License (R-EX-11), Inability to Demonstrate Due Diligence / Due Care (R-GV-9), Privacy Harm / Unauthorized Processing (R-IP-6), and most likely increases susceptibility to Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11).", "compensating_control_1": { "control_id": "HRS-04", "name": "Defined Roles & Responsibilities", "description": "Mechanisms exist to define cybersecurity roles & responsibilities for all personnel.", "justification": "Defined Roles & Responsibilities (HRS-04) provides overlapping security capability that compensates for the absence of Binding Corporate Rules (BCR) (PRI-15) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "SAT-05", "name": "Role-Based Security, Compliance & Resilience Training", "description": "Mechanisms exist to provide role-based security, compliance and resilience-related training: \n(1) Before authorizing access to the system or performing assigned duties; \n(2) When required by system changes; and \n(3) Annually thereafter.", "justification": "Role-Based Security, Compliance & Resilience Training (SAT-05) provides personnel training and awareness that compensates for the absence of Binding Corporate Rules (BCR) (PRI-15) by reducing human-factor risk by equipping personnel to recognize and respond to relevant threats. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "PRI-16", "risk_if_not_implemented": "Without Information Sharing With Third Parties, supplier and External Service Provider (ESP) weaknesses, incidents or failures may propagate into the organization's environment unmanaged. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Access (R-AC-4), Regulatory / Legal / Contractual Financial Liability (R-EX-5), Loss of Confidentiality (R-IP-2), Privacy Harm / Unauthorized Processing (R-IP-6), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11), Data Quality Degradation / Data Poisoning (MT-12).", "compensating_control_1": { "control_id": "TPM-14", "name": "Third-Party Contract Requirements", "description": "Mechanisms exist to require contractual requirements for applicable security, compliance and resilience requirements with third-parties, reflecting the organization's needs to protect its Technology Assets, Applications, Services and/or Data (TAASD).", "justification": "Third-Party Contract Requirements (TPM-14) provides third-party oversight that compensates for the absence of Information Sharing With Third Parties (PRI-16) by extending security obligations contractually and monitoring third-party risk in lieu of direct control. Given the data-handling focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "DCH-08.1", "name": "Sensitive / Regulated Data Sharing Decisions", "description": "Mechanisms exist to utilize a process to assist users in making information sharing decisions to ensure data is appropriately protected.", "justification": "Sensitive / Regulated Data Sharing Decisions (DCH-08.1) provides overlapping security capability that compensates for the absence of Information Sharing With Third Parties (PRI-16) by addressing related risk objectives through an alternative control mechanism aligned with Data applicability. Given the data-handling focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "PRI-17", "risk_if_not_implemented": "Without Limiting Personal Data (PD) Disclosures, Personal Data (PD) may be collected, processed, retained or shared without lawful authority or adequate safeguards, harming individuals and exposing the organization to regulatory action. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Access (R-AC-4), Regulatory / Legal / Contractual Financial Liability (R-EX-5), Loss of Confidentiality (R-IP-2), Privacy Harm / Unauthorized Processing (R-IP-6), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11).", "compensating_control_1": { "control_id": "PRI-02", "name": "Data Privacy Program", "description": "Mechanisms exist to facilitate the implementation and operation of data protection controls throughout the data lifecycle to ensure all forms of Personal Data (PD) are processed lawfully, fairly and transparently.", "justification": "Data Privacy Program (PRI-02) provides policy-level governance that compensates for the absence of Limiting Personal Data (PD) Disclosures (PRI-01.7) by establishing documented expectations, accountability structures, and organizational guardrails. Given the data-handling focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CPL-02", "name": "Statutory, Regulatory & Contractual Compliance", "description": "Mechanisms exist to facilitate the identification and implementation of relevant statutory, regulatory and contractual controls.", "justification": "Statutory, Regulatory & Contractual Compliance (CPL-02) provides overlapping security capability that compensates for the absence of Limiting Personal Data (PD) Disclosures (PRI-01.7) by addressing related risk objectives through an alternative control mechanism aligned with Data applicability. Given the data-handling focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "PRI-17.1", "risk_if_not_implemented": "Without Accounting of Disclosures, unauthorized individuals, devices or services may gain access to Technology Assets, Applications, Services, Data and/or Facilities (TAASDF). Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss of Accountability / Attribution (R-AC-1), Regulatory / Legal / Contractual Financial Liability (R-EX-5), Inability to Demonstrate Due Diligence / Due Care (R-GV-9), Privacy Harm / Unauthorized Processing (R-IP-6), and most likely increases susceptibility to Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11), Data Quality Degradation / Data Poisoning (MT-12).", "compensating_control_1": { "control_id": "CPL-02", "name": "Statutory, Regulatory & Contractual Compliance", "description": "Mechanisms exist to facilitate the identification and implementation of relevant statutory, regulatory and contractual controls.", "justification": "Statutory, Regulatory & Contractual Compliance (CPL-02) provides overlapping security capability that compensates for the absence of Accounting of Disclosures (PRI-17.1) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "DCH-03", "name": "Sensitive / Regulated Data Governance", "description": "Mechanisms exist to facilitate data governance so that sensitive and/or regulated data is effectively managed and maintained in accordance with applicable statutory, regulatory and contractual obligations.", "justification": "Sensitive / Regulated Data Governance (DCH-03) provides policy-level governance that compensates for the absence of Accounting of Disclosures (PRI-17.1) by establishing documented expectations, accountability structures, and organizational guardrails. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "PRI-18", "risk_if_not_implemented": "Without Notification of Disclosure Requests To Data Subject, Personal Data (PD) may be collected, processed, retained or shared without lawful authority or adequate safeguards, harming individuals and exposing the organization to regulatory action. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Regulatory / Legal / Contractual Financial Liability (R-EX-5), Privacy Harm / Unauthorized Processing (R-IP-6), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11), Geopolitical Conflict / Government Intervention (MT-18).", "compensating_control_1": { "control_id": "DCH-03", "name": "Sensitive / Regulated Data Governance", "description": "Mechanisms exist to facilitate data governance so that sensitive and/or regulated data is effectively managed and maintained in accordance with applicable statutory, regulatory and contractual obligations.", "justification": "Sensitive / Regulated Data Governance (DCH-03) provides policy-level governance that compensates for the absence of Notification of Disclosure Request To Data Subject (PRI-18) by establishing documented expectations, accountability structures, and organizational guardrails. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "PRI-05", "name": "Documenting Data Processing Activities", "description": "Mechanisms exist to document Personal Data (PD) processing activities that covers collection, receiving, processing, storage, transmission, sharing, updating and/or disposal actions with sufficient detail to demonstrate conformity with applicable statutory, regulatory and contractual requirements.", "justification": "Documenting Data Processing Activities (PRI-05) provides overlapping security capability that compensates for the absence of Notification of Disclosure Request To Data Subject (PRI-18) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "PRI-18.1", "risk_if_not_implemented": "Without Disclosure Request Rejections, Personal Data (PD) may be collected, processed, retained or shared without lawful authority or adequate safeguards, harming individuals and exposing the organization to regulatory action. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to R-AC-4, R-AC-5, R-BC-5, R-EX-5, R-IP-2, R-IP-6, and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11), Fraud, Corruption and/or Intentional Criminal Conduct (MT-14).", "compensating_control_1": { "control_id": "DCH-08.1", "name": "Sensitive / Regulated Data Sharing Decisions", "description": "Mechanisms exist to utilize a process to assist users in making information sharing decisions to ensure data is appropriately protected.", "justification": "Sensitive / Regulated Data Sharing Decisions (DCH-08.1) provides overlapping security capability that compensates for the absence of Reject Unauthenticated or Untrustworthy Disclosure Requests (PRI-18.1) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "PRI-16", "name": "Information Sharing With Third Parties", "description": "Mechanisms exist to disclose Personal Data (PD) to third-parties only for the purposes identified in the data privacy notice and with the implicit or explicit consent of the data subject.", "justification": "Information Sharing With Third Parties (PRI-16) provides third-party oversight that compensates for the absence of Reject Unauthenticated or Untrustworthy Disclosure Requests (PRI-18.1) by extending security obligations contractually and monitoring third-party risk in lieu of direct control. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "PRI-18.2", "risk_if_not_implemented": "Without Justification To Reject Disclosure Requests, Personal Data (PD) may be collected, processed, retained or shared without lawful authority or adequate safeguards, harming individuals and exposing the organization to regulatory action. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Regulatory / Legal / Contractual Financial Liability (R-EX-5), Inability to Demonstrate Due Diligence / Due Care (R-GV-9), Privacy Harm / Unauthorized Processing (R-IP-6), and most likely increases susceptibility to Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11).", "compensating_control_1": { "control_id": "TPM-14", "name": "Third-Party Contract Requirements", "description": "Mechanisms exist to require contractual requirements for applicable security, compliance and resilience requirements with third-parties, reflecting the organization's needs to protect its Technology Assets, Applications, Services and/or Data (TAASD).", "justification": "Third-Party Contract Requirements (TPM-14) provides third-party oversight that compensates for the absence of Justification To Reject Disclosure Requests (PRI-18.2) by extending security obligations contractually and monitoring third-party risk in lieu of direct control. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "PRI-16", "name": "Information Sharing With Third Parties", "description": "Mechanisms exist to disclose Personal Data (PD) to third-parties only for the purposes identified in the data privacy notice and with the implicit or explicit consent of the data subject.", "justification": "Information Sharing With Third Parties (PRI-16) provides third-party oversight that compensates for the absence of Justification To Reject Disclosure Requests (PRI-18.2) by extending security obligations contractually and monitoring third-party risk in lieu of direct control. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "PRI-19", "risk_if_not_implemented": "Without Financial Incentives For Personal Data (PD), Personal Data (PD) may be collected, processed, retained or shared without lawful authority or adequate safeguards, harming individuals and exposing the organization to regulatory action. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Regulatory / Legal / Contractual Financial Liability (R-EX-5), Privacy Harm / Unauthorized Processing (R-IP-6), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11).", "compensating_control_1": { "control_id": "PRI-02", "name": "Data Privacy Program", "description": "Mechanisms exist to facilitate the implementation and operation of data protection controls throughout the data lifecycle to ensure all forms of Personal Data (PD) are processed lawfully, fairly and transparently.", "justification": "Data Privacy Program (PRI-02) provides policy-level governance that compensates for the absence of Financial Incentives For Personal Data (PD) (PRI-19) by establishing documented expectations, accountability structures, and organizational guardrails. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "DCH-03", "name": "Sensitive / Regulated Data Governance", "description": "Mechanisms exist to facilitate data governance so that sensitive and/or regulated data is effectively managed and maintained in accordance with applicable statutory, regulatory and contractual obligations.", "justification": "Sensitive / Regulated Data Governance (DCH-03) provides policy-level governance that compensates for the absence of Financial Incentives For Personal Data (PD) (PRI-19) by establishing documented expectations, accountability structures, and organizational guardrails. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "PRI-19.1", "risk_if_not_implemented": "Without Notice of Financial Incentive, Personal Data (PD) may be collected, processed, retained or shared without lawful authority or adequate safeguards, harming individuals and exposing the organization to regulatory action. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Regulatory / Legal / Contractual Financial Liability (R-EX-5), Inability to Demonstrate Due Diligence / Due Care (R-GV-9), Privacy Harm / Unauthorized Processing (R-IP-6), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11).", "compensating_control_1": { "control_id": "PRI-37", "name": "Data Subject Communications", "description": "Mechanisms exist to craft disclosures and communications to data subjects in a manner that is concise, unambiguous and understandable by a reasonable person.", "justification": "Data Subject Communications (PRI-37) provides privacy protection that compensates for the absence of Notice of Financial Incentive (PRI-19.1) by applying alternative privacy safeguards to protect personal data and honor data subject rights. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CPL-02", "name": "Statutory, Regulatory & Contractual Compliance", "description": "Mechanisms exist to facilitate the identification and implementation of relevant statutory, regulatory and contractual controls.", "justification": "Statutory, Regulatory & Contractual Compliance (CPL-02) provides overlapping security capability that compensates for the absence of Notice of Financial Incentive (PRI-19.1) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "PRI-20", "risk_if_not_implemented": "Without Dissemination of Data Privacy Program Information, Personal Data (PD) may be collected, processed, retained or shared without lawful authority or adequate safeguards, harming individuals and exposing the organization to regulatory action. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Regulatory / Legal / Contractual Financial Liability (R-EX-5), Inability to Demonstrate Due Diligence / Due Care (R-GV-9), Privacy Harm / Unauthorized Processing (R-IP-6), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11).", "compensating_control_1": { "control_id": "CPL-02", "name": "Statutory, Regulatory & Contractual Compliance", "description": "Mechanisms exist to facilitate the identification and implementation of relevant statutory, regulatory and contractual controls.", "justification": "Statutory, Regulatory & Contractual Compliance (CPL-02) provides overlapping security capability that compensates for the absence of Dissemination of Data Privacy Program Information (PRI-20) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "PRI-11", "name": "Personal Data (PD) Control Testing, Training & Monitoring", "description": "Mechanisms exist to conduct testing, training and monitoring activities for Personal Data (PD) controls.", "justification": "Personal Data (PD) Control Testing, Training & Monitoring (PRI-11) provides detective monitoring capability that compensates for the absence of Dissemination of Data Privacy Program Information (PRI-20) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "PRI-20.1", "risk_if_not_implemented": "Without Privacy Act Statements, Personal Data (PD) may be collected, processed, retained or shared without lawful authority or adequate safeguards, harming individuals and exposing the organization to regulatory action. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Regulatory / Legal / Contractual Financial Liability (R-EX-5), Inability to Demonstrate Due Diligence / Due Care (R-GV-9), Privacy Harm / Unauthorized Processing (R-IP-6), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11).", "compensating_control_1": { "control_id": "CPL-02", "name": "Statutory, Regulatory & Contractual Compliance", "description": "Mechanisms exist to facilitate the identification and implementation of relevant statutory, regulatory and contractual controls.", "justification": "Statutory, Regulatory & Contractual Compliance (CPL-02) provides overlapping security capability that compensates for the absence of Privacy Act Statements (PRI-20.1) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "DCH-03", "name": "Sensitive / Regulated Data Governance", "description": "Mechanisms exist to facilitate data governance so that sensitive and/or regulated data is effectively managed and maintained in accordance with applicable statutory, regulatory and contractual obligations.", "justification": "Sensitive / Regulated Data Governance (DCH-03) provides policy-level governance that compensates for the absence of Privacy Act Statements (PRI-20.1) by establishing documented expectations, accountability structures, and organizational guardrails. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "PRI-20.2", "risk_if_not_implemented": "Without Privacy Act Exemptions, Personal Data (PD) may be collected, processed, retained or shared without lawful authority or adequate safeguards, harming individuals and exposing the organization to regulatory action. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Regulatory / Legal / Contractual Financial Liability (R-EX-5), Lack of oversight of internal controls (R-GV-6), Inability to Demonstrate Due Diligence / Due Care (R-GV-9), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11), Workforce Shortage / Loss of Critical Skills / Labor Disruption (MT-25).", "compensating_control_1": { "control_id": "PRI-21", "name": "Data Privacy Notice", "description": "Mechanisms exist to:\n(1) Make data privacy notice(s) available to individuals upon first interacting with an organization and subsequently as necessary; \n(2) Ensure that data privacy notices are clear and easy-to-understand, expressing relevant information about how Personal Data (PD) is collected, received, processed, stored, transmitted, shared, updated and/or disposed;\n(3) Contain all necessary notice-related criteria required by applicable statutory, regulatory and contractual obligations;\n(4) Define the scope of PD processing activities, including the geographic locations and third-party recipients that process the PD within the scope of the data privacy notice;\n(5) Periodically, review and update the content of the privacy notice, as necessary; and\n(6) Retain prior versions of the privacy notice, in accordance with data retention requirements.", "justification": "Data Privacy Notice (PRI-21) provides privacy protection that compensates for the absence of Privacy Act Exemptions (PRI-20.2) by applying alternative privacy safeguards to protect personal data and honor data subject rights. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CPL-02", "name": "Statutory, Regulatory & Contractual Compliance", "description": "Mechanisms exist to facilitate the identification and implementation of relevant statutory, regulatory and contractual controls.", "justification": "Statutory, Regulatory & Contractual Compliance (CPL-02) provides overlapping security capability that compensates for the absence of Privacy Act Exemptions (PRI-20.2) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "PRI-20.3", "risk_if_not_implemented": "Without System of Records Notice (SORN), Personal Data (PD) may be collected, processed, retained or shared without lawful authority or adequate safeguards, harming individuals and exposing the organization to regulatory action. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Regulatory / Legal / Contractual Financial Liability (R-EX-5), Inability to Demonstrate Due Diligence / Due Care (R-GV-9), Privacy Harm / Unauthorized Processing (R-IP-6), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11).", "compensating_control_1": { "control_id": "DCH-04", "name": "Data & Asset Classification", "description": "Mechanisms exist to ensure data and assets are categorized in accordance with applicable statutory, regulatory and contractual requirements.", "justification": "Data & Asset Classification (DCH-04) provides overlapping security capability that compensates for the absence of System of Records Notice (SORN) (PRI-20.3) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "PRI-21", "name": "Data Privacy Notice", "description": "Mechanisms exist to:\n(1) Make data privacy notice(s) available to individuals upon first interacting with an organization and subsequently as necessary; \n(2) Ensure that data privacy notices are clear and easy-to-understand, expressing relevant information about how Personal Data (PD) is collected, received, processed, stored, transmitted, shared, updated and/or disposed;\n(3) Contain all necessary notice-related criteria required by applicable statutory, regulatory and contractual obligations;\n(4) Define the scope of PD processing activities, including the geographic locations and third-party recipients that process the PD within the scope of the data privacy notice;\n(5) Periodically, review and update the content of the privacy notice, as necessary; and\n(6) Retain prior versions of the privacy notice, in accordance with data retention requirements.", "justification": "Data Privacy Notice (PRI-21) provides privacy protection that compensates for the absence of System of Records Notice (SORN) (PRI-20.3) by applying alternative privacy safeguards to protect personal data and honor data subject rights. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "PRI-20.4", "risk_if_not_implemented": "Without System of Records Notice (SORN) Review Process, Personal Data (PD) may be collected, processed, retained or shared without lawful authority or adequate safeguards, harming individuals and exposing the organization to regulatory action. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Regulatory / Legal / Contractual Financial Liability (R-EX-5), Lack of oversight of internal controls (R-GV-6), Inability to Demonstrate Due Diligence / Due Care (R-GV-9), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11), Workforce Shortage / Loss of Critical Skills / Labor Disruption (MT-25).", "compensating_control_1": { "control_id": "CPL-02", "name": "Statutory, Regulatory & Contractual Compliance", "description": "Mechanisms exist to facilitate the identification and implementation of relevant statutory, regulatory and contractual controls.", "justification": "Statutory, Regulatory & Contractual Compliance (CPL-02) provides overlapping security capability that compensates for the absence of System of Records Notice (SORN) Review Process (PRI-20.4) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "DCH-04", "name": "Data & Asset Classification", "description": "Mechanisms exist to ensure data and assets are categorized in accordance with applicable statutory, regulatory and contractual requirements.", "justification": "Data & Asset Classification (DCH-04) provides overlapping security capability that compensates for the absence of System of Records Notice (SORN) Review Process (PRI-20.4) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "PRI-20.5", "risk_if_not_implemented": "Without Computer Matching Agreements (CMA), Personal Data (PD) may be collected, processed, retained or shared without lawful authority or adequate safeguards, harming individuals and exposing the organization to regulatory action. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Regulatory / Legal / Contractual Financial Liability (R-EX-5), Inability to Demonstrate Due Diligence / Due Care (R-GV-9), Privacy Harm / Unauthorized Processing (R-IP-6), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11).", "compensating_control_1": { "control_id": "PRI-21", "name": "Data Privacy Notice", "description": "Mechanisms exist to:\n(1) Make data privacy notice(s) available to individuals upon first interacting with an organization and subsequently as necessary; \n(2) Ensure that data privacy notices are clear and easy-to-understand, expressing relevant information about how Personal Data (PD) is collected, received, processed, stored, transmitted, shared, updated and/or disposed;\n(3) Contain all necessary notice-related criteria required by applicable statutory, regulatory and contractual obligations;\n(4) Define the scope of PD processing activities, including the geographic locations and third-party recipients that process the PD within the scope of the data privacy notice;\n(5) Periodically, review and update the content of the privacy notice, as necessary; and\n(6) Retain prior versions of the privacy notice, in accordance with data retention requirements.", "justification": "Data Privacy Notice (PRI-21) provides privacy protection that compensates for the absence of Computer Matching Agreements (CMA) (PRI-20.5) by applying alternative privacy safeguards to protect personal data and honor data subject rights. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "DCH-04", "name": "Data & Asset Classification", "description": "Mechanisms exist to ensure data and assets are categorized in accordance with applicable statutory, regulatory and contractual requirements.", "justification": "Data & Asset Classification (DCH-04) provides overlapping security capability that compensates for the absence of Computer Matching Agreements (CMA) (PRI-20.5) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "PRI-21", "risk_if_not_implemented": "Without Data Privacy Notice, Personal Data (PD) may be collected, processed, retained or shared without lawful authority or adequate safeguards, harming individuals and exposing the organization to regulatory action. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Regulatory / Legal / Contractual Financial Liability (R-EX-5), Inability to Demonstrate Due Diligence / Due Care (R-GV-9), Privacy Harm / Unauthorized Processing (R-IP-6), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11).", "compensating_control_1": { "control_id": "DCH-04", "name": "Data & Asset Classification", "description": "Mechanisms exist to ensure data and assets are categorized in accordance with applicable statutory, regulatory and contractual requirements.", "justification": "Data & Asset Classification (DCH-04) provides overlapping security capability that compensates for the absence of Data Privacy Notice (PRI-21) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CPL-02", "name": "Statutory, Regulatory & Contractual Compliance", "description": "Mechanisms exist to facilitate the identification and implementation of relevant statutory, regulatory and contractual controls.", "justification": "Statutory, Regulatory & Contractual Compliance (CPL-02) provides overlapping security capability that compensates for the absence of Data Privacy Notice (PRI-21) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "PRI-21.1", "risk_if_not_implemented": "Without Privacy Notice Formatting, Personal Data (PD) may be collected, processed, retained or shared without lawful authority or adequate safeguards, harming individuals and exposing the organization to regulatory action. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Regulatory / Legal / Contractual Financial Liability (R-EX-5), Inability to Demonstrate Due Diligence / Due Care (R-GV-9), Privacy Harm / Unauthorized Processing (R-IP-6), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11).", "compensating_control_1": { "control_id": "PRI-21", "name": "Data Privacy Notice", "description": "Mechanisms exist to:\n(1) Make data privacy notice(s) available to individuals upon first interacting with an organization and subsequently as necessary; \n(2) Ensure that data privacy notices are clear and easy-to-understand, expressing relevant information about how Personal Data (PD) is collected, received, processed, stored, transmitted, shared, updated and/or disposed;\n(3) Contain all necessary notice-related criteria required by applicable statutory, regulatory and contractual obligations;\n(4) Define the scope of PD processing activities, including the geographic locations and third-party recipients that process the PD within the scope of the data privacy notice;\n(5) Periodically, review and update the content of the privacy notice, as necessary; and\n(6) Retain prior versions of the privacy notice, in accordance with data retention requirements.", "justification": "Data Privacy Notice (PRI-21) provides privacy protection that compensates for the absence of Privacy Notice Formatting (PRI-21.1) by applying alternative privacy safeguards to protect personal data and honor data subject rights. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "DCH-37", "name": "Cybersecurity & Data Protection Attributes", "description": "Mechanisms exist to bind cybersecurity and data protection attributes to information as it is stored, transmitted and processed.", "justification": "Cybersecurity & Data Protection Attributes (DCH-37) provides overlapping security capability that compensates for the absence of Privacy Notice Formatting (PRI-21.1) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "PRI-21.2", "risk_if_not_implemented": "Without Conspicuous Link To Data Privacy Notice, Personal Data (PD) may be collected, processed, retained or shared without lawful authority or adequate safeguards, harming individuals and exposing the organization to regulatory action. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Regulatory / Legal / Contractual Financial Liability (R-EX-5), Inability to Demonstrate Due Diligence / Due Care (R-GV-9), Privacy Harm / Unauthorized Processing (R-IP-6), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11).", "compensating_control_1": { "control_id": "CPL-02", "name": "Statutory, Regulatory & Contractual Compliance", "description": "Mechanisms exist to facilitate the identification and implementation of relevant statutory, regulatory and contractual controls.", "justification": "Statutory, Regulatory & Contractual Compliance (CPL-02) provides overlapping security capability that compensates for the absence of Conspicuous Link To Data Privacy Notice (PRI-21.2) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "PRI-21", "name": "Data Privacy Notice", "description": "Mechanisms exist to:\n(1) Make data privacy notice(s) available to individuals upon first interacting with an organization and subsequently as necessary; \n(2) Ensure that data privacy notices are clear and easy-to-understand, expressing relevant information about how Personal Data (PD) is collected, received, processed, stored, transmitted, shared, updated and/or disposed;\n(3) Contain all necessary notice-related criteria required by applicable statutory, regulatory and contractual obligations;\n(4) Define the scope of PD processing activities, including the geographic locations and third-party recipients that process the PD within the scope of the data privacy notice;\n(5) Periodically, review and update the content of the privacy notice, as necessary; and\n(6) Retain prior versions of the privacy notice, in accordance with data retention requirements.", "justification": "Data Privacy Notice (PRI-21) provides privacy protection that compensates for the absence of Conspicuous Link To Data Privacy Notice (PRI-21.2) by applying alternative privacy safeguards to protect personal data and honor data subject rights. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "PRI-21.3", "risk_if_not_implemented": "Without Alternative Means To Deliver Privacy Notice, Personal Data (PD) may be collected, processed, retained or shared without lawful authority or adequate safeguards, harming individuals and exposing the organization to regulatory action. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Regulatory / Legal / Contractual Financial Liability (R-EX-5), Inability to Demonstrate Due Diligence / Due Care (R-GV-9), Privacy Harm / Unauthorized Processing (R-IP-6), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11).", "compensating_control_1": { "control_id": "PRI-21", "name": "Data Privacy Notice", "description": "Mechanisms exist to:\n(1) Make data privacy notice(s) available to individuals upon first interacting with an organization and subsequently as necessary; \n(2) Ensure that data privacy notices are clear and easy-to-understand, expressing relevant information about how Personal Data (PD) is collected, received, processed, stored, transmitted, shared, updated and/or disposed;\n(3) Contain all necessary notice-related criteria required by applicable statutory, regulatory and contractual obligations;\n(4) Define the scope of PD processing activities, including the geographic locations and third-party recipients that process the PD within the scope of the data privacy notice;\n(5) Periodically, review and update the content of the privacy notice, as necessary; and\n(6) Retain prior versions of the privacy notice, in accordance with data retention requirements.", "justification": "Data Privacy Notice (PRI-21) provides privacy protection that compensates for the absence of Alternative Means To Deliver Privacy Notice (PRI-21.3) by applying alternative privacy safeguards to protect personal data and honor data subject rights. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CPL-02", "name": "Statutory, Regulatory & Contractual Compliance", "description": "Mechanisms exist to facilitate the identification and implementation of relevant statutory, regulatory and contractual controls.", "justification": "Statutory, Regulatory & Contractual Compliance (CPL-02) provides overlapping security capability that compensates for the absence of Alternative Means To Deliver Privacy Notice (PRI-21.3) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "PRI-21.4", "risk_if_not_implemented": "Without Notice of Right To Limit, Personal Data (PD) may be collected, processed, retained or shared without lawful authority or adequate safeguards, harming individuals and exposing the organization to regulatory action. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Regulatory / Legal / Contractual Financial Liability (R-EX-5), Inability to Demonstrate Due Diligence / Due Care (R-GV-9), Privacy Harm / Unauthorized Processing (R-IP-6), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11).", "compensating_control_1": { "control_id": "CPL-02", "name": "Statutory, Regulatory & Contractual Compliance", "description": "Mechanisms exist to facilitate the identification and implementation of relevant statutory, regulatory and contractual controls.", "justification": "Statutory, Regulatory & Contractual Compliance (CPL-02) provides overlapping security capability that compensates for the absence of Notice of Right To Limit (PRI-21.4) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "PRI-21", "name": "Data Privacy Notice", "description": "Mechanisms exist to:\n(1) Make data privacy notice(s) available to individuals upon first interacting with an organization and subsequently as necessary; \n(2) Ensure that data privacy notices are clear and easy-to-understand, expressing relevant information about how Personal Data (PD) is collected, received, processed, stored, transmitted, shared, updated and/or disposed;\n(3) Contain all necessary notice-related criteria required by applicable statutory, regulatory and contractual obligations;\n(4) Define the scope of PD processing activities, including the geographic locations and third-party recipients that process the PD within the scope of the data privacy notice;\n(5) Periodically, review and update the content of the privacy notice, as necessary; and\n(6) Retain prior versions of the privacy notice, in accordance with data retention requirements.", "justification": "Data Privacy Notice (PRI-21) provides privacy protection that compensates for the absence of Notice of Right To Limit (PRI-21.4) by applying alternative privacy safeguards to protect personal data and honor data subject rights. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "PRI-21.5", "risk_if_not_implemented": "Without Real-Time or Layered Notice, Personal Data (PD) may be collected, processed, retained or shared without lawful authority or adequate safeguards, harming individuals and exposing the organization to regulatory action. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Regulatory / Legal / Contractual Financial Liability (R-EX-5), Privacy Harm / Unauthorized Processing (R-IP-6), and most likely increases susceptibility to Human Error (MT-9), Technical / Mechanical Failure (MT-10), Statutory / Regulatory / Contractual Change (MT-11).", "compensating_control_1": { "control_id": "DCH-37", "name": "Cybersecurity & Data Protection Attributes", "description": "Mechanisms exist to bind cybersecurity and data protection attributes to information as it is stored, transmitted and processed.", "justification": "Cybersecurity & Data Protection Attributes (DCH-37) provides overlapping security capability that compensates for the absence of Real-Time or Layered Notice (PRI-21.5) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CPL-02", "name": "Statutory, Regulatory & Contractual Compliance", "description": "Mechanisms exist to facilitate the identification and implementation of relevant statutory, regulatory and contractual controls.", "justification": "Statutory, Regulatory & Contractual Compliance (CPL-02) provides overlapping security capability that compensates for the absence of Real-Time or Layered Notice (PRI-21.5) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "PRI-22", "risk_if_not_implemented": "Without Purpose Specification, Personal Data (PD) may be collected, processed, retained or shared without lawful authority or adequate safeguards, harming individuals and exposing the organization to regulatory action. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Regulatory / Legal / Contractual Financial Liability (R-EX-5), Privacy Harm / Unauthorized Processing (R-IP-6), and most likely increases susceptibility to Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11).", "compensating_control_1": { "control_id": "DCH-37", "name": "Cybersecurity & Data Protection Attributes", "description": "Mechanisms exist to bind cybersecurity and data protection attributes to information as it is stored, transmitted and processed.", "justification": "Cybersecurity & Data Protection Attributes (DCH-37) provides overlapping security capability that compensates for the absence of Purpose Specification (PRI-22) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "PRI-21", "name": "Data Privacy Notice", "description": "Mechanisms exist to:\n(1) Make data privacy notice(s) available to individuals upon first interacting with an organization and subsequently as necessary; \n(2) Ensure that data privacy notices are clear and easy-to-understand, expressing relevant information about how Personal Data (PD) is collected, received, processed, stored, transmitted, shared, updated and/or disposed;\n(3) Contain all necessary notice-related criteria required by applicable statutory, regulatory and contractual obligations;\n(4) Define the scope of PD processing activities, including the geographic locations and third-party recipients that process the PD within the scope of the data privacy notice;\n(5) Periodically, review and update the content of the privacy notice, as necessary; and\n(6) Retain prior versions of the privacy notice, in accordance with data retention requirements.", "justification": "Data Privacy Notice (PRI-21) provides privacy protection that compensates for the absence of Purpose Specification (PRI-22) by applying alternative privacy safeguards to protect personal data and honor data subject rights. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "PRI-22.1", "risk_if_not_implemented": "Without Purpose Compatibility, Personal Data (PD) may be collected, processed, retained or shared without lawful authority or adequate safeguards, harming individuals and exposing the organization to regulatory action. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Lack of oversight of internal controls (R-GV-6), and most likely increases susceptibility to Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11).", "compensating_control_1": { "control_id": "CPL-02", "name": "Statutory, Regulatory & Contractual Compliance", "description": "Mechanisms exist to facilitate the identification and implementation of relevant statutory, regulatory and contractual controls.", "justification": "Statutory, Regulatory & Contractual Compliance (CPL-02) provides overlapping security capability that compensates for the absence of Purpose Compatibility (PRI-22.1) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "DCH-37", "name": "Cybersecurity & Data Protection Attributes", "description": "Mechanisms exist to bind cybersecurity and data protection attributes to information as it is stored, transmitted and processed.", "justification": "Cybersecurity & Data Protection Attributes (DCH-37) provides overlapping security capability that compensates for the absence of Purpose Compatibility (PRI-22.1) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "PRI-23", "risk_if_not_implemented": "Without Choice Architecture, security may be bolted on rather than designed in, resulting in structural weaknesses that are costly to remediate and easy to exploit. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Regulatory / Legal / Contractual Financial Liability (R-EX-5), Privacy Harm / Unauthorized Processing (R-IP-6), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11).", "compensating_control_1": { "control_id": "DCH-37", "name": "Cybersecurity & Data Protection Attributes", "description": "Mechanisms exist to bind cybersecurity and data protection attributes to information as it is stored, transmitted and processed.", "justification": "Cybersecurity & Data Protection Attributes (DCH-37) provides overlapping security capability that compensates for the absence of Choice Architecture (PRI-23) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "PRI-21", "name": "Data Privacy Notice", "description": "Mechanisms exist to:\n(1) Make data privacy notice(s) available to individuals upon first interacting with an organization and subsequently as necessary; \n(2) Ensure that data privacy notices are clear and easy-to-understand, expressing relevant information about how Personal Data (PD) is collected, received, processed, stored, transmitted, shared, updated and/or disposed;\n(3) Contain all necessary notice-related criteria required by applicable statutory, regulatory and contractual obligations;\n(4) Define the scope of PD processing activities, including the geographic locations and third-party recipients that process the PD within the scope of the data privacy notice;\n(5) Periodically, review and update the content of the privacy notice, as necessary; and\n(6) Retain prior versions of the privacy notice, in accordance with data retention requirements.", "justification": "Data Privacy Notice (PRI-21) provides privacy protection that compensates for the absence of Choice Architecture (PRI-23) by applying alternative privacy safeguards to protect personal data and honor data subject rights. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "PRI-23.1", "risk_if_not_implemented": "Without Symmetry In Choice, Personal Data (PD) may be collected, processed, retained or shared without lawful authority or adequate safeguards, harming individuals and exposing the organization to regulatory action. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Regulatory / Legal / Contractual Financial Liability (R-EX-5), Privacy Harm / Unauthorized Processing (R-IP-6), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11).", "compensating_control_1": { "control_id": "DCH-04", "name": "Data & Asset Classification", "description": "Mechanisms exist to ensure data and assets are categorized in accordance with applicable statutory, regulatory and contractual requirements.", "justification": "Data & Asset Classification (DCH-04) provides overlapping security capability that compensates for the absence of Symmetry In Choice (PRI-23.1) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "DCH-37", "name": "Cybersecurity & Data Protection Attributes", "description": "Mechanisms exist to bind cybersecurity and data protection attributes to information as it is stored, transmitted and processed.", "justification": "Cybersecurity & Data Protection Attributes (DCH-37) provides overlapping security capability that compensates for the absence of Symmetry In Choice (PRI-23.1) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "PRI-23.2", "risk_if_not_implemented": "Without Choice Architecture Testing, security may be bolted on rather than designed in, resulting in structural weaknesses that are costly to remediate and easy to exploit. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Lack of oversight of internal controls (R-GV-6), and most likely increases susceptibility to Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11).", "compensating_control_1": { "control_id": "PRI-21", "name": "Data Privacy Notice", "description": "Mechanisms exist to:\n(1) Make data privacy notice(s) available to individuals upon first interacting with an organization and subsequently as necessary; \n(2) Ensure that data privacy notices are clear and easy-to-understand, expressing relevant information about how Personal Data (PD) is collected, received, processed, stored, transmitted, shared, updated and/or disposed;\n(3) Contain all necessary notice-related criteria required by applicable statutory, regulatory and contractual obligations;\n(4) Define the scope of PD processing activities, including the geographic locations and third-party recipients that process the PD within the scope of the data privacy notice;\n(5) Periodically, review and update the content of the privacy notice, as necessary; and\n(6) Retain prior versions of the privacy notice, in accordance with data retention requirements.", "justification": "Data Privacy Notice (PRI-21) provides privacy protection that compensates for the absence of Choice Architecture Testing (PRI-23.2) by applying alternative privacy safeguards to protect personal data and honor data subject rights. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "DCH-04", "name": "Data & Asset Classification", "description": "Mechanisms exist to ensure data and assets are categorized in accordance with applicable statutory, regulatory and contractual requirements.", "justification": "Data & Asset Classification (DCH-04) provides overlapping security capability that compensates for the absence of Choice Architecture Testing (PRI-23.2) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "PRI-24", "risk_if_not_implemented": "Without Data Subject Consent, Personal Data (PD) may be collected, processed, retained or shared without lawful authority or adequate safeguards, harming individuals and exposing the organization to regulatory action. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Regulatory / Legal / Contractual Financial Liability (R-EX-5), Inability to Demonstrate Due Diligence / Due Care (R-GV-9), Privacy Harm / Unauthorized Processing (R-IP-6), and most likely increases susceptibility to Technical / Mechanical Failure (MT-10), Statutory / Regulatory / Contractual Change (MT-11).", "compensating_control_1": { "control_id": "CPL-02", "name": "Statutory, Regulatory & Contractual Compliance", "description": "Mechanisms exist to facilitate the identification and implementation of relevant statutory, regulatory and contractual controls.", "justification": "Statutory, Regulatory & Contractual Compliance (CPL-02) provides overlapping security capability that compensates for the absence of Choice & Consent (PRI-24) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "PRI-21", "name": "Data Privacy Notice", "description": "Mechanisms exist to:\n(1) Make data privacy notice(s) available to individuals upon first interacting with an organization and subsequently as necessary; \n(2) Ensure that data privacy notices are clear and easy-to-understand, expressing relevant information about how Personal Data (PD) is collected, received, processed, stored, transmitted, shared, updated and/or disposed;\n(3) Contain all necessary notice-related criteria required by applicable statutory, regulatory and contractual obligations;\n(4) Define the scope of PD processing activities, including the geographic locations and third-party recipients that process the PD within the scope of the data privacy notice;\n(5) Periodically, review and update the content of the privacy notice, as necessary; and\n(6) Retain prior versions of the privacy notice, in accordance with data retention requirements.", "justification": "Data Privacy Notice (PRI-21) provides privacy protection that compensates for the absence of Choice & Consent (PRI-24) by applying alternative privacy safeguards to protect personal data and honor data subject rights. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "PRI-24.1", "risk_if_not_implemented": "Without Active Participation For Consent By Data Subjects, Personal Data (PD) may be collected, processed, retained or shared without lawful authority or adequate safeguards, harming individuals and exposing the organization to regulatory action. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Regulatory / Legal / Contractual Financial Liability (R-EX-5), Privacy Harm / Unauthorized Processing (R-IP-6), and most likely increases susceptibility to Technical / Mechanical Failure (MT-10), Statutory / Regulatory / Contractual Change (MT-11).", "compensating_control_1": { "control_id": "CPL-02", "name": "Statutory, Regulatory & Contractual Compliance", "description": "Mechanisms exist to facilitate the identification and implementation of relevant statutory, regulatory and contractual controls.", "justification": "Statutory, Regulatory & Contractual Compliance (CPL-02) provides overlapping security capability that compensates for the absence of Active Participation By Data Subjects (PRI-24.1) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "PRI-24", "name": "Data Subject Consent", "description": "Mechanisms exist to enable data subjects to authorize the collection, receipt, processing, storage, transmission, sharing, updating and/or disposal of their Personal Data (PD), where the data subject is provided, prior to collection, with:\n(1) Plain language explaining the potential data privacy risks of the authorization;\n(2) A means to decline the authorization; and\n(3) Necessary choice and consent-related criteria required by applicable statutory, regulatory and contractual obligations.", "justification": "Data Subject Consent (PRI-24) provides privacy protection that compensates for the absence of Active Participation By Data Subjects (PRI-24.1) by applying alternative privacy safeguards to protect personal data and honor data subject rights. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "PRI-24.2", "risk_if_not_implemented": "Without Tailored Consent, Personal Data (PD) may be collected, processed, retained or shared without lawful authority or adequate safeguards, harming individuals and exposing the organization to regulatory action. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Regulatory / Legal / Contractual Financial Liability (R-EX-5), Privacy Harm / Unauthorized Processing (R-IP-6), and most likely increases susceptibility to Technical / Mechanical Failure (MT-10), Statutory / Regulatory / Contractual Change (MT-11).", "compensating_control_1": { "control_id": "PRI-21", "name": "Data Privacy Notice", "description": "Mechanisms exist to:\n(1) Make data privacy notice(s) available to individuals upon first interacting with an organization and subsequently as necessary; \n(2) Ensure that data privacy notices are clear and easy-to-understand, expressing relevant information about how Personal Data (PD) is collected, received, processed, stored, transmitted, shared, updated and/or disposed;\n(3) Contain all necessary notice-related criteria required by applicable statutory, regulatory and contractual obligations;\n(4) Define the scope of PD processing activities, including the geographic locations and third-party recipients that process the PD within the scope of the data privacy notice;\n(5) Periodically, review and update the content of the privacy notice, as necessary; and\n(6) Retain prior versions of the privacy notice, in accordance with data retention requirements.", "justification": "Data Privacy Notice (PRI-21) provides privacy protection that compensates for the absence of Tailored Consent (PRI-24.2) by applying alternative privacy safeguards to protect personal data and honor data subject rights. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CPL-02", "name": "Statutory, Regulatory & Contractual Compliance", "description": "Mechanisms exist to facilitate the identification and implementation of relevant statutory, regulatory and contractual controls.", "justification": "Statutory, Regulatory & Contractual Compliance (CPL-02) provides overlapping security capability that compensates for the absence of Tailored Consent (PRI-24.2) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "PRI-24.3", "risk_if_not_implemented": "Without Revoke Consent, Personal Data (PD) may be collected, processed, retained or shared without lawful authority or adequate safeguards, harming individuals and exposing the organization to regulatory action. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Retention / Inability to Dispose of Data (R-AM-3), Regulatory / Legal / Contractual Financial Liability (R-EX-5), Privacy Harm / Unauthorized Processing (R-IP-6), and most likely increases susceptibility to Technical / Mechanical Failure (MT-10), Statutory / Regulatory / Contractual Change (MT-11).", "compensating_control_1": { "control_id": "CPL-02", "name": "Statutory, Regulatory & Contractual Compliance", "description": "Mechanisms exist to facilitate the identification and implementation of relevant statutory, regulatory and contractual controls.", "justification": "Statutory, Regulatory & Contractual Compliance (CPL-02) provides overlapping security capability that compensates for the absence of Revoke Consent (PRI-24.3) by addressing related risk objectives through an alternative control mechanism aligned with Data applicability. Given the data-handling focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "PRI-21", "name": "Data Privacy Notice", "description": "Mechanisms exist to:\n(1) Make data privacy notice(s) available to individuals upon first interacting with an organization and subsequently as necessary; \n(2) Ensure that data privacy notices are clear and easy-to-understand, expressing relevant information about how Personal Data (PD) is collected, received, processed, stored, transmitted, shared, updated and/or disposed;\n(3) Contain all necessary notice-related criteria required by applicable statutory, regulatory and contractual obligations;\n(4) Define the scope of PD processing activities, including the geographic locations and third-party recipients that process the PD within the scope of the data privacy notice;\n(5) Periodically, review and update the content of the privacy notice, as necessary; and\n(6) Retain prior versions of the privacy notice, in accordance with data retention requirements.", "justification": "Data Privacy Notice (PRI-21) provides privacy protection that compensates for the absence of Revoke Consent (PRI-24.3) by applying alternative privacy safeguards to protect personal data and honor data subject rights. Given the data-handling focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "PRI-24.4", "risk_if_not_implemented": "Without Just-In-Time Notice & Updated Consent, Personal Data (PD) may be collected, processed, retained or shared without lawful authority or adequate safeguards, harming individuals and exposing the organization to regulatory action. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Regulatory / Legal / Contractual Financial Liability (R-EX-5), Privacy Harm / Unauthorized Processing (R-IP-6), and most likely increases susceptibility to Technical / Mechanical Failure (MT-10), Statutory / Regulatory / Contractual Change (MT-11), Data Quality Degradation / Data Poisoning (MT-12).", "compensating_control_1": { "control_id": "CPL-02", "name": "Statutory, Regulatory & Contractual Compliance", "description": "Mechanisms exist to facilitate the identification and implementation of relevant statutory, regulatory and contractual controls.", "justification": "Statutory, Regulatory & Contractual Compliance (CPL-02) provides overlapping security capability that compensates for the absence of Just-In-Time Notice & Updated Consent (PRI-24.4) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "PRI-24", "name": "Data Subject Consent", "description": "Mechanisms exist to enable data subjects to authorize the collection, receipt, processing, storage, transmission, sharing, updating and/or disposal of their Personal Data (PD), where the data subject is provided, prior to collection, with:\n(1) Plain language explaining the potential data privacy risks of the authorization;\n(2) A means to decline the authorization; and\n(3) Necessary choice and consent-related criteria required by applicable statutory, regulatory and contractual obligations.", "justification": "Data Subject Consent (PRI-24) provides privacy protection that compensates for the absence of Just-In-Time Notice & Updated Consent (PRI-24.4) by applying alternative privacy safeguards to protect personal data and honor data subject rights. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "PRI-24.5", "risk_if_not_implemented": "Without Prohibition of Selling, Processing and/or Sharing Personal Data (PD), Personal Data (PD) may be collected, processed, retained or shared without lawful authority or adequate safeguards, harming individuals and exposing the organization to regulatory action. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Regulatory / Legal / Contractual Financial Liability (R-EX-5), Loss of Confidentiality (R-IP-2), Privacy Harm / Unauthorized Processing (R-IP-6), and most likely increases susceptibility to Technical / Mechanical Failure (MT-10), Statutory / Regulatory / Contractual Change (MT-11).", "compensating_control_1": { "control_id": "PRI-24", "name": "Data Subject Consent", "description": "Mechanisms exist to enable data subjects to authorize the collection, receipt, processing, storage, transmission, sharing, updating and/or disposal of their Personal Data (PD), where the data subject is provided, prior to collection, with:\n(1) Plain language explaining the potential data privacy risks of the authorization;\n(2) A means to decline the authorization; and\n(3) Necessary choice and consent-related criteria required by applicable statutory, regulatory and contractual obligations.", "justification": "Data Subject Consent (PRI-24) provides privacy protection that compensates for the absence of Prohibition of Selling, Processing and/or Sharing Personal Data (PD) (PRI-24.5) by applying alternative privacy safeguards to protect personal data and honor data subject rights. Given the data-handling focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CPL-02", "name": "Statutory, Regulatory & Contractual Compliance", "description": "Mechanisms exist to facilitate the identification and implementation of relevant statutory, regulatory and contractual controls.", "justification": "Statutory, Regulatory & Contractual Compliance (CPL-02) provides overlapping security capability that compensates for the absence of Prohibition of Selling, Processing and/or Sharing Personal Data (PD) (PRI-24.5) by addressing related risk objectives through an alternative control mechanism aligned with Data applicability. Given the data-handling focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "PRI-25", "risk_if_not_implemented": "Without Cookie Management, Personal Data (PD) may be collected, processed, retained or shared without lawful authority or adequate safeguards, harming individuals and exposing the organization to regulatory action. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Access (R-AC-4), Identity Compromise / Impersonation (R-AC-5), Loss of Confidentiality (R-IP-2), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9).", "compensating_control_1": { "control_id": "CFG-04.5", "name": "Session Termination", "description": "Automated mechanisms exist to log out users, both locally on the network and for remote sessions, at the end of the session or after an organization-defined period of inactivity.", "justification": "Session Termination (CFG-04.5) provides overlapping security capability that compensates for the absence of Cookie Management (PRI-25) by addressing related risk objectives through an alternative control mechanism aligned with Technology applicability. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "IAC-25", "name": "Access Enforcement", "description": "Mechanisms exist to enforce Logical Access Control (LAC) permissions that conform to the principle of \"least privilege.\"", "justification": "Access Enforcement (IAC-25) provides access control enforcement that compensates for the absence of Cookie Management (PRI-25) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "PRI-26", "risk_if_not_implemented": "Without Data Subject Right To Opt-Out, Personal Data (PD) may be collected, processed, retained or shared without lawful authority or adequate safeguards, harming individuals and exposing the organization to regulatory action. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Regulatory / Legal / Contractual Financial Liability (R-EX-5), Privacy Harm / Unauthorized Processing (R-IP-6), and most likely increases susceptibility to Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11).", "compensating_control_1": { "control_id": "PRI-21", "name": "Data Privacy Notice", "description": "Mechanisms exist to:\n(1) Make data privacy notice(s) available to individuals upon first interacting with an organization and subsequently as necessary; \n(2) Ensure that data privacy notices are clear and easy-to-understand, expressing relevant information about how Personal Data (PD) is collected, received, processed, stored, transmitted, shared, updated and/or disposed;\n(3) Contain all necessary notice-related criteria required by applicable statutory, regulatory and contractual obligations;\n(4) Define the scope of PD processing activities, including the geographic locations and third-party recipients that process the PD within the scope of the data privacy notice;\n(5) Periodically, review and update the content of the privacy notice, as necessary; and\n(6) Retain prior versions of the privacy notice, in accordance with data retention requirements.", "justification": "Data Privacy Notice (PRI-26) provides privacy protection that compensates for the absence of Notice of Right To Opt-Out (PRI-26) by applying alternative privacy safeguards to protect personal data and honor data subject rights. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CPL-02", "name": "Statutory, Regulatory & Contractual Compliance", "description": "Mechanisms exist to facilitate the identification and implementation of relevant statutory, regulatory and contractual controls.", "justification": "Statutory, Regulatory & Contractual Compliance (CPL-02) provides overlapping security capability that compensates for the absence of Notice of Right To Opt-Out (PRI-26) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "PRI-26.1", "risk_if_not_implemented": "Without Opt-Out Links, Personal Data (PD) may be collected, processed, retained or shared without lawful authority or adequate safeguards, harming individuals and exposing the organization to regulatory action. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Regulatory / Legal / Contractual Financial Liability (R-EX-5), Privacy Harm / Unauthorized Processing (R-IP-6), and most likely increases susceptibility to Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11).", "compensating_control_1": { "control_id": "CPL-02", "name": "Statutory, Regulatory & Contractual Compliance", "description": "Mechanisms exist to facilitate the identification and implementation of relevant statutory, regulatory and contractual controls.", "justification": "Statutory, Regulatory & Contractual Compliance (CPL-02) provides overlapping security capability that compensates for the absence of Opt-Out Links (PRI-26.1) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "PRI-21", "name": "Data Privacy Notice", "description": "Mechanisms exist to:\n(1) Make data privacy notice(s) available to individuals upon first interacting with an organization and subsequently as necessary; \n(2) Ensure that data privacy notices are clear and easy-to-understand, expressing relevant information about how Personal Data (PD) is collected, received, processed, stored, transmitted, shared, updated and/or disposed;\n(3) Contain all necessary notice-related criteria required by applicable statutory, regulatory and contractual obligations;\n(4) Define the scope of PD processing activities, including the geographic locations and third-party recipients that process the PD within the scope of the data privacy notice;\n(5) Periodically, review and update the content of the privacy notice, as necessary; and\n(6) Retain prior versions of the privacy notice, in accordance with data retention requirements.", "justification": "Data Privacy Notice (PRI-21) provides privacy protection that compensates for the absence of Opt-Out Links (PRI-26.1) by applying alternative privacy safeguards to protect personal data and honor data subject rights. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "PRI-26.2", "risk_if_not_implemented": "Without Alternative Opt-Out Link, Personal Data (PD) may be collected, processed, retained or shared without lawful authority or adequate safeguards, harming individuals and exposing the organization to regulatory action. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Regulatory / Legal / Contractual Financial Liability (R-EX-5), Privacy Harm / Unauthorized Processing (R-IP-6), and most likely increases susceptibility to Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11).", "compensating_control_1": { "control_id": "PRI-26", "name": "Data Subject Right To Opt-Out", "description": "Mechanisms exist to include a notification to data subjects within the data privacy notice of:\n(1) Their right to direct an organization that sells or shares their Personal Data (PD) to stop selling or sharing their PD; and\n(2) The methods available to exercise that right.", "justification": "Data Subject Right To Opt-Out (PRI-26) provides overlapping security capability that compensates for the absence of Alternative Out-Out Link (PRI-26.2) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CPL-02", "name": "Statutory, Regulatory & Contractual Compliance", "description": "Mechanisms exist to facilitate the identification and implementation of relevant statutory, regulatory and contractual controls.", "justification": "Statutory, Regulatory & Contractual Compliance (CPL-02) provides overlapping security capability that compensates for the absence of Alternative Out-Out Link (PRI-26.2) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "PRI-26.3", "risk_if_not_implemented": "Without Global Privacy Control (GPC), Personal Data (PD) may be collected, processed, retained or shared without lawful authority or adequate safeguards, harming individuals and exposing the organization to regulatory action. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Regulatory / Legal / Contractual Financial Liability (R-EX-5), Privacy Harm / Unauthorized Processing (R-IP-6), and most likely increases susceptibility to Technical / Mechanical Failure (MT-10), Statutory / Regulatory / Contractual Change (MT-11).", "compensating_control_1": { "control_id": "PRI-24", "name": "Data Subject Consent", "description": "Mechanisms exist to enable data subjects to authorize the collection, receipt, processing, storage, transmission, sharing, updating and/or disposal of their Personal Data (PD), where the data subject is provided, prior to collection, with:\n(1) Plain language explaining the potential data privacy risks of the authorization;\n(2) A means to decline the authorization; and\n(3) Necessary choice and consent-related criteria required by applicable statutory, regulatory and contractual obligations.", "justification": "Data Subject Consent (PRI-24) provides privacy protection that compensates for the absence of Global Privacy Control (GPC) (PRI-26.3) by applying alternative privacy safeguards to protect personal data and honor data subject rights. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CPL-02", "name": "Statutory, Regulatory & Contractual Compliance", "description": "Mechanisms exist to facilitate the identification and implementation of relevant statutory, regulatory and contractual controls.", "justification": "Statutory, Regulatory & Contractual Compliance (CPL-02) provides overlapping security capability that compensates for the absence of Global Privacy Control (GPC) (PRI-26.3) by addressing related risk objectives through an alternative control mechanism aligned with Technology applicability. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "PRI-27", "risk_if_not_implemented": "Without Data Subject Opt-In Consent, Personal Data (PD) may be collected, processed, retained or shared without lawful authority or adequate safeguards, harming individuals and exposing the organization to regulatory action. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Regulatory / Legal / Contractual Financial Liability (R-EX-5), Privacy Harm / Unauthorized Processing (R-IP-6), and most likely increases susceptibility to Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11).", "compensating_control_1": { "control_id": "PRI-21", "name": "Data Privacy Notice", "description": "Mechanisms exist to:\n(1) Make data privacy notice(s) available to individuals upon first interacting with an organization and subsequently as necessary; \n(2) Ensure that data privacy notices are clear and easy-to-understand, expressing relevant information about how Personal Data (PD) is collected, received, processed, stored, transmitted, shared, updated and/or disposed;\n(3) Contain all necessary notice-related criteria required by applicable statutory, regulatory and contractual obligations;\n(4) Define the scope of PD processing activities, including the geographic locations and third-party recipients that process the PD within the scope of the data privacy notice;\n(5) Periodically, review and update the content of the privacy notice, as necessary; and\n(6) Retain prior versions of the privacy notice, in accordance with data retention requirements.", "justification": "Data Privacy Notice (PRI-21) provides privacy protection that compensates for the absence of Data Subject Opt-In Consent (PRI-27) by applying alternative privacy safeguards to protect personal data and honor data subject rights. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "PRI-24", "name": "Data Subject Consent", "description": "Mechanisms exist to enable data subjects to authorize the collection, receipt, processing, storage, transmission, sharing, updating and/or disposal of their Personal Data (PD), where the data subject is provided, prior to collection, with:\n(1) Plain language explaining the potential data privacy risks of the authorization;\n(2) A means to decline the authorization; and\n(3) Necessary choice and consent-related criteria required by applicable statutory, regulatory and contractual obligations.", "justification": "Data Subject Consent (PRI-24) provides privacy protection that compensates for the absence of Data Subject Opt-In Consent (PRI-27) by applying alternative privacy safeguards to protect personal data and honor data subject rights. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "PRI-27.1", "risk_if_not_implemented": "Without Parent or Guardian Opt-In Consent For Minors, Personal Data (PD) may be collected, processed, retained or shared without lawful authority or adequate safeguards, harming individuals and exposing the organization to regulatory action. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Regulatory / Legal / Contractual Financial Liability (R-EX-5), Privacy Harm / Unauthorized Processing (R-IP-6), and most likely increases susceptibility to Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11).", "compensating_control_1": { "control_id": "CPL-02", "name": "Statutory, Regulatory & Contractual Compliance", "description": "Mechanisms exist to facilitate the identification and implementation of relevant statutory, regulatory and contractual controls.", "justification": "Statutory, Regulatory & Contractual Compliance (CPL-02) provides overlapping security capability that compensates for the absence of Parent or Guardian Opt-In Consent For Minors (PRI-27.1) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "PRI-24", "name": "Data Subject Consent", "description": "Mechanisms exist to enable data subjects to authorize the collection, receipt, processing, storage, transmission, sharing, updating and/or disposal of their Personal Data (PD), where the data subject is provided, prior to collection, with:\n(1) Plain language explaining the potential data privacy risks of the authorization;\n(2) A means to decline the authorization; and\n(3) Necessary choice and consent-related criteria required by applicable statutory, regulatory and contractual obligations.", "justification": "Data Subject Consent (PRI-24) provides privacy protection that compensates for the absence of Parent or Guardian Opt-In Consent For Minors (PRI-27.1) by applying alternative privacy safeguards to protect personal data and honor data subject rights. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "PRI-28", "risk_if_not_implemented": "Without Authorized Agent, AI and autonomous systems may produce unreliable, biased or unsafe outputs, act outside authorized scope, or expose sensitive data. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Regulatory / Legal / Contractual Financial Liability (R-EX-5), Privacy Harm / Unauthorized Processing (R-IP-6), and most likely increases susceptibility to Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11).", "compensating_control_1": { "control_id": "PRI-24", "name": "Data Subject Consent", "description": "Mechanisms exist to enable data subjects to authorize the collection, receipt, processing, storage, transmission, sharing, updating and/or disposal of their Personal Data (PD), where the data subject is provided, prior to collection, with:\n(1) Plain language explaining the potential data privacy risks of the authorization;\n(2) A means to decline the authorization; and\n(3) Necessary choice and consent-related criteria required by applicable statutory, regulatory and contractual obligations.", "justification": "Data Subject Consent (PRI-24) provides privacy protection that compensates for the absence of Authorized Agent (PRI-28) by applying alternative privacy safeguards to protect personal data and honor data subject rights. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "PRI-21", "name": "Data Privacy Notice", "description": "Mechanisms exist to:\n(1) Make data privacy notice(s) available to individuals upon first interacting with an organization and subsequently as necessary; \n(2) Ensure that data privacy notices are clear and easy-to-understand, expressing relevant information about how Personal Data (PD) is collected, received, processed, stored, transmitted, shared, updated and/or disposed;\n(3) Contain all necessary notice-related criteria required by applicable statutory, regulatory and contractual obligations;\n(4) Define the scope of PD processing activities, including the geographic locations and third-party recipients that process the PD within the scope of the data privacy notice;\n(5) Periodically, review and update the content of the privacy notice, as necessary; and\n(6) Retain prior versions of the privacy notice, in accordance with data retention requirements.", "justification": "Data Privacy Notice (PRI-21) provides privacy protection that compensates for the absence of Authorized Agent (PRI-28) by applying alternative privacy safeguards to protect personal data and honor data subject rights. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "PRI-29", "risk_if_not_implemented": "Without Usage Restrictions of Personal Data (PD), Personal Data (PD) may be collected, processed, retained or shared without lawful authority or adequate safeguards, harming individuals and exposing the organization to regulatory action. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Regulatory / Legal / Contractual Financial Liability (R-EX-5), Privacy Harm / Unauthorized Processing (R-IP-6), and most likely increases susceptibility to Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11).", "compensating_control_1": { "control_id": "DCH-27", "name": "Media & Data Retention", "description": "Mechanisms exist to retain media and data in accordance with applicable statutory, regulatory and contractual obligations.", "justification": "Media & Data Retention (DCH-27) provides overlapping security capability that compensates for the absence of Usage Restrictions of Personal Data (PD) (PRI-29) by addressing related risk objectives through an alternative control mechanism aligned with Data applicability. Given the data-handling focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "PRI-30", "name": "Personal Data (PD) Retention & Disposal", "description": "Mechanisms exist to: \n(1) Retain Personal Data (PD), including metadata, for an organization-defined time period to fulfill the purpose(s) identified in the notice or as required by law;\n(2) Dispose of, destroys, erases, and/or anonymizes the PD, regardless of the method of storage; and\n(3) Use organization-defined techniques or methods to ensure secure deletion or destruction of PD (including originals, copies and archived records).", "justification": "Personal Data (PD) Retention & Disposal (PRI-30) provides privacy protection that compensates for the absence of Usage Restrictions of Personal Data (PD) (PRI-29) by applying alternative privacy safeguards to protect personal data and honor data subject rights. Given the data-handling focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "PRI-29.1", "risk_if_not_implemented": "Without Continued Use of Personal Data (PD), Personal Data (PD) may be collected, processed, retained or shared without lawful authority or adequate safeguards, harming individuals and exposing the organization to regulatory action. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Retention / Inability to Dispose of Data (R-AM-3), Regulatory / Legal / Contractual Financial Liability (R-EX-5), Privacy Harm / Unauthorized Processing (R-IP-6), and most likely increases susceptibility to Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11).", "compensating_control_1": { "control_id": "PRI-21", "name": "Data Privacy Notice", "description": "Mechanisms exist to:\n(1) Make data privacy notice(s) available to individuals upon first interacting with an organization and subsequently as necessary; \n(2) Ensure that data privacy notices are clear and easy-to-understand, expressing relevant information about how Personal Data (PD) is collected, received, processed, stored, transmitted, shared, updated and/or disposed;\n(3) Contain all necessary notice-related criteria required by applicable statutory, regulatory and contractual obligations;\n(4) Define the scope of PD processing activities, including the geographic locations and third-party recipients that process the PD within the scope of the data privacy notice;\n(5) Periodically, review and update the content of the privacy notice, as necessary; and\n(6) Retain prior versions of the privacy notice, in accordance with data retention requirements.", "justification": "Data Privacy Notice (PRI-21) provides privacy protection that compensates for the absence of Continued Use of Personal Data (PD) (PRI-29.1) by applying alternative privacy safeguards to protect personal data and honor data subject rights. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CPL-02", "name": "Statutory, Regulatory & Contractual Compliance", "description": "Mechanisms exist to facilitate the identification and implementation of relevant statutory, regulatory and contractual controls.", "justification": "Statutory, Regulatory & Contractual Compliance (CPL-02) provides overlapping security capability that compensates for the absence of Continued Use of Personal Data (PD) (PRI-29.1) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "PRI-29.2", "risk_if_not_implemented": "Without Cease Processing, Storing and/or Sharing Personal Data (PD), Personal Data (PD) may be collected, processed, retained or shared without lawful authority or adequate safeguards, harming individuals and exposing the organization to regulatory action. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Regulatory / Legal / Contractual Financial Liability (R-EX-5), Privacy Harm / Unauthorized Processing (R-IP-6), and most likely increases susceptibility to Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11).", "compensating_control_1": { "control_id": "CPL-02", "name": "Statutory, Regulatory & Contractual Compliance", "description": "Mechanisms exist to facilitate the identification and implementation of relevant statutory, regulatory and contractual controls.", "justification": "Statutory, Regulatory & Contractual Compliance (CPL-02) provides overlapping security capability that compensates for the absence of Cease Processing, Storing and/or Sharing Personal Data (PD) (PRI-29.2) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "PRI-21", "name": "Data Privacy Notice", "description": "Mechanisms exist to:\n(1) Make data privacy notice(s) available to individuals upon first interacting with an organization and subsequently as necessary; \n(2) Ensure that data privacy notices are clear and easy-to-understand, expressing relevant information about how Personal Data (PD) is collected, received, processed, stored, transmitted, shared, updated and/or disposed;\n(3) Contain all necessary notice-related criteria required by applicable statutory, regulatory and contractual obligations;\n(4) Define the scope of PD processing activities, including the geographic locations and third-party recipients that process the PD within the scope of the data privacy notice;\n(5) Periodically, review and update the content of the privacy notice, as necessary; and\n(6) Retain prior versions of the privacy notice, in accordance with data retention requirements.", "justification": "Data Privacy Notice (PRI-21) provides privacy protection that compensates for the absence of Cease Processing, Storing and/or Sharing Personal Data (PD) (PRI-29.2) by applying alternative privacy safeguards to protect personal data and honor data subject rights. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "PRI-29.3", "risk_if_not_implemented": "Without Internal Use of Personal Data (PD) For Testing, Training and Research, personnel are more likely to make unsafe decisions, fall victim to social engineering, mishandle data or violate requirements. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Regulatory / Legal / Contractual Financial Liability (R-EX-5), Privacy Harm / Unauthorized Processing (R-IP-6), and most likely increases susceptibility to Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11).", "compensating_control_1": { "control_id": "DCH-27", "name": "Media & Data Retention", "description": "Mechanisms exist to retain media and data in accordance with applicable statutory, regulatory and contractual obligations.", "justification": "Media & Data Retention (DCH-27) provides overlapping security capability that compensates for the absence of Internal Use of Personal Data (PD) For Testing, Training and Research (PRI-29.3) by addressing related risk objectives through an alternative control mechanism aligned with Data applicability. Given the data-handling focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "DCH-18", "name": "Digital Media Sanitization", "description": "Mechanisms exist to sanitize digital media with the strength and integrity commensurate with the classification or sensitivity of the information prior to disposal, release out of organizational control or release for reuse.", "justification": "Digital Media Sanitization (DCH-18) provides overlapping security capability that compensates for the absence of Internal Use of Personal Data (PD) For Testing, Training and Research (PRI-29.3) by addressing related risk objectives through an alternative control mechanism aligned with Data applicability. Given the data-handling focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "PRI-30", "risk_if_not_implemented": "Without Personal Data (PD) Retention & Disposal, Personal Data (PD) may be collected, processed, retained or shared without lawful authority or adequate safeguards, harming individuals and exposing the organization to regulatory action. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Retention / Inability to Dispose of Data (R-AM-3), Regulatory / Legal / Contractual Financial Liability (R-EX-5), Privacy Harm / Unauthorized Processing (R-IP-6), and most likely increases susceptibility to Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11).", "compensating_control_1": { "control_id": "DCH-18", "name": "Digital Media Sanitization", "description": "Mechanisms exist to sanitize digital media with the strength and integrity commensurate with the classification or sensitivity of the information prior to disposal, release out of organizational control or release for reuse.", "justification": "Digital Media Sanitization (DCH-18) provides overlapping security capability that compensates for the absence of Personal Data (PD) Retention & Disposal (PRI-30) by addressing related risk objectives through an alternative control mechanism aligned with Data applicability. Given the data-handling focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "DCH-27", "name": "Media & Data Retention", "description": "Mechanisms exist to retain media and data in accordance with applicable statutory, regulatory and contractual obligations.", "justification": "Media & Data Retention (DCH-27) provides overlapping security capability that compensates for the absence of Personal Data (PD) Retention & Disposal (PRI-30) by addressing related risk objectives through an alternative control mechanism aligned with Data applicability. Given the data-handling focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "PRI-30.1", "risk_if_not_implemented": "Without Personal Data (PD) Formats, Personal Data (PD) may be collected, processed, retained or shared without lawful authority or adequate safeguards, harming individuals and exposing the organization to regulatory action. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Retention / Inability to Dispose of Data (R-AM-3), Regulatory / Legal / Contractual Financial Liability (R-EX-5), Privacy Harm / Unauthorized Processing (R-IP-6), and most likely increases susceptibility to Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11).", "compensating_control_1": { "control_id": "PRI-30", "name": "Personal Data (PD) Retention & Disposal", "description": "Mechanisms exist to: \n(1) Retain Personal Data (PD), including metadata, for an organization-defined time period to fulfill the purpose(s) identified in the notice or as required by law;\n(2) Dispose of, destroys, erases, and/or anonymizes the PD, regardless of the method of storage; and\n(3) Use organization-defined techniques or methods to ensure secure deletion or destruction of PD (including originals, copies and archived records).", "justification": "Personal Data (PD) Retention & Disposal (PRI-30) provides privacy protection that compensates for the absence of Personal Data (PD) Formats (PRI-30.1) by applying alternative privacy safeguards to protect personal data and honor data subject rights. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "DCH-18", "name": "Digital Media Sanitization", "description": "Mechanisms exist to sanitize digital media with the strength and integrity commensurate with the classification or sensitivity of the information prior to disposal, release out of organizational control or release for reuse.", "justification": "Digital Media Sanitization (DCH-18) provides overlapping security capability that compensates for the absence of Personal Data (PD) Formats (PRI-30.1) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "PRI-30.2", "risk_if_not_implemented": "Without Temporary Files Containing Personal Data (PD), Personal Data (PD) may be collected, processed, retained or shared without lawful authority or adequate safeguards, harming individuals and exposing the organization to regulatory action. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Retention / Inability to Dispose of Data (R-AM-3), Privacy Harm / Unauthorized Processing (R-IP-6), and most likely increases susceptibility to Human Error (MT-9).", "compensating_control_1": { "control_id": "MON-13", "name": "Event Log & Security-Relevant Telemetry Retention", "description": "Mechanisms exist to retain event logs and security-relevant telemetry for a time period consistent with records retention requirements to provide support for after-the-fact investigations of security incidents and to meet statutory, regulatory and contractual retention requirements.", "justification": "Event Log & Security-Relevant Telemetry Retention (MON-13) provides detective monitoring capability that compensates for the absence of Temporary Files Containing Personal Data (PD) (PRI-30.2) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the data-handling focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "DCH-18", "name": "Digital Media Sanitization", "description": "Mechanisms exist to sanitize digital media with the strength and integrity commensurate with the classification or sensitivity of the information prior to disposal, release out of organizational control or release for reuse.", "justification": "Digital Media Sanitization (DCH-18) provides overlapping security capability that compensates for the absence of Temporary Files Containing Personal Data (PD) (PRI-30.2) by addressing related risk objectives through an alternative control mechanism aligned with Data applicability. Given the data-handling focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "PRI-31", "risk_if_not_implemented": "Without Personal Data (PD) Collection Methods, Personal Data (PD) may be collected, processed, retained or shared without lawful authority or adequate safeguards, harming individuals and exposing the organization to regulatory action. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Regulatory / Legal / Contractual Financial Liability (R-EX-5), Privacy Harm / Unauthorized Processing (R-IP-6), and most likely increases susceptibility to Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11).", "compensating_control_1": { "control_id": "DCH-04", "name": "Data & Asset Classification", "description": "Mechanisms exist to ensure data and assets are categorized in accordance with applicable statutory, regulatory and contractual requirements.", "justification": "Data & Asset Classification (DCH-04) provides overlapping security capability that compensates for the absence of Personal Data (PD) Collection Methods (PRI-31) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CPL-02", "name": "Statutory, Regulatory & Contractual Compliance", "description": "Mechanisms exist to facilitate the identification and implementation of relevant statutory, regulatory and contractual controls.", "justification": "Statutory, Regulatory & Contractual Compliance (CPL-02) provides overlapping security capability that compensates for the absence of Personal Data (PD) Collection Methods (PRI-31) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "PRI-31.1", "risk_if_not_implemented": "Without Restrict Collection, Processing & Sharing To Identified Purpose, Personal Data (PD) may be collected, processed, retained or shared without lawful authority or adequate safeguards, harming individuals and exposing the organization to regulatory action. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Regulatory / Legal / Contractual Financial Liability (R-EX-5), Loss of Confidentiality (R-IP-2), Privacy Harm / Unauthorized Processing (R-IP-6), and most likely increases susceptibility to Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11).", "compensating_control_1": { "control_id": "DCH-04", "name": "Data & Asset Classification", "description": "Mechanisms exist to ensure data and assets are categorized in accordance with applicable statutory, regulatory and contractual requirements.", "justification": "Data & Asset Classification (DCH-04) provides overlapping security capability that compensates for the absence of Restrict Collection To Identified Purpose (PRI-31.1) by addressing related risk objectives through an alternative control mechanism aligned with Data applicability. Given the data-handling focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CPL-02", "name": "Statutory, Regulatory & Contractual Compliance", "description": "Mechanisms exist to facilitate the identification and implementation of relevant statutory, regulatory and contractual controls.", "justification": "Statutory, Regulatory & Contractual Compliance (CPL-02) provides overlapping security capability that compensates for the absence of Restrict Collection To Identified Purpose (PRI-31.1) by addressing related risk objectives through an alternative control mechanism aligned with Data applicability. Given the data-handling focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "PRI-32", "risk_if_not_implemented": "Without Primary Source Collection For Personal Data (PD), Personal Data (PD) may be collected, processed, retained or shared without lawful authority or adequate safeguards, harming individuals and exposing the organization to regulatory action. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Regulatory / Legal / Contractual Financial Liability (R-EX-5), Loss of Authenticity / Provenance (R-IP-5), Privacy Harm / Unauthorized Processing (R-IP-6), and most likely increases susceptibility to Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11).", "compensating_control_1": { "control_id": "CPL-02", "name": "Statutory, Regulatory & Contractual Compliance", "description": "Mechanisms exist to facilitate the identification and implementation of relevant statutory, regulatory and contractual controls.", "justification": "Statutory, Regulatory & Contractual Compliance (CPL-02) provides overlapping security capability that compensates for the absence of Primary Sources (PRI-04.2) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "PRI-31.1", "name": "Restrict Collection, Processing & Sharing To Identified Purpose", "description": "Mechanisms exist to minimize the collection, processing and/or sharing of Personal Data (PD) to only what is adequate, relevant and limited to the purposes identified in the data privacy notice, including protections against collecting PD from minors without appropriate parental or legal guardian consent.", "justification": "Restrict Collection, Processing & Sharing To Identified Purpose (PRI-31.1) provides overlapping security capability that compensates for the absence of Primary Sources (PRI-04.2) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "PRI-33", "risk_if_not_implemented": "Without Identifiable Image Collection, Personal Data (PD) may be collected, processed, retained or shared without lawful authority or adequate safeguards, harming individuals and exposing the organization to regulatory action. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Regulatory / Legal / Contractual Financial Liability (R-EX-5), Privacy Harm / Unauthorized Processing (R-IP-6), and most likely increases susceptibility to Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11).", "compensating_control_1": { "control_id": "PRI-31.1", "name": "Restrict Collection, Processing & Sharing To Identified Purpose", "description": "Mechanisms exist to minimize the collection, processing and/or sharing of Personal Data (PD) to only what is adequate, relevant and limited to the purposes identified in the data privacy notice, including protections against collecting PD from minors without appropriate parental or legal guardian consent.", "justification": "Restrict Collection, Processing & Sharing To Identified Purpose (PRI-31.1) provides overlapping security capability that compensates for the absence of Identifiable Image Collection (PRI-33) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "DCH-04", "name": "Data & Asset Classification", "description": "Mechanisms exist to ensure data and assets are categorized in accordance with applicable statutory, regulatory and contractual requirements.", "justification": "Data & Asset Classification (DCH-04) provides overlapping security capability that compensates for the absence of Identifiable Image Collection (PRI-33) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "PRI-34", "risk_if_not_implemented": "Without Acquired Personal Data (PD), Personal Data (PD) may be collected, processed, retained or shared without lawful authority or adequate safeguards, harming individuals and exposing the organization to regulatory action. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Regulatory / Legal / Contractual Financial Liability (R-EX-5), Privacy Harm / Unauthorized Processing (R-IP-6), and most likely increases susceptibility to Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11).", "compensating_control_1": { "control_id": "DCH-04", "name": "Data & Asset Classification", "description": "Mechanisms exist to ensure data and assets are categorized in accordance with applicable statutory, regulatory and contractual requirements.", "justification": "Data & Asset Classification (DCH-04) provides overlapping security capability that compensates for the absence of Acquired Personal Data (PD) (PRI-34) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "PRI-31.1", "name": "Restrict Collection, Processing & Sharing To Identified Purpose", "description": "Mechanisms exist to minimize the collection, processing and/or sharing of Personal Data (PD) to only what is adequate, relevant and limited to the purposes identified in the data privacy notice, including protections against collecting PD from minors without appropriate parental or legal guardian consent.", "justification": "Restrict Collection, Processing & Sharing To Identified Purpose (PRI-31.1) provides overlapping security capability that compensates for the absence of Acquired Personal Data (PD) (PRI-34) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "PRI-34.1", "risk_if_not_implemented": "Without Data Brokers, Personal Data (PD) may be collected, processed, retained or shared without lawful authority or adequate safeguards, harming individuals and exposing the organization to regulatory action. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Regulatory / Legal / Contractual Financial Liability (R-EX-5), Uncontrolled Third-Party Security / Privacy Exposure (R-GV-5), Third-Party Legal / Compliance Exposure (R-SC-4), Privacy Harm / Unauthorized Processing (R-IP-6), and most likely increases susceptibility to Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11).", "compensating_control_1": { "control_id": "CPL-02", "name": "Statutory, Regulatory & Contractual Compliance", "description": "Mechanisms exist to facilitate the identification and implementation of relevant statutory, regulatory and contractual controls.", "justification": "Statutory, Regulatory & Contractual Compliance (CPL-02) provides overlapping security capability that compensates for the absence of Data Brokers (PRI-34.1) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "PRI-02", "name": "Data Privacy Program", "description": "Mechanisms exist to facilitate the implementation and operation of data protection controls throughout the data lifecycle to ensure all forms of Personal Data (PD) are processed lawfully, fairly and transparently.", "justification": "Data Privacy Program (PRI-02) provides policy-level governance that compensates for the absence of Data Brokers (PRI-34.1) by establishing documented expectations, accountability structures, and organizational guardrails. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "PRI-35", "risk_if_not_implemented": "Without Personal Data (PD) Accuracy & Integrity, Personal Data (PD) may be collected, processed, retained or shared without lawful authority or adequate safeguards, harming individuals and exposing the organization to regulatory action. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Regulatory / Legal / Contractual Financial Liability (R-EX-5), Loss of Data Integrity (R-IP-3), Privacy Harm / Unauthorized Processing (R-IP-6), and most likely increases susceptibility to Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11), Data Quality Degradation / Data Poisoning (MT-12).", "compensating_control_1": { "control_id": "DCH-18", "name": "Digital Media Sanitization", "description": "Mechanisms exist to sanitize digital media with the strength and integrity commensurate with the classification or sensitivity of the information prior to disposal, release out of organizational control or release for reuse.", "justification": "Digital Media Sanitization (DCH-18) provides overlapping security capability that compensates for the absence of Personal Data (PD) Accuracy & Integrity (PRI-35) by addressing related risk objectives through an alternative control mechanism aligned with Data applicability. Given the data-handling focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "PRI-30", "name": "Personal Data (PD) Retention & Disposal", "description": "Mechanisms exist to: \n(1) Retain Personal Data (PD), including metadata, for an organization-defined time period to fulfill the purpose(s) identified in the notice or as required by law;\n(2) Dispose of, destroys, erases, and/or anonymizes the PD, regardless of the method of storage; and\n(3) Use organization-defined techniques or methods to ensure secure deletion or destruction of PD (including originals, copies and archived records).", "justification": "Personal Data (PD) Retention & Disposal (PRI-30) provides privacy protection that compensates for the absence of Personal Data (PD) Accuracy & Integrity (PRI-35) by applying alternative privacy safeguards to protect personal data and honor data subject rights. Given the data-handling focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "PRI-35.1", "risk_if_not_implemented": "Without Validate Collected Personal Data (PD), Personal Data (PD) may be collected, processed, retained or shared without lawful authority or adequate safeguards, harming individuals and exposing the organization to regulatory action. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss of Data Integrity (R-IP-3), Privacy Harm / Unauthorized Processing (R-IP-6), and most likely increases susceptibility to Human Error (MT-9).", "compensating_control_1": { "control_id": "CPL-02", "name": "Statutory, Regulatory & Contractual Compliance", "description": "Mechanisms exist to facilitate the identification and implementation of relevant statutory, regulatory and contractual controls.", "justification": "Statutory, Regulatory & Contractual Compliance (CPL-02) provides overlapping security capability that compensates for the absence of Validate Collected Personal Data (PD) (PRI-35.1) by addressing related risk objectives through an alternative control mechanism aligned with Data applicability. Given the data-handling focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "DCH-04", "name": "Data & Asset Classification", "description": "Mechanisms exist to ensure data and assets are categorized in accordance with applicable statutory, regulatory and contractual requirements.", "justification": "Data & Asset Classification (DCH-04) provides overlapping security capability that compensates for the absence of Validate Collected Personal Data (PD) (PRI-35.1) by addressing related risk objectives through an alternative control mechanism aligned with Data applicability. Given the data-handling focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "PRI-35.2", "risk_if_not_implemented": "Without Re-Validate Collected Personal Data (PD), Personal Data (PD) may be collected, processed, retained or shared without lawful authority or adequate safeguards, harming individuals and exposing the organization to regulatory action. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Regulatory / Legal / Contractual Financial Liability (R-EX-5), Loss of Data Integrity (R-IP-3), Privacy Harm / Unauthorized Processing (R-IP-6), and most likely increases susceptibility to Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11).", "compensating_control_1": { "control_id": "PRI-31.1", "name": "Restrict Collection, Processing & Sharing To Identified Purpose", "description": "Mechanisms exist to minimize the collection, processing and/or sharing of Personal Data (PD) to only what is adequate, relevant and limited to the purposes identified in the data privacy notice, including protections against collecting PD from minors without appropriate parental or legal guardian consent.", "justification": "Restrict Collection, Processing & Sharing To Identified Purpose (PRI-31.1) provides overlapping security capability that compensates for the absence of Re-Validate Collected Personal Data (PD) (PRI-35.2) by addressing related risk objectives through an alternative control mechanism aligned with Data applicability. Given the data-handling focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CPL-02", "name": "Statutory, Regulatory & Contractual Compliance", "description": "Mechanisms exist to facilitate the identification and implementation of relevant statutory, regulatory and contractual controls.", "justification": "Statutory, Regulatory & Contractual Compliance (CPL-02) provides overlapping security capability that compensates for the absence of Re-Validate Collected Personal Data (PD) (PRI-35.2) by addressing related risk objectives through an alternative control mechanism aligned with Data applicability. Given the data-handling focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "PRI-36", "risk_if_not_implemented": "Without Automated Decision-Making Technology (ADMT), Personal Data (PD) may be collected, processed, retained or shared without lawful authority or adequate safeguards, harming individuals and exposing the organization to regulatory action. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Retention / Inability to Dispose of Data (R-AM-3), Regulatory / Legal / Contractual Financial Liability (R-EX-5), Loss of Confidentiality (R-IP-2), Privacy Harm / Unauthorized Processing (R-IP-6), and most likely increases susceptibility to Human Error (MT-9), Technical / Mechanical Failure (MT-10), Statutory / Regulatory / Contractual Change (MT-11), Data Quality Degradation / Data Poisoning (MT-12).", "compensating_control_1": { "control_id": "CPL-02", "name": "Statutory, Regulatory & Contractual Compliance", "description": "Mechanisms exist to facilitate the identification and implementation of relevant statutory, regulatory and contractual controls.", "justification": "Statutory, Regulatory & Contractual Compliance (CPL-02) provides overlapping security capability that compensates for the absence of Automated Data Management Processes (PRI-36) by addressing related risk objectives through an alternative control mechanism aligned with Technology applicability. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "PRI-21", "name": "Data Privacy Notice", "description": "Mechanisms exist to:\n(1) Make data privacy notice(s) available to individuals upon first interacting with an organization and subsequently as necessary; \n(2) Ensure that data privacy notices are clear and easy-to-understand, expressing relevant information about how Personal Data (PD) is collected, received, processed, stored, transmitted, shared, updated and/or disposed;\n(3) Contain all necessary notice-related criteria required by applicable statutory, regulatory and contractual obligations;\n(4) Define the scope of PD processing activities, including the geographic locations and third-party recipients that process the PD within the scope of the data privacy notice;\n(5) Periodically, review and update the content of the privacy notice, as necessary; and\n(6) Retain prior versions of the privacy notice, in accordance with data retention requirements.", "justification": "Data Privacy Notice (PRI-21) provides privacy protection that compensates for the absence of Automated Data Management Processes (PRI-36) by applying alternative privacy safeguards to protect personal data and honor data subject rights. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "PRI-36.1", "risk_if_not_implemented": "Without Automated Decision-Making Technology (ADMT) For Data Subject Actions, Personal Data (PD) may be collected, processed, retained or shared without lawful authority or adequate safeguards, harming individuals and exposing the organization to regulatory action. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Contractual Default / Termination (R-EX-2), Regulatory / Legal / Contractual Financial Liability (R-EX-5), Privacy Harm / Unauthorized Processing (R-IP-6), and most likely increases susceptibility to Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11), Artificial Intelligence & Autonomous Technologies (AAT) System Failure or Unintended Behavior (MT-13).", "compensating_control_1": { "control_id": "IAC-25", "name": "Access Enforcement", "description": "Mechanisms exist to enforce Logical Access Control (LAC) permissions that conform to the principle of \"least privilege.\"", "justification": "Access Enforcement (IAC-25) provides access control enforcement that compensates for the absence of Automated Decision-Making Technology (ADMT) For Data Subject Actions (PRI-36.1) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "RSK-13", "name": "Risk Assessment", "description": "Mechanisms exist to conduct recurring assessments of risk that includes the likelihood and magnitude of harm, from unauthorized access, use, disclosure, disruption, modification or destruction of the organization's Technology Assets, Applications, Services and/or Data (TAASD).", "justification": "Risk Assessment (RSK-13) provides periodic assessment and assurance that compensates for the absence of Automated Decision-Making Technology (ADMT) For Data Subject Actions (PRI-36.1) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "PRI-36.2", "risk_if_not_implemented": "Without Automated Decision-Making Technology (ADMT) Use Notification, Personal Data (PD) may be collected, processed, retained or shared without lawful authority or adequate safeguards, harming individuals and exposing the organization to regulatory action. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Regulatory / Legal / Contractual Financial Liability (R-EX-5), Privacy Harm / Unauthorized Processing (R-IP-6), and most likely increases susceptibility to Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11).", "compensating_control_1": { "control_id": "RSK-13", "name": "Risk Assessment", "description": "Mechanisms exist to conduct recurring assessments of risk that includes the likelihood and magnitude of harm, from unauthorized access, use, disclosure, disruption, modification or destruction of the organization's Technology Assets, Applications, Services and/or Data (TAASD).", "justification": "Risk Assessment (RSK-13) provides periodic assessment and assurance that compensates for the absence of Automated Decision-Making Technology (ADMT) Use Notification (PRI-36.2) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "IAC-25", "name": "Access Enforcement", "description": "Mechanisms exist to enforce Logical Access Control (LAC) permissions that conform to the principle of \"least privilege.\"", "justification": "Access Enforcement (IAC-25) provides access control enforcement that compensates for the absence of Automated Decision-Making Technology (ADMT) Use Notification (PRI-36.2) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "PRI-36.3", "risk_if_not_implemented": "Without Automated Decision-Making Technology (ADMT) Opt-Out Consent, Personal Data (PD) may be collected, processed, retained or shared without lawful authority or adequate safeguards, harming individuals and exposing the organization to regulatory action. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Regulatory / Legal / Contractual Financial Liability (R-EX-5), Privacy Harm / Unauthorized Processing (R-IP-6), and most likely increases susceptibility to Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11).", "compensating_control_1": { "control_id": "IAC-25", "name": "Access Enforcement", "description": "Mechanisms exist to enforce Logical Access Control (LAC) permissions that conform to the principle of \"least privilege.\"", "justification": "Access Enforcement (IAC-25) provides access control enforcement that compensates for the absence of Automated Decision-Making Technology (ADMT) Opt-Out Consent (PRI-36.3) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "PRI-36.1", "name": "Automated Decision-Making Technology (ADMT) For Data Subject Actions", "description": "Mechanisms exist to ensure data subject actions utilizing Automated Decision-Making Technology (ADMT) where computation replaces, or substantially replaces, human decisionmaking, conforms with all applicable statutory, regulatory and/or contractual obligations.", "justification": "Automated Decision-Making Technology (ADMT) For Data Subject Actions (PRI-36.1) provides detective monitoring capability that compensates for the absence of Automated Decision-Making Technology (ADMT) Opt-Out Consent (PRI-36.3) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "PRI-36.4", "risk_if_not_implemented": "Without Automated Decision-Making Technology (ADMT) Transparency, Personal Data (PD) may be collected, processed, retained or shared without lawful authority or adequate safeguards, harming individuals and exposing the organization to regulatory action. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Regulatory / Legal / Contractual Financial Liability (R-EX-5), Privacy Harm / Unauthorized Processing (R-IP-6), and most likely increases susceptibility to Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11).", "compensating_control_1": { "control_id": "PRI-36.1", "name": "Automated Decision-Making Technology (ADMT) For Data Subject Actions", "description": "Mechanisms exist to ensure data subject actions utilizing Automated Decision-Making Technology (ADMT) where computation replaces, or substantially replaces, human decisionmaking, conforms with all applicable statutory, regulatory and/or contractual obligations.", "justification": "Automated Decision-Making Technology (ADMT) For Data Subject Actions (PRI-36.1) provides detective monitoring capability that compensates for the absence of Automated Decision-Making Technology (ADMT) Transparency (PRI-36.4) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "IAC-25", "name": "Access Enforcement", "description": "Mechanisms exist to enforce Logical Access Control (LAC) permissions that conform to the principle of \"least privilege.\"", "justification": "Access Enforcement (IAC-25) provides access control enforcement that compensates for the absence of Automated Decision-Making Technology (ADMT) Transparency (PRI-36.4) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "PRI-37", "risk_if_not_implemented": "Without Data Subject Communications, Personal Data (PD) may be collected, processed, retained or shared without lawful authority or adequate safeguards, harming individuals and exposing the organization to regulatory action. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Regulatory / Legal / Contractual Financial Liability (R-EX-5), Privacy Harm / Unauthorized Processing (R-IP-6), and most likely increases susceptibility to Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11).", "compensating_control_1": { "control_id": "PRI-21", "name": "Data Privacy Notice", "description": "Mechanisms exist to:\n(1) Make data privacy notice(s) available to individuals upon first interacting with an organization and subsequently as necessary; \n(2) Ensure that data privacy notices are clear and easy-to-understand, expressing relevant information about how Personal Data (PD) is collected, received, processed, stored, transmitted, shared, updated and/or disposed;\n(3) Contain all necessary notice-related criteria required by applicable statutory, regulatory and contractual obligations;\n(4) Define the scope of PD processing activities, including the geographic locations and third-party recipients that process the PD within the scope of the data privacy notice;\n(5) Periodically, review and update the content of the privacy notice, as necessary; and\n(6) Retain prior versions of the privacy notice, in accordance with data retention requirements.", "justification": "Data Privacy Notice (PRI-21) provides privacy protection that compensates for the absence of Data Subject Communications (PRI-37) by applying alternative privacy safeguards to protect personal data and honor data subject rights. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CPL-02", "name": "Statutory, Regulatory & Contractual Compliance", "description": "Mechanisms exist to facilitate the identification and implementation of relevant statutory, regulatory and contractual controls.", "justification": "Statutory, Regulatory & Contractual Compliance (CPL-02) provides overlapping security capability that compensates for the absence of Data Subject Communications (PRI-37) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "PRI-37.1", "risk_if_not_implemented": "Without Communicating Processing Changes, Personal Data (PD) may be collected, processed, retained or shared without lawful authority or adequate safeguards, harming individuals and exposing the organization to regulatory action. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Regulatory / Legal / Contractual Financial Liability (R-EX-5), Privacy Harm / Unauthorized Processing (R-IP-6), and most likely increases susceptibility to Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11).", "compensating_control_1": { "control_id": "PRI-24", "name": "Data Subject Consent", "description": "Mechanisms exist to enable data subjects to authorize the collection, receipt, processing, storage, transmission, sharing, updating and/or disposal of their Personal Data (PD), where the data subject is provided, prior to collection, with:\n(1) Plain language explaining the potential data privacy risks of the authorization;\n(2) A means to decline the authorization; and\n(3) Necessary choice and consent-related criteria required by applicable statutory, regulatory and contractual obligations.", "justification": "Data Subject Consent (PRI-24) provides privacy protection that compensates for the absence of Communicating Processing Changes (PRI-37.1) by applying alternative privacy safeguards to protect personal data and honor data subject rights. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "PRI-21", "name": "Data Privacy Notice", "description": "Mechanisms exist to:\n(1) Make data privacy notice(s) available to individuals upon first interacting with an organization and subsequently as necessary; \n(2) Ensure that data privacy notices are clear and easy-to-understand, expressing relevant information about how Personal Data (PD) is collected, received, processed, stored, transmitted, shared, updated and/or disposed;\n(3) Contain all necessary notice-related criteria required by applicable statutory, regulatory and contractual obligations;\n(4) Define the scope of PD processing activities, including the geographic locations and third-party recipients that process the PD within the scope of the data privacy notice;\n(5) Periodically, review and update the content of the privacy notice, as necessary; and\n(6) Retain prior versions of the privacy notice, in accordance with data retention requirements.", "justification": "Data Privacy Notice (PRI-21) provides privacy protection that compensates for the absence of Communicating Processing Changes (PRI-37.1) by applying alternative privacy safeguards to protect personal data and honor data subject rights. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "PRI-37.2", "risk_if_not_implemented": "Without Data Subject Communications Documentation, Personal Data (PD) may be collected, processed, retained or shared without lawful authority or adequate safeguards, harming individuals and exposing the organization to regulatory action. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss of Accountability / Attribution (R-AC-1), Unauthorized Retention / Inability to Dispose of Data (R-AM-3), Contractual Default / Termination (R-EX-2), Regulatory / Legal / Contractual Financial Liability (R-EX-5), Inability to Demonstrate Due Diligence / Due Care (R-GV-9), and most likely increases susceptibility to Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11).", "compensating_control_1": { "control_id": "PRI-21", "name": "Data Privacy Notice", "description": "Mechanisms exist to:\n(1) Make data privacy notice(s) available to individuals upon first interacting with an organization and subsequently as necessary; \n(2) Ensure that data privacy notices are clear and easy-to-understand, expressing relevant information about how Personal Data (PD) is collected, received, processed, stored, transmitted, shared, updated and/or disposed;\n(3) Contain all necessary notice-related criteria required by applicable statutory, regulatory and contractual obligations;\n(4) Define the scope of PD processing activities, including the geographic locations and third-party recipients that process the PD within the scope of the data privacy notice;\n(5) Periodically, review and update the content of the privacy notice, as necessary; and\n(6) Retain prior versions of the privacy notice, in accordance with data retention requirements.", "justification": "Data Privacy Notice (PRI-21) provides privacy protection that compensates for the absence of Data Subject Communications Documentation (PRI-37.2) by applying alternative privacy safeguards to protect personal data and honor data subject rights. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "PRI-37", "name": "Data Subject Communications", "description": "Mechanisms exist to craft disclosures and communications to data subjects in a manner that is concise, unambiguous and understandable by a reasonable person.", "justification": "Data Subject Communications (PRI-37) provides privacy protection that compensates for the absence of Data Subject Communications Documentation (PRI-37.2) by applying alternative privacy safeguards to protect personal data and honor data subject rights. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "PRI-37.3", "risk_if_not_implemented": "Without Data Subject Communications Metrics, Personal Data (PD) may be collected, processed, retained or shared without lawful authority or adequate safeguards, harming individuals and exposing the organization to regulatory action. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Regulatory / Legal / Contractual Financial Liability (R-EX-5), Unreliable Assurance / Decision Information (R-GV-10), and most likely increases susceptibility to Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11).", "compensating_control_1": { "control_id": "PRI-37", "name": "Data Subject Communications", "description": "Mechanisms exist to craft disclosures and communications to data subjects in a manner that is concise, unambiguous and understandable by a reasonable person.", "justification": "Data Subject Communications (PRI-37) provides privacy protection that compensates for the absence of Data Subject Communications Metrics (PRI-37.3) by applying alternative privacy safeguards to protect personal data and honor data subject rights. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "PRI-21", "name": "Data Privacy Notice", "description": "Mechanisms exist to:\n(1) Make data privacy notice(s) available to individuals upon first interacting with an organization and subsequently as necessary; \n(2) Ensure that data privacy notices are clear and easy-to-understand, expressing relevant information about how Personal Data (PD) is collected, received, processed, stored, transmitted, shared, updated and/or disposed;\n(3) Contain all necessary notice-related criteria required by applicable statutory, regulatory and contractual obligations;\n(4) Define the scope of PD processing activities, including the geographic locations and third-party recipients that process the PD within the scope of the data privacy notice;\n(5) Periodically, review and update the content of the privacy notice, as necessary; and\n(6) Retain prior versions of the privacy notice, in accordance with data retention requirements.", "justification": "Data Privacy Notice (PRI-21) provides privacy protection that compensates for the absence of Data Subject Communications Metrics (PRI-37.3) by applying alternative privacy safeguards to protect personal data and honor data subject rights. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "PRI-37.4", "risk_if_not_implemented": "Without Data Subject Communications Disclosure, Personal Data (PD) may be collected, processed, retained or shared without lawful authority or adequate safeguards, harming individuals and exposing the organization to regulatory action. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Regulatory / Legal / Contractual Financial Liability (R-EX-5), and most likely increases susceptibility to Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11).", "compensating_control_1": { "control_id": "CPL-02", "name": "Statutory, Regulatory & Contractual Compliance", "description": "Mechanisms exist to facilitate the identification and implementation of relevant statutory, regulatory and contractual controls.", "justification": "Statutory, Regulatory & Contractual Compliance (CPL-02) provides overlapping security capability that compensates for the absence of Data Subject Communications Disclosure (PRI-37.4) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "PRI-37", "name": "Data Subject Communications", "description": "Mechanisms exist to craft disclosures and communications to data subjects in a manner that is concise, unambiguous and understandable by a reasonable person.", "justification": "Data Subject Communications (PRI-37) provides privacy protection that compensates for the absence of Data Subject Communications Disclosure (PRI-37.4) by applying alternative privacy safeguards to protect personal data and honor data subject rights. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "PRI-38", "risk_if_not_implemented": "Without Data Subject Authentication, credentials may be phished, replayed, guessed or stolen, allowing unauthorized actors to authenticate as trusted identities. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to R-AC-4, R-AC-5, R-BC-5, R-EX-5, R-IP-2, R-IP-3, R-IP-6, and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11), Fraud, Corruption and/or Intentional Criminal Conduct (MT-14).", "compensating_control_1": { "control_id": "CPL-02", "name": "Statutory, Regulatory & Contractual Compliance", "description": "Mechanisms exist to facilitate the identification and implementation of relevant statutory, regulatory and contractual controls.", "justification": "Statutory, Regulatory & Contractual Compliance (CPL-02) provides overlapping security capability that compensates for the absence of Data Subject Authentication (PRI-38) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "PRI-02", "name": "Data Privacy Program", "description": "Mechanisms exist to facilitate the implementation and operation of data protection controls throughout the data lifecycle to ensure all forms of Personal Data (PD) are processed lawfully, fairly and transparently.", "justification": "Data Privacy Program (PRI-02) provides policy-level governance that compensates for the absence of Data Subject Authentication (PRI-38) by establishing documented expectations, accountability structures, and organizational guardrails. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "PRI-39", "risk_if_not_implemented": "Without Data Subject Rights Management, Personal Data (PD) may be collected, processed, retained or shared without lawful authority or adequate safeguards, harming individuals and exposing the organization to regulatory action. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Regulatory / Legal / Contractual Financial Liability (R-EX-5), Inability to Demonstrate Due Diligence / Due Care (R-GV-9), Privacy Harm / Unauthorized Processing (R-IP-6), and most likely increases susceptibility to Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11).", "compensating_control_1": { "control_id": "PRI-02", "name": "Data Privacy Program", "description": "Mechanisms exist to facilitate the implementation and operation of data protection controls throughout the data lifecycle to ensure all forms of Personal Data (PD) are processed lawfully, fairly and transparently.", "justification": "Data Privacy Program (PRI-02) provides policy-level governance that compensates for the absence of User Feedback Management (PRI-39) by establishing documented expectations, accountability structures, and organizational guardrails. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "PRI-39.1", "name": "Data Subject Empowerment", "description": "Mechanisms exist to provide authenticated data subjects the ability to:\n(1) Access their Personal Data (PD) that is being processed, stored and shared, except where the burden, risk or expense of providing access would be disproportionate to the benefit offered to the data subject through granting access;\n(2) Obtain answers on the specifics of how their PD is collected, received, processed, stored, transmitted, shared, updated and/or disposed; \n(3) Obtain the source(s) of their PD; \n(4) Obtain the categories of their PD being collected, received, processed, stored and shared; \n(5) Request correction to their PD due to inaccuracies;\n(6) Request erasure of their PD; and\n(7) Restrict the further collecting, receiving, processing, storing, transmitting, updated and/or sharing of their PD.", "justification": "Data Subject Empowerment (PRI-39.1) provides privacy protection that compensates for the absence of User Feedback Management (PRI-39) by applying alternative privacy safeguards to protect personal data and honor data subject rights. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "PRI-39.1", "risk_if_not_implemented": "Without Data Subject Empowerment, Personal Data (PD) may be collected, processed, retained or shared without lawful authority or adequate safeguards, harming individuals and exposing the organization to regulatory action. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Regulatory / Legal / Contractual Financial Liability (R-EX-5), Privacy Harm / Unauthorized Processing (R-IP-6), and most likely increases susceptibility to Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11).", "compensating_control_1": { "control_id": "CPL-02", "name": "Statutory, Regulatory & Contractual Compliance", "description": "Mechanisms exist to facilitate the identification and implementation of relevant statutory, regulatory and contractual controls.", "justification": "Statutory, Regulatory & Contractual Compliance (CPL-02) provides overlapping security capability that compensates for the absence of Data Subject Empowerment (PRI-39.1) by addressing related risk objectives through an alternative control mechanism aligned with Data applicability. Given the data-handling focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "PRI-02", "name": "Data Privacy Program", "description": "Mechanisms exist to facilitate the implementation and operation of data protection controls throughout the data lifecycle to ensure all forms of Personal Data (PD) are processed lawfully, fairly and transparently.", "justification": "Data Privacy Program (PRI-02) provides policy-level governance that compensates for the absence of Data Subject Empowerment (PRI-39.1) by establishing documented expectations, accountability structures, and organizational guardrails. Given the data-handling focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "PRI-39.2", "risk_if_not_implemented": "Without Enabling Data Subjects To Update Personal Data (PD), Personal Data (PD) may be collected, processed, retained or shared without lawful authority or adequate safeguards, harming individuals and exposing the organization to regulatory action. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Regulatory / Legal / Contractual Financial Liability (R-EX-5), Loss of Data Integrity (R-IP-3), Privacy Harm / Unauthorized Processing (R-IP-6), and most likely increases susceptibility to Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11).", "compensating_control_1": { "control_id": "DCH-33.2", "name": "Data Quality Management", "description": "Mechanisms exist to manage the quality, utility, objectivity, integrity and impact determination and de-identification of sensitive and/or regulated data across the information lifecycle.", "justification": "Data Quality Management (DCH-33.2) provides overlapping security capability that compensates for the absence of Enabling Data Subjects To Update Personal Data (PD) (PRI-39.2) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "DCH-33", "name": "Data Quality Operations", "description": "Mechanisms exist to check for Redundant, Obsolete/Outdated, Toxic or Trivial (ROTT) data to ensure the accuracy, relevance, timeliness, impact, completeness and de-identification of information throughout the information lifecycle.", "justification": "Data Quality Operations (DCH-33) provides overlapping security capability that compensates for the absence of Enabling Data Subjects To Update Personal Data (PD) (PRI-39.2) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "PRI-39.3", "risk_if_not_implemented": "Without Correcting Inaccurate Personal Data (PD), Personal Data (PD) may be collected, processed, retained or shared without lawful authority or adequate safeguards, harming individuals and exposing the organization to regulatory action. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Regulatory / Legal / Contractual Financial Liability (R-EX-5), Loss of Data Integrity (R-IP-3), Privacy Harm / Unauthorized Processing (R-IP-6), and most likely increases susceptibility to Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11).", "compensating_control_1": { "control_id": "PRI-39.1", "name": "Data Subject Empowerment", "description": "Mechanisms exist to provide authenticated data subjects the ability to:\n(1) Access their Personal Data (PD) that is being processed, stored and shared, except where the burden, risk or expense of providing access would be disproportionate to the benefit offered to the data subject through granting access;\n(2) Obtain answers on the specifics of how their PD is collected, received, processed, stored, transmitted, shared, updated and/or disposed; \n(3) Obtain the source(s) of their PD; \n(4) Obtain the categories of their PD being collected, received, processed, stored and shared; \n(5) Request correction to their PD due to inaccuracies;\n(6) Request erasure of their PD; and\n(7) Restrict the further collecting, receiving, processing, storing, transmitting, updated and/or sharing of their PD.", "justification": "Data Subject Empowerment (PRI-39.1) provides privacy protection that compensates for the absence of Correcting Inaccurate Personal Data (PD) (PRI-39.3) by applying alternative privacy safeguards to protect personal data and honor data subject rights. Given the data-handling focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CPL-22", "name": "Grievances", "description": "Mechanisms exist to govern the intake and analysis of grievances related to the organization's cybersecurity and/or data protection practices.", "justification": "Grievances (CPL-22) provides overlapping security capability that compensates for the absence of Correcting Inaccurate Personal Data (PD) (PRI-39.3) by addressing related risk objectives through an alternative control mechanism aligned with Data applicability. Given the data-handling focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "PRI-39.4", "risk_if_not_implemented": "Without Notice of Correction or Processing Change, Personal Data (PD) may be collected, processed, retained or shared without lawful authority or adequate safeguards, harming individuals and exposing the organization to regulatory action. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Regulatory / Legal / Contractual Financial Liability (R-EX-5), Privacy Harm / Unauthorized Processing (R-IP-6), and most likely increases susceptibility to Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11).", "compensating_control_1": { "control_id": "CPL-02", "name": "Statutory, Regulatory & Contractual Compliance", "description": "Mechanisms exist to facilitate the identification and implementation of relevant statutory, regulatory and contractual controls.", "justification": "Statutory, Regulatory & Contractual Compliance (CPL-02) provides overlapping security capability that compensates for the absence of Notice of Correction or Processing Change (PRI-39.4) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "PRI-39.1", "name": "Data Subject Empowerment", "description": "Mechanisms exist to provide authenticated data subjects the ability to:\n(1) Access their Personal Data (PD) that is being processed, stored and shared, except where the burden, risk or expense of providing access would be disproportionate to the benefit offered to the data subject through granting access;\n(2) Obtain answers on the specifics of how their PD is collected, received, processed, stored, transmitted, shared, updated and/or disposed; \n(3) Obtain the source(s) of their PD; \n(4) Obtain the categories of their PD being collected, received, processed, stored and shared; \n(5) Request correction to their PD due to inaccuracies;\n(6) Request erasure of their PD; and\n(7) Restrict the further collecting, receiving, processing, storing, transmitting, updated and/or sharing of their PD.", "justification": "Data Subject Empowerment (PRI-39.1) provides privacy protection that compensates for the absence of Notice of Correction or Processing Change (PRI-39.4) by applying alternative privacy safeguards to protect personal data and honor data subject rights. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "PRI-39.5", "risk_if_not_implemented": "Without Appeal Adverse Decision, Personal Data (PD) may be collected, processed, retained or shared without lawful authority or adequate safeguards, harming individuals and exposing the organization to regulatory action. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Regulatory / Legal / Contractual Financial Liability (R-EX-5), Privacy Harm / Unauthorized Processing (R-IP-6), and most likely increases susceptibility to Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11), Conflict of Interest (COI) / Undue Influence / Insider Misconduct (MT-15).", "compensating_control_1": { "control_id": "PRI-39.1", "name": "Data Subject Empowerment", "description": "Mechanisms exist to provide authenticated data subjects the ability to:\n(1) Access their Personal Data (PD) that is being processed, stored and shared, except where the burden, risk or expense of providing access would be disproportionate to the benefit offered to the data subject through granting access;\n(2) Obtain answers on the specifics of how their PD is collected, received, processed, stored, transmitted, shared, updated and/or disposed; \n(3) Obtain the source(s) of their PD; \n(4) Obtain the categories of their PD being collected, received, processed, stored and shared; \n(5) Request correction to their PD due to inaccuracies;\n(6) Request erasure of their PD; and\n(7) Restrict the further collecting, receiving, processing, storing, transmitting, updated and/or sharing of their PD.", "justification": "Data Subject Empowerment (PRI-39.1) provides privacy protection that compensates for the absence of Appeal Adverse Decision (PRI-39.5) by applying alternative privacy safeguards to protect personal data and honor data subject rights. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "PRI-02", "name": "Data Privacy Program", "description": "Mechanisms exist to facilitate the implementation and operation of data protection controls throughout the data lifecycle to ensure all forms of Personal Data (PD) are processed lawfully, fairly and transparently.", "justification": "Data Privacy Program (PRI-02) provides policy-level governance that compensates for the absence of Appeal Adverse Decision (PRI-39.5) by establishing documented expectations, accountability structures, and organizational guardrails. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "PRI-40", "risk_if_not_implemented": "Without Right to Erasure, Personal Data (PD) may be collected, processed, retained or shared without lawful authority or adequate safeguards, harming individuals and exposing the organization to regulatory action. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Retention / Inability to Dispose of Data (R-AM-3), Regulatory / Legal / Contractual Financial Liability (R-EX-5), Privacy Harm / Unauthorized Processing (R-IP-6), and most likely increases susceptibility to Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11).", "compensating_control_1": { "control_id": "CPL-22", "name": "Grievances", "description": "Mechanisms exist to govern the intake and analysis of grievances related to the organization's cybersecurity and/or data protection practices.", "justification": "Grievances (CPL-22) provides overlapping security capability that compensates for the absence of Right to Erasure (PRI-40) by addressing related risk objectives through an alternative control mechanism aligned with People applicability. Given the people-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "PRI-39.1", "name": "Data Subject Empowerment", "description": "Mechanisms exist to provide authenticated data subjects the ability to:\n(1) Access their Personal Data (PD) that is being processed, stored and shared, except where the burden, risk or expense of providing access would be disproportionate to the benefit offered to the data subject through granting access;\n(2) Obtain answers on the specifics of how their PD is collected, received, processed, stored, transmitted, shared, updated and/or disposed; \n(3) Obtain the source(s) of their PD; \n(4) Obtain the categories of their PD being collected, received, processed, stored and shared; \n(5) Request correction to their PD due to inaccuracies;\n(6) Request erasure of their PD; and\n(7) Restrict the further collecting, receiving, processing, storing, transmitting, updated and/or sharing of their PD.", "justification": "Data Subject Empowerment (PRI-39.1) provides privacy protection that compensates for the absence of Right to Erasure (PRI-40) by applying alternative privacy safeguards to protect personal data and honor data subject rights. Given the people-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "PRI-41", "risk_if_not_implemented": "Without Data Portability, Personal Data (PD) may be collected, processed, retained or shared without lawful authority or adequate safeguards, harming individuals and exposing the organization to regulatory action. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Regulatory / Legal / Contractual Financial Liability (R-EX-5), Privacy Harm / Unauthorized Processing (R-IP-6), and most likely increases susceptibility to Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11).", "compensating_control_1": { "control_id": "PRI-39.1", "name": "Data Subject Empowerment", "description": "Mechanisms exist to provide authenticated data subjects the ability to:\n(1) Access their Personal Data (PD) that is being processed, stored and shared, except where the burden, risk or expense of providing access would be disproportionate to the benefit offered to the data subject through granting access;\n(2) Obtain answers on the specifics of how their PD is collected, received, processed, stored, transmitted, shared, updated and/or disposed; \n(3) Obtain the source(s) of their PD; \n(4) Obtain the categories of their PD being collected, received, processed, stored and shared; \n(5) Request correction to their PD due to inaccuracies;\n(6) Request erasure of their PD; and\n(7) Restrict the further collecting, receiving, processing, storing, transmitting, updated and/or sharing of their PD.", "justification": "Data Subject Empowerment (PRI-39.1) provides privacy protection that compensates for the absence of Data Portability (PRI-41) by applying alternative privacy safeguards to protect personal data and honor data subject rights. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CPL-02", "name": "Statutory, Regulatory & Contractual Compliance", "description": "Mechanisms exist to facilitate the identification and implementation of relevant statutory, regulatory and contractual controls.", "justification": "Statutory, Regulatory & Contractual Compliance (CPL-02) provides overlapping security capability that compensates for the absence of Data Portability (PRI-41) by addressing related risk objectives through an alternative control mechanism aligned with Technology applicability. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "PRI-41.1", "risk_if_not_implemented": "Without Personal Data (PD) Exports, Personal Data (PD) may be collected, processed, retained or shared without lawful authority or adequate safeguards, harming individuals and exposing the organization to regulatory action. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Regulatory / Legal / Contractual Financial Liability (R-EX-5), Privacy Harm / Unauthorized Processing (R-IP-6), and most likely increases susceptibility to Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11).", "compensating_control_1": { "control_id": "PRI-02", "name": "Data Privacy Program", "description": "Mechanisms exist to facilitate the implementation and operation of data protection controls throughout the data lifecycle to ensure all forms of Personal Data (PD) are processed lawfully, fairly and transparently.", "justification": "Data Privacy Program (PRI-02) provides policy-level governance that compensates for the absence of Personal Data (PD) Exports (PRI-41.1) by establishing documented expectations, accountability structures, and organizational guardrails. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CPL-02", "name": "Statutory, Regulatory & Contractual Compliance", "description": "Mechanisms exist to facilitate the identification and implementation of relevant statutory, regulatory and contractual controls.", "justification": "Statutory, Regulatory & Contractual Compliance (CPL-02) provides overlapping security capability that compensates for the absence of Personal Data (PD) Exports (PRI-41.1) by addressing related risk objectives through an alternative control mechanism aligned with Technology applicability. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "PRI-42", "risk_if_not_implemented": "Without Obligation To Inform Third-Parties, supplier and External Service Provider (ESP) weaknesses, incidents or failures may propagate into the organization's environment unmanaged. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Regulatory / Legal / Contractual Financial Liability (R-EX-5), Privacy Harm / Unauthorized Processing (R-IP-6), and most likely increases susceptibility to Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11).", "compensating_control_1": { "control_id": "PRI-16", "name": "Information Sharing With Third Parties", "description": "Mechanisms exist to disclose Personal Data (PD) to third-parties only for the purposes identified in the data privacy notice and with the implicit or explicit consent of the data subject.", "justification": "Information Sharing With Third Parties (PRI-16) provides third-party oversight that compensates for the absence of Obligation To Inform Third-Parties (PRI-42) by extending security obligations contractually and monitoring third-party risk in lieu of direct control. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "DCH-08.1", "name": "Sensitive / Regulated Data Sharing Decisions", "description": "Mechanisms exist to utilize a process to assist users in making information sharing decisions to ensure data is appropriately protected.", "justification": "Sensitive / Regulated Data Sharing Decisions (DCH-08.1) provides overlapping security capability that compensates for the absence of Obligation To Inform Third-Parties (PRI-42) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "PRI-43", "risk_if_not_implemented": "Without Joint Processing of Personal Data (PD), Personal Data (PD) may be collected, processed, retained or shared without lawful authority or adequate safeguards, harming individuals and exposing the organization to regulatory action. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Regulatory / Legal / Contractual Financial Liability (R-EX-5), Unperformed / Unowned Control Responsibilities (R-GV-3), Inability to Demonstrate Due Diligence / Due Care (R-GV-9), and most likely increases susceptibility to Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11).", "compensating_control_1": { "control_id": "TPM-14", "name": "Third-Party Contract Requirements", "description": "Mechanisms exist to require contractual requirements for applicable security, compliance and resilience requirements with third-parties, reflecting the organization's needs to protect its Technology Assets, Applications, Services and/or Data (TAASD).", "justification": "Third-Party Contract Requirements (TPM-14) provides third-party oversight that compensates for the absence of Joint Processing of Personal Data (PD) (PRI-43) by extending security obligations contractually and monitoring third-party risk in lieu of direct control. Given the data-handling focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "PRI-16", "name": "Information Sharing With Third Parties", "description": "Mechanisms exist to disclose Personal Data (PD) to third-parties only for the purposes identified in the data privacy notice and with the implicit or explicit consent of the data subject.", "justification": "Information Sharing With Third Parties (PRI-16) provides third-party oversight that compensates for the absence of Joint Processing of Personal Data (PD) (PRI-43) by extending security obligations contractually and monitoring third-party risk in lieu of direct control. Given the data-handling focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "PRI-44", "risk_if_not_implemented": "Without Data Controller Communications, Personal Data (PD) may be collected, processed, retained or shared without lawful authority or adequate safeguards, harming individuals and exposing the organization to regulatory action. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Regulatory / Legal / Contractual Financial Liability (R-EX-5), Privacy Harm / Unauthorized Processing (R-IP-6), and most likely increases susceptibility to Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11).", "compensating_control_1": { "control_id": "CPL-02", "name": "Statutory, Regulatory & Contractual Compliance", "description": "Mechanisms exist to facilitate the identification and implementation of relevant statutory, regulatory and contractual controls.", "justification": "Statutory, Regulatory & Contractual Compliance (CPL-02) provides overlapping security capability that compensates for the absence of Data Controller Communications (PRI-44) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "PRI-02", "name": "Data Privacy Program", "description": "Mechanisms exist to facilitate the implementation and operation of data protection controls throughout the data lifecycle to ensure all forms of Personal Data (PD) are processed lawfully, fairly and transparently.", "justification": "Data Privacy Program (PRI-02) provides policy-level governance that compensates for the absence of Data Controller Communications (PRI-44) by establishing documented expectations, accountability structures, and organizational guardrails. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "PRI-45", "risk_if_not_implemented": "Without Register As A Data Controller and/or Data Processor, Personal Data (PD) may be collected, processed, retained or shared without lawful authority or adequate safeguards, harming individuals and exposing the organization to regulatory action. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Regulatory / Legal / Contractual Financial Liability (R-EX-5), Loss of Authorization / Certification / License (R-EX-11), Privacy Harm / Unauthorized Processing (R-IP-6), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11).", "compensating_control_1": { "control_id": "CPL-02", "name": "Statutory, Regulatory & Contractual Compliance", "description": "Mechanisms exist to facilitate the identification and implementation of relevant statutory, regulatory and contractual controls.", "justification": "Statutory, Regulatory & Contractual Compliance (CPL-02) provides overlapping security capability that compensates for the absence of Register As A Data Controller and/or Data Processor (PRI-45) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "DCH-03", "name": "Sensitive / Regulated Data Governance", "description": "Mechanisms exist to facilitate data governance so that sensitive and/or regulated data is effectively managed and maintained in accordance with applicable statutory, regulatory and contractual obligations.", "justification": "Sensitive / Regulated Data Governance (DCH-03) provides policy-level governance that compensates for the absence of Register As A Data Controller and/or Data Processor (PRI-45) by establishing documented expectations, accountability structures, and organizational guardrails. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "PRM-02", "risk_if_not_implemented": "Without Strategic Plan & Objectives, security, compliance and resilience requirements may be omitted from projects and initiatives until late, costly stages. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Failure to Achieve Strategic / Mission Objectives (R-EX-8), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9).", "compensating_control_1": { "control_id": "GOV-02", "name": "Security, Compliance & Resilience Program (SCRP)", "description": "Mechanisms exist to facilitate the design, implementation, and monitoring of security, compliance and resilience governance controls.", "justification": "Security, Compliance & Resilience Program (SCRP) (GOV-02) provides resilience and recovery capability that compensates for the absence of Strategic Plan & Objectives (PRM-02) by ensuring the organization can restore operations and data when the primary control is absent. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "RSK-02", "name": "Risk Management Program", "description": "Mechanisms exist to facilitate the implementation of strategic, operational and tactical risk management controls that are aligned with:\n(1) The organization's Enterprise Risk Management (ERM); and\n(2) Industry-recognized cybersecurity risk management practices.", "justification": "Risk Management Program (RSK-02) provides policy-level governance that compensates for the absence of Strategic Plan & Objectives (PRM-02) by establishing documented expectations, accountability structures, and organizational guardrails. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "PRM-03", "risk_if_not_implemented": "Without Targeted Capability Maturity Levels, security, compliance and resilience requirements may be omitted from projects and initiatives until late, costly stages. Based on the risk and threat mapping for this control, no risk is rated Likely; risks rated Possible include Failure to Achieve Strategic / Mission Objectives (R-EX-8), Failure to Support Business / Mission Objectives (R-GV-1), Unaddressed Security / Compliance Exposure (R-GV-2), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9).", "compensating_control_1": { "control_id": "RSK-02", "name": "Risk Management Program", "description": "Mechanisms exist to facilitate the implementation of strategic, operational and tactical risk management controls that are aligned with:\n(1) The organization's Enterprise Risk Management (ERM); and\n(2) Industry-recognized cybersecurity risk management practices.", "justification": "Risk Management Program (RSK-02) provides policy-level governance that compensates for the absence of Targeted Capability Maturity Levels (PRM-03) by establishing documented expectations, accountability structures, and organizational guardrails. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "PRM-04", "name": "Security, Compliance & Resilience Protection Portfolio Management", "description": "Mechanisms exist to facilitate the implementation of resource planning controls that provide a portfolio management approach to achieve security, compliance and resilience objectives.", "justification": "Security, Compliance & Resilience Protection Portfolio Management (PRM-04) provides resilience and recovery capability that compensates for the absence of Targeted Capability Maturity Levels (PRM-03) by ensuring the organization can restore operations and data when the primary control is absent. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "PRM-04", "risk_if_not_implemented": "Without Security, Compliance & Resilience Protection Portfolio Management, security, compliance and resilience requirements may be omitted from projects and initiatives until late, costly stages. Based on the risk and threat mapping for this control, no risk is rated Likely; risks rated Possible include Business / Service Interruption (R-BC-1), Reduced Operational Productivity (R-BC-3), Regulatory / Legal / Contractual Financial Liability (R-EX-5), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9).", "compensating_control_1": { "control_id": "RSK-02", "name": "Risk Management Program", "description": "Mechanisms exist to facilitate the implementation of strategic, operational and tactical risk management controls that are aligned with:\n(1) The organization's Enterprise Risk Management (ERM); and\n(2) Industry-recognized cybersecurity risk management practices.", "justification": "Risk Management Program (RSK-02) provides policy-level governance that compensates for the absence of Security, Compliance & Resilience Protection Portfolio Management (PRM-04) by establishing documented expectations, accountability structures, and organizational guardrails. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "GOV-02", "name": "Security, Compliance & Resilience Program (SCRP)", "description": "Mechanisms exist to facilitate the design, implementation, and monitoring of security, compliance and resilience governance controls.", "justification": "Security, Compliance & Resilience Program (SCRP) (GOV-02) provides resilience and recovery capability that compensates for the absence of Security, Compliance & Resilience Protection Portfolio Management (PRM-04) by ensuring the organization can restore operations and data when the primary control is absent. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "PRM-04.1", "risk_if_not_implemented": "Without Purpose Validation, security, compliance and resilience requirements may be omitted from projects and initiatives until late, costly stages. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Undetected / Delayed Detection of Adverse Activity (R-SA-1), Harm from Unauthorized / Unintended Product or Service Use (R-SC-5), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Data Quality Degradation / Data Poisoning (MT-12).", "compensating_control_1": { "control_id": "PRI-31.1", "name": "Restrict Collection, Processing & Sharing To Identified Purpose", "description": "Mechanisms exist to minimize the collection, processing and/or sharing of Personal Data (PD) to only what is adequate, relevant and limited to the purposes identified in the data privacy notice, including protections against collecting PD from minors without appropriate parental or legal guardian consent.", "justification": "Restrict Collection, Processing & Sharing To Identified Purpose (PRI-31.1) provides overlapping security capability that compensates for the absence of Purpose Validation (PRM-04.1) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "DCH-02", "name": "Data Protection", "description": "Mechanisms exist to facilitate the implementation of data protection controls.", "justification": "Data Protection (DCH-02) provides overlapping security capability that compensates for the absence of Purpose Validation (PRM-04.1) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "PRM-05", "risk_if_not_implemented": "Without Security, Compliance & Resilience Resource Management, security, compliance and resilience requirements may be omitted from projects and initiatives until late, costly stages. Based on the risk and threat mapping for this control, no risk is rated Likely; risks rated Possible include Business / Service Interruption (R-BC-1), Reduced Operational Productivity (R-BC-3), Regulatory / Legal / Contractual Financial Liability (R-EX-5), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Economic Shock / Market Disruption (MT-16).", "compensating_control_1": { "control_id": "RSK-02", "name": "Risk Management Program", "description": "Mechanisms exist to facilitate the implementation of strategic, operational and tactical risk management controls that are aligned with:\n(1) The organization's Enterprise Risk Management (ERM); and\n(2) Industry-recognized cybersecurity risk management practices.", "justification": "Risk Management Program (RSK-02) provides policy-level governance that compensates for the absence of Security, Compliance & Resilience Resource Management (PRM-05) by establishing documented expectations, accountability structures, and organizational guardrails. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "GOV-12", "name": "Measures of Performance", "description": "Mechanisms exist to develop, report and monitor Security, Compliance & Resilience Program (SCRP) measures of performance.", "justification": "Measures of Performance (GOV-12) provides overlapping security capability that compensates for the absence of Security, Compliance & Resilience Resource Management (PRM-05) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "PRM-05.1", "risk_if_not_implemented": "Without Commitment To Continual Improvements, security, compliance and resilience requirements may be omitted from projects and initiatives until late, costly stages. Based on the risk and threat mapping for this control, no risk is rated Likely; risks rated Possible include Business / Service Interruption (R-BC-1), Reduced Operational Productivity (R-BC-3), Regulatory / Legal / Contractual Financial Liability (R-EX-5), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Economic Shock / Market Disruption (MT-16), Workforce Shortage / Loss of Critical Skills / Labor Disruption (MT-25).", "compensating_control_1": { "control_id": "PRM-05", "name": "Security, Compliance & Resilience Resource Management", "description": "Mechanisms exist to address all capital planning and investment requests, including the resources needed to implement the Security, Compliance & Resilience Program (SCRP) and document all exceptions.", "justification": "Security, Compliance & Resilience Resource Management (PRM-05) provides resilience and recovery capability that compensates for the absence of Commitment To Continual Improvements (PRM-05.1) by ensuring the organization can restore operations and data when the primary control is absent. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "RSK-02", "name": "Risk Management Program", "description": "Mechanisms exist to facilitate the implementation of strategic, operational and tactical risk management controls that are aligned with:\n(1) The organization's Enterprise Risk Management (ERM); and\n(2) Industry-recognized cybersecurity risk management practices.", "justification": "Risk Management Program (RSK-02) provides policy-level governance that compensates for the absence of Commitment To Continual Improvements (PRM-05.1) by establishing documented expectations, accountability structures, and organizational guardrails. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "PRM-05.2", "risk_if_not_implemented": "Without Prioritization To Address Evolving Risks & Threats, security, compliance and resilience requirements may be omitted from projects and initiatives until late, costly stages. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Undetected / Delayed Detection of Adverse Activity (R-SA-1), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9).", "compensating_control_1": { "control_id": "GOV-12", "name": "Measures of Performance", "description": "Mechanisms exist to develop, report and monitor Security, Compliance & Resilience Program (SCRP) measures of performance.", "justification": "Measures of Performance (GOV-12) provides overlapping security capability that compensates for the absence of Prioritization To Address Evolving Risks & Threats (PRM-05.2) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "RSK-02", "name": "Risk Management Program", "description": "Mechanisms exist to facilitate the implementation of strategic, operational and tactical risk management controls that are aligned with:\n(1) The organization's Enterprise Risk Management (ERM); and\n(2) Industry-recognized cybersecurity risk management practices.", "justification": "Risk Management Program (RSK-02) provides policy-level governance that compensates for the absence of Prioritization To Address Evolving Risks & Threats (PRM-05.2) by establishing documented expectations, accountability structures, and organizational guardrails. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "PRM-06", "risk_if_not_implemented": "Without Allocation of Resources, security, compliance and resilience requirements may be omitted from projects and initiatives until late, costly stages. Based on the risk and threat mapping for this control, no risk is rated Likely; risks rated Possible include Business / Service Interruption (R-BC-1), Reduced Operational Productivity (R-BC-3), Regulatory / Legal / Contractual Financial Liability (R-EX-5), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Economic Shock / Market Disruption (MT-16).", "compensating_control_1": { "control_id": "PRM-05", "name": "Security, Compliance & Resilience Resource Management", "description": "Mechanisms exist to address all capital planning and investment requests, including the resources needed to implement the Security, Compliance & Resilience Program (SCRP) and document all exceptions.", "justification": "Security, Compliance & Resilience Resource Management (PRM-05) provides resilience and recovery capability that compensates for the absence of Allocation of Resources (PRM-06) by ensuring the organization can restore operations and data when the primary control is absent. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "RSK-02", "name": "Risk Management Program", "description": "Mechanisms exist to facilitate the implementation of strategic, operational and tactical risk management controls that are aligned with:\n(1) The organization's Enterprise Risk Management (ERM); and\n(2) Industry-recognized cybersecurity risk management practices.", "justification": "Risk Management Program (RSK-02) provides policy-level governance that compensates for the absence of Allocation of Resources (PRM-06) by establishing documented expectations, accountability structures, and organizational guardrails. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "PRM-08.1", "risk_if_not_implemented": "Without Project Management Stage Gates, security, compliance and resilience requirements may be omitted from projects and initiatives until late, costly stages. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unaddressed Security / Compliance Exposure (R-GV-2), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9).", "compensating_control_1": { "control_id": "PRM-08", "name": "Security, Compliance & Resilience In Project Management", "description": "Mechanisms exist to assess security, compliance and resilience controls as part of Technology Assets, Applications and/or Services (TAAS) project development to determine whether controls are implemented correctly, operating as intended and producing the desired outcome with respect to meeting requirements.", "justification": "Security, Compliance & Resilience In Project Management (PRM-08) provides resilience and recovery capability that compensates for the absence of Project Management Stage Gates (PRM-08.1) by ensuring the organization can restore operations and data when the primary control is absent. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CHG-06", "name": "Security Impact Analysis for Changes", "description": "Mechanisms exist to analyze proposed changes for potential security impacts, prior to the implementation of the change.", "justification": "Security Impact Analysis for Changes (CHG-06) provides risk identification and prioritization that compensates for the absence of Project Management Stage Gates (PRM-08.1) by enabling informed decisions about where to focus resources to manage residual exposure. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "PRM-09", "risk_if_not_implemented": "Without Security, Compliance & Resilience Requirements Definition, security, compliance and resilience requirements may be omitted from projects and initiatives until late, costly stages. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unaddressed Security / Compliance Exposure (R-GV-2), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9).", "compensating_control_1": { "control_id": "TDA-11.1", "name": "Minimum Viable Product (MVP) Security Requirements", "description": "Mechanisms exist to design, develop and produce Technology Assets, Applications and/or Services (TAAS) in such a way that risk-based technical and functional specifications ensure Minimum Viable Product (MVP) criteria establish an appropriate level of security and resiliency based on applicable risks and threats.", "justification": "Minimum Viable Product (MVP) Security Requirements (TDA-11.1) provides overlapping security capability that compensates for the absence of Security, Compliance & Resilience Requirements Definition (PRM-09) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "RSK-13", "name": "Risk Assessment", "description": "Mechanisms exist to conduct recurring assessments of risk that includes the likelihood and magnitude of harm, from unauthorized access, use, disclosure, disruption, modification or destruction of the organization's Technology Assets, Applications, Services and/or Data (TAASD).", "justification": "Risk Assessment (RSK-13) provides periodic assessment and assurance that compensates for the absence of Security, Compliance & Resilience Requirements Definition (PRM-09) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "PRM-10", "risk_if_not_implemented": "Without Business Process Definition, security, compliance and resilience requirements may be omitted from projects and initiatives until late, costly stages. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unaddressed Security / Compliance Exposure (R-GV-2), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9).", "compensating_control_1": { "control_id": "GOV-06", "name": "Defining Business Context & Mission", "description": "Mechanisms exist to document the organization's business model and mission.", "justification": "Defining Business Context & Mission (GOV-06) provides overlapping security capability that compensates for the absence of Business Process Definition (PRM-10) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "RSK-02", "name": "Risk Management Program", "description": "Mechanisms exist to facilitate the implementation of strategic, operational and tactical risk management controls that are aligned with:\n(1) The organization's Enterprise Risk Management (ERM); and\n(2) Industry-recognized cybersecurity risk management practices.", "justification": "Risk Management Program (RSK-02) provides policy-level governance that compensates for the absence of Business Process Definition (PRM-10) by establishing documented expectations, accountability structures, and organizational guardrails. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "PRM-11", "risk_if_not_implemented": "Without Manage Organizational Knowledge, essential knowledge and skills may be unavailable when needed, degrading the organization's ability to operate and protect itself. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss of Critical Knowledge / Capability (R-PE-1), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Workforce Shortage / Loss of Critical Skills / Labor Disruption (MT-25).", "compensating_control_1": { "control_id": "SAT-12", "name": "Security, Compliance & Resilience Knowledge Sharing", "description": "Mechanisms exist to improve knowledge sharing across security, compliance and resilience personnel allowing for:\n(1) Efficient operations; and\n(2) Rapid and effective response to incidents.", "justification": "Security, Compliance & Resilience Knowledge Sharing (SAT-12) provides personnel training and awareness that compensates for the absence of Manage Organizational Knowledge (PRM-11) by reducing human-factor risk by equipping personnel to recognize and respond to relevant threats. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "GOV-04", "name": "Publishing Security, Compliance & Resilience Documentation", "description": "Mechanisms exist to establish, maintain and disseminate policies, standards and procedures necessary for secure, compliant and resilient capabilities.", "justification": "Publishing Security, Compliance & Resilience Documentation (GOV-04) provides resilience and recovery capability that compensates for the absence of Manage Organizational Knowledge (PRM-11) by ensuring the organization can restore operations and data when the primary control is absent. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "QTS-01", "risk_if_not_implemented": "Without Quantum Security Policy, sensitive data with long confidentiality lifetimes remains protected only by quantum-vulnerable cryptography, exposing it to future decryption. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unperformed / Unowned Control Responsibilities (R-GV-3), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9).", "compensating_control_1": { "control_id": "GOV-02", "name": "Security, Compliance & Resilience Program (SCRP)", "description": "Mechanisms exist to facilitate the design, implementation, and monitoring of security, compliance and resilience governance controls.", "justification": "Publishing Security, Compliance & Resilience Documentation (GOV-02) provides resilience and recovery capability that compensates for the absence of Quantum Security Policy (QTS-01) by ensuring the organization can restore operations when the primary control is absent. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CRY-02", "name": "Use of Cryptographic Controls", "description": "Mechanisms exist to facilitate the implementation of cryptographic protections controls using known public standards and trusted cryptographic technologies.", "justification": "Use of Cryptographic Controls (CRY-02) provides cryptographic protection and key governance that compensates for the absence of Quantum Security Policy (QTS-01) by ensuring data confidentiality and integrity through alternative or complementary cryptographic mechanisms. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "QTS-02", "risk_if_not_implemented": "Without Quantum Risk Governance, sensitive data with long confidentiality lifetimes remains protected only by quantum-vulnerable cryptography, exposing it to future decryption. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unperformed / Unowned Control Responsibilities (R-GV-3), Unreliable Assurance / Decision Information (R-GV-10), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8).", "compensating_control_1": { "control_id": "RSK-02", "name": "Risk Management Program", "description": "Mechanisms exist to facilitate the implementation of strategic, operational and tactical risk management controls that are aligned with:\n(1) The organization's Enterprise Risk Management (ERM); and\n(2) Industry-recognized cybersecurity risk management practices.", "justification": "Risk Management Program (RSK-02) provides policy-level governance that compensates for the absence of Quantum Risk Governance (QTS-02) by establishing documented expectations, accountability structures, and organizational guardrails. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "GOV-02", "name": "Security, Compliance & Resilience Program (SCRP)", "description": "Mechanisms exist to facilitate the design, implementation, and monitoring of security, compliance and resilience governance controls.", "justification": "Security, Compliance & Resilience Program (SCRP) (GOV-02) provides resilience and recovery capability that compensates for the absence of Quantum Risk Governance (QTS-02) by ensuring the organization can restore operations when the primary control is absent. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "QTS-03", "risk_if_not_implemented": "Without Data Shelf-Life Classification for Post-Quantum Cryptography (PQC) Prioritization, sensitive data with long confidentiality lifetimes remains protected only by quantum-vulnerable cryptography, exposing it to future decryption. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unaddressed Security / Compliance Exposure (R-GV-2), Long-Term Confidentiality Loss from Cryptographic Obsolescence (R-IP-1), and most likely increases susceptibility to Human Error (MT-9), Harvest Now / Decrypt Later (HNDL) (MT-28), Cryptographic Compromise / Cryptanalytic Capability Advancement (MT-31).", "compensating_control_1": { "control_id": "DCH-04", "name": "Data & Asset Classification", "description": "Mechanisms exist to ensure data and assets are categorized in accordance with applicable statutory, regulatory and contractual requirements.", "justification": "Data & Asset Classification (DCH-04) provides asset and inventory visibility that compensates for the absence of Data Shelf-Life Classification for Post-Quantum Cryptography (PQC) Prioritization (QTS-03) by providing the foundational asset knowledge needed to manage risks associated with the primary control. Given the data-handling focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "RSK-15", "name": "Risk Ranking", "description": "Mechanisms exist to identify and assign a risk ranking to newly discovered security vulnerabilities that is based on industry-recognized practices.", "justification": "Risk Ranking (RSK-15) provides risk identification and prioritization that compensates for the absence of Data Shelf-Life Classification for Post-Quantum Cryptography (PQC) Prioritization (QTS-03) by enabling informed decisions about where to focus resources to manage residual exposure. Given the data-handling focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "QTS-03.1", "risk_if_not_implemented": "Without Long-Lived Data Identification, sensitive data with long confidentiality lifetimes remains protected only by quantum-vulnerable cryptography, exposing it to future decryption. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Long-Term Confidentiality Loss from Cryptographic Obsolescence (R-IP-1), and most likely increases susceptibility to Human Error (MT-9), Harvest Now / Decrypt Later (HNDL) (MT-28).", "compensating_control_1": { "control_id": "DCH-04", "name": "Data & Asset Classification", "description": "Mechanisms exist to ensure data and assets are categorized in accordance with applicable statutory, regulatory and contractual requirements.", "justification": "Data & Asset Classification (DCH-04) provides asset and inventory visibility that compensates for the absence of Long-Lived Data Identification (QTS-03.1) by providing the foundational asset knowledge needed to manage risks associated with the primary control. Given the data-handling focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "DCH-27", "name": "Media & Data Retention", "description": "Mechanisms exist to retain media and data in accordance with applicable statutory, regulatory and contractual obligations.", "justification": "Media & Data Retention (DCH-27) provides overlapping security capability that compensates for the absence of Long-Lived Data Identification (QTS-03.1) by addressing related risk objectives through an alternative control mechanism. Given the data-handling focus of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "QTS-04", "risk_if_not_implemented": "Without Cryptographic Agility Risk Assessment (CARA), data in transit and at rest may be exposed through weak, misconfigured or compromised cryptographic protections. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Long-Term Confidentiality Loss from Cryptographic Obsolescence (R-IP-1), and most likely increases susceptibility to Human Error (MT-9), Harvest Now / Decrypt Later (HNDL) (MT-28), Cryptographic Compromise / Cryptanalytic Capability Advancement (MT-31).", "compensating_control_1": { "control_id": "RSK-13", "name": "Risk Assessment", "description": "Mechanisms exist to conduct recurring assessments of risk that includes the likelihood and magnitude of harm, from unauthorized access, use, disclosure, disruption, modification or destruction of the organization's Technology Assets, Applications, Services and/or Data (TAASD).", "justification": "Risk Assessment (RSK-13) provides periodic assessment and verification that compensates for the absence of Cryptographic Agility Risk Assessment (CARA) (QTS-04) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CRY-02", "name": "Use of Cryptographic Controls", "description": "Mechanisms exist to facilitate the implementation of cryptographic protections controls using known public standards and trusted cryptographic technologies.", "justification": "Use of Cryptographic Controls (CRY-02) provides cryptographic protection and key governance that compensates for the absence of Cryptographic Agility Risk Assessment (CARA) (QTS-04) by ensuring data confidentiality and integrity through alternative or complementary cryptographic mechanisms. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "QTS-04.1", "risk_if_not_implemented": "Without Cryptographic Exception Register, data in transit and at rest may be exposed through weak, misconfigured or compromised cryptographic protections. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unperformed / Unowned Control Responsibilities (R-GV-3), Lack of oversight of internal controls (R-GV-6), Inability to Demonstrate Due Diligence / Due Care (R-GV-9), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9).", "compensating_control_1": { "control_id": "CPL-25", "name": "Statement of Applicability (SOA)", "description": "Mechanisms exist to produce a Statement of Applicability (SOA), or similar document, for compliance-related scoping activities.", "justification": "Statement of Applicability (SOA) (CPL-25) provides overlapping security capability that compensates for the absence of Cryptographic Exception Register (QTS-04.1) by addressing related risk objectives through an alternative control mechanism. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "RSK-17", "name": "Risk Remediation", "description": "Mechanisms exist to remediate risks to an acceptable level.", "justification": "Risk Remediation (RSK-17) provides vulnerability management that compensates for the absence of Cryptographic Exception Register (QTS-04.1) by reducing the exploitable attack surface by addressing known weaknesses and prioritizing critical remediations. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "QTS-04.2", "risk_if_not_implemented": "Without Compensating Controls for Quantum-Vulnerable Systems, sensitive data with long confidentiality lifetimes remains protected only by quantum-vulnerable cryptography, exposing it to future decryption. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Long-Term Confidentiality Loss from Cryptographic Obsolescence (R-IP-1), Loss of Confidentiality (R-IP-2), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Harvest Now / Decrypt Later (HNDL) (MT-28), Cryptographic Compromise / Cryptanalytic Capability Advancement (MT-31).", "compensating_control_1": { "control_id": "NET-06", "name": "Network Segmentation (macrosegmentation)", "description": "Mechanisms exist to implement network segmentation within network architectures to isolate Technology Assets, Applications and/or Services (TAAS) from other network resources.", "justification": "Network Segmentation (macrosegmentation) (NET-06) provides network-level access restriction that compensates for the absence of Compensating Controls for Quantum-Vulnerable Systems (QTS-04.2) by limiting attacker reach and lateral movement opportunities across the environment. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "IAC-30", "name": "Least Privilege", "description": "Mechanisms exist to utilize the concept of least privilege, allowing only authorized access to processes necessary to accomplish assigned tasks in accordance with organizational business functions.", "justification": "Least Privilege (IAC-30) provides access control enforcement that compensates for the absence of Compensating Controls for Quantum-Vulnerable Systems (QTS-04.2) by restricting system and data access through alternative identity and access management mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "QTS-04.3", "risk_if_not_implemented": "Without Crypto Agility Maturity Assessment, sensitive data with long confidentiality lifetimes remains protected only by quantum-vulnerable cryptography, exposing it to future decryption. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unreliable Assurance / Decision Information (R-GV-10), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9).", "compensating_control_1": { "control_id": "CPL-05", "name": "Conformity Monitoring", "description": "Mechanisms exist to validate that Technology Assets, Applications, Services and/or Data (TAASD) conform to the organization's security, compliance and/or resilience policies, standards and other applicable requirements.", "justification": "Conformity Monitoring (CPL-05) provides detective monitoring capability that compensates for the absence of Crypto Agility Maturity Assessment (QTS-04.3) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "IAO-04", "name": "Control Validation Testing (CVT)", "description": "Mechanisms exist to formally assess the security, compliance and resilience controls in Technology Assets, Applications and/or Services (TAAS) through Information Assurance Program (IAP) activities to determine the extent to which the controls are implemented correctly, operating as intended and producing the desired outcome with respect to meeting expected requirements.", "justification": "Control Validation Testing (CVT) (IAO-04) provides periodic assessment and verification that compensates for the absence of Crypto Agility Maturity Assessment (QTS-04.3) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "QTS-05", "risk_if_not_implemented": "Without Harvest Now, Decrypt Later (HNDL) Mitigation, sensitive data with long confidentiality lifetimes remains protected only by quantum-vulnerable cryptography, exposing it to future decryption. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Excessive or Unauthorized Privilege (R-AC-2), Unauthorized Access (R-AC-4), Identity Compromise / Impersonation (R-AC-5), Long-Term Confidentiality Loss from Cryptographic Obsolescence (R-IP-1), Loss of Confidentiality (R-IP-2), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Harvest Now / Decrypt Later (HNDL) (MT-28), Cryptographic Compromise / Cryptanalytic Capability Advancement (MT-31).", "compensating_control_1": { "control_id": "CRY-05", "name": "Encrypting Data In Transit", "description": "Cryptographic mechanisms exist to prevent the unauthorized disclosure of data in transit.", "justification": "Encrypting Data In Transit (CRY-05) provides overlapping security capability that compensates for the absence of Harvest Now, Decrypt Later (HNDL) Mitigation (QTS-05) by addressing related risk objectives through an alternative control mechanism. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "NET-03", "name": "Boundary Protection", "description": "Mechanisms exist to monitor and control communications at the external network boundary and at key internal boundaries within the network.", "justification": "Boundary Protection (NET-03) provides network-level access restriction that compensates for the absence of Harvest Now, Decrypt Later (HNDL) Mitigation (QTS-05) by limiting attacker reach and lateral movement opportunities across the environment. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "QTS-06", "risk_if_not_implemented": "Without Post-Quantum Cryptography Agility Plan (PQCAP), sensitive data with long confidentiality lifetimes remains protected only by quantum-vulnerable cryptography, exposing it to future decryption. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unperformed / Unowned Control Responsibilities (R-GV-3), Inability to Demonstrate Due Diligence / Due Care (R-GV-9), Long-Term Confidentiality Loss from Cryptographic Obsolescence (R-IP-1), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Harvest Now / Decrypt Later (HNDL) (MT-28), Cryptographic Compromise / Cryptanalytic Capability Advancement (MT-31).", "compensating_control_1": { "control_id": "RSK-02", "name": "Risk Management Program", "description": "Mechanisms exist to facilitate the implementation of strategic, operational and tactical risk management controls that are aligned with:\n(1) The organization's Enterprise Risk Management (ERM); and\n(2) Industry-recognized cybersecurity risk management practices.", "justification": "Risk Management Program (RSK-02) provides policy-level governance that compensates for the absence of Post-Quantum Cryptography Agility Plan (PSCAP) (QTS-06) by establishing documented expectations, accountability structures, and organizational guardrails. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CRY-10", "name": "Cryptographic Key Management", "description": "Mechanisms exist to facilitate cryptographic key management controls to protect the confidentiality, integrity and availability of keys.", "justification": "Cryptographic Key Management (CRY-10) provides cryptographic protection and key governance that compensates for the absence of Post-Quantum Cryptography Agility Plan (PSCAP) (QTS-06) by ensuring data confidentiality and integrity through alternative or complementary cryptographic mechanisms. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "QTS-06.1", "risk_if_not_implemented": "Without Post-Quantum Cryptography (PQC) Transition Planning & Hybrid Mode Support, sensitive data with long confidentiality lifetimes remains protected only by quantum-vulnerable cryptography, exposing it to future decryption. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Long-Term Confidentiality Loss from Cryptographic Obsolescence (R-IP-1), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Economic Shock / Market Disruption (MT-16), Harvest Now / Decrypt Later (HNDL) (MT-28), Cryptographic Compromise / Cryptanalytic Capability Advancement (MT-31).", "compensating_control_1": { "control_id": "CRY-09", "name": "Public Key Infrastructure (PKI)", "description": "Mechanisms exist to securely implement an internal Public Key Infrastructure (PKI) infrastructure or obtain PKI services from a reputable PKI service provider.", "justification": "Public Key Infrastructure (PKI) (CRY-09) provides cryptographic protection and key governance that compensates for the absence of Post-Quantum Cryptography (PQC) Transition Planning & Hybrid Mode Support (QTS-06.1) by ensuring data confidentiality and integrity through alternative or complementary cryptographic mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CHG-02", "name": "Change Management Program", "description": "Mechanisms exist to facilitate the implementation of a change management program.", "justification": "Change Management Program (CHG-02) provides policy-level governance that compensates for the absence of Post-Quantum Cryptography (PQC) Transition Planning & Hybrid Mode Support (QTS-06.1) by establishing documented expectations, accountability structures, and organizational guardrails. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "QTS-06.2", "risk_if_not_implemented": "Without Post-Quantum Cryptography (PQC) Migration Progress Oversight, sensitive data with long confidentiality lifetimes remains protected only by quantum-vulnerable cryptography, exposing it to future decryption. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Lack of oversight of internal controls (R-GV-6), Inability to Demonstrate Due Diligence / Due Care (R-GV-9), Unreliable Assurance / Decision Information (R-GV-10), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Data Quality Degradation / Data Poisoning (MT-12), Cryptographic Compromise / Cryptanalytic Capability Advancement (MT-31).", "compensating_control_1": { "control_id": "GOV-12", "name": "Measures of Performance", "description": "Mechanisms exist to develop, report and monitor Security, Compliance & Resilience Program (SCRP) measures of performance.", "justification": "Measures of Performance (GOV-12) provides overlapping security capability that compensates for the absence of Post-Quantum Cryptography (PQC) Migration Progress Oversight (QTS-06.2) by addressing related risk objectives through an alternative control mechanism. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "RSK-22", "name": "Risk Monitoring", "description": "Mechanisms exist to monitor risk as an integral part of the continuous monitoring strategy, including: \n(1) The effectiveness of security, compliance and resilience controls; \n(2) Changes to the organization's risk profile; and \n(3) Changes to Technology Assets, Applications and/or Services (TAAS) that affect risk.", "justification": "Risk Monitoring (RSK-22) provides detective monitoring capability that compensates for the absence of Post-Quantum Cryptography (PQC) Migration Progress Oversight (QTS-06.2) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "QTS-06.3", "risk_if_not_implemented": "Without Post-Quantum Cryptography (PQC) Supply Chain Visibility, sensitive data with long confidentiality lifetimes remains protected only by quantum-vulnerable cryptography, exposing it to future decryption. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Uncontrolled Third-Party Security / Privacy Exposure (R-GV-5), Lack of oversight of third-party controls (R-GV-7), and most likely increases susceptibility to Human Error (MT-9), Cryptographic Compromise / Cryptanalytic Capability Advancement (MT-31).", "compensating_control_1": { "control_id": "TPM-15", "name": "Review of Third-Party Services", "description": "Mechanisms exist to monitor, regularly review and assess External Service Providers (ESPs) for compliance with established contractual requirements for security, compliance and resilience controls.", "justification": "Review of Third-Party Services (TPM-15) provides periodic assessment and verification that compensates for the absence of Post-Quantum Cryptography (PQC) Supply Chain Visibility (QTS-06.3) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "TPM-14", "name": "Third-Party Contract Requirements", "description": "Mechanisms exist to require contractual requirements for applicable security, compliance and resilience requirements with third-parties, reflecting the organization's needs to protect its Technology Assets, Applications, Services and/or Data (TAASD).", "justification": "Third-Party Contract Requirements (TPM-14) provides third-party oversight and contractual controls that compensates for the absence of Post-Quantum Cryptography (PQC) Supply Chain Visibility (QTS-06.3) by extending security obligations and monitoring third-party risk in lieu of direct primary control implementation. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "QTS-06.4", "risk_if_not_implemented": "Without Post-Quantum Cryptography (PQC) Supply Chain Flow-Down Requirements, sensitive data with long confidentiality lifetimes remains protected only by quantum-vulnerable cryptography, exposing it to future decryption. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Uncontrolled Third-Party Security / Privacy Exposure (R-GV-5), Lack of oversight of third-party controls (R-GV-7), Sub-Tier / Fourth-Party Supply Chain Exposure (R-SC-3), and most likely increases susceptibility to Human Error (MT-9), Cryptographic Compromise / Cryptanalytic Capability Advancement (MT-31).", "compensating_control_1": { "control_id": "TPM-04", "name": "Supply Chain Risk Management (SCRM)", "description": "Mechanisms exist to:\n(1) Evaluate security risks and threats associated with Technology Assets, Applications and/or Services (TAAS) supply chains; and\n(2) Take appropriate remediation actions to minimize the organization's exposure to those risks and threats, as necessary.", "justification": "Supply Chain Risk Management (SCRM) (TPM-04) provides risk identification and prioritization that compensates for the absence of Post-Quantum Cryptography (PQC) Supply Chain Flow-Down Requirements (QTS-06.4) by enabling informed decisions about where to focus resources to manage residual exposure. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "TPM-14", "name": "Third-Party Contract Requirements", "description": "Mechanisms exist to require contractual requirements for applicable security, compliance and resilience requirements with third-parties, reflecting the organization's needs to protect its Technology Assets, Applications, Services and/or Data (TAASD).", "justification": "Third-Party Contract Requirements (TPM-14) provides third-party oversight and contractual controls that compensates for the absence of Post-Quantum Cryptography (PQC) Supply Chain Flow-Down Requirements (QTS-06.4) by extending security obligations and monitoring third-party risk in lieu of direct primary control implementation. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "QTS-07", "risk_if_not_implemented": "Without Post-Quantum Cryptography (PQC) Discovery & Visibility, sensitive data with long confidentiality lifetimes remains protected only by quantum-vulnerable cryptography, exposing it to future decryption. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unaddressed Security / Compliance Exposure (R-GV-2), and most likely increases susceptibility to Human Error (MT-9), Cryptographic Compromise / Cryptanalytic Capability Advancement (MT-31).", "compensating_control_1": { "control_id": "AST-04", "name": "Asset Inventories", "description": "Mechanisms exist to perform inventories of Technology Assets, Applications, Services and/or Data (TAASD) that:\n(1) Accurately reflects the current TAASD in use; \n(2) Identifies authorized software products, including business justification details;\n(3) Is at the level of granularity deemed necessary for tracking and reporting;\n(4) Includes organization-defined information deemed necessary to achieve effective property accountability; and\n(5) Is available for review and audit by designated organizational personnel.", "justification": "Asset Inventories (AST-04) provides asset and inventory visibility that compensates for the absence of Post-Quantum Cryptography (PQC) Discovery & Visibility (QTS-07) by providing the foundational asset knowledge needed to manage risks associated with the primary control. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "VPM-12", "name": "Vulnerability Scanning", "description": "Mechanisms exist to detect vulnerabilities and configuration errors by routine vulnerability scanning of systems and applications.", "justification": "Vulnerability Scanning (VPM-12) provides vulnerability management that compensates for the absence of Post-Quantum Cryptography (PQC) Discovery & Visibility (QTS-07) by reducing the exploitable attack surface by addressing known weaknesses and prioritizing critical remediations. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "QTS-07.1", "risk_if_not_implemented": "Without Post-Quantum Cryptography (PQC) Asset Inventory, sensitive data with long confidentiality lifetimes remains protected only by quantum-vulnerable cryptography, exposing it to future decryption. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss of Authorization / Certification / License (R-EX-11), Unaddressed Security / Compliance Exposure (R-GV-2), Inability to Demonstrate Due Diligence / Due Care (R-GV-9), and most likely increases susceptibility to Human Error (MT-9), Data Quality Degradation / Data Poisoning (MT-12), Cryptographic Compromise / Cryptanalytic Capability Advancement (MT-31).", "compensating_control_1": { "control_id": "AST-04", "name": "Asset Inventories", "description": "Mechanisms exist to perform inventories of Technology Assets, Applications, Services and/or Data (TAASD) that:\n(1) Accurately reflects the current TAASD in use; \n(2) Identifies authorized software products, including business justification details;\n(3) Is at the level of granularity deemed necessary for tracking and reporting;\n(4) Includes organization-defined information deemed necessary to achieve effective property accountability; and\n(5) Is available for review and audit by designated organizational personnel.", "justification": "Asset Inventories (AST-04) provides asset and inventory visibility that compensates for the absence of Post-Quantum Cryptography (PQC) Asset Inventory (QTS-07.1) by providing the foundational asset knowledge needed to manage risks associated with the primary control. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CRY-10", "name": "Cryptographic Key Management", "description": "Mechanisms exist to facilitate cryptographic key management controls to protect the confidentiality, integrity and availability of keys.", "justification": "Cryptographic Key Management (CRY-10) provides cryptographic protection and key governance that compensates for the absence of Post-Quantum Cryptography (PQC) Asset Inventory (QTS-07.1) by ensuring data confidentiality and integrity through alternative or complementary cryptographic mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "QTS-07.2", "risk_if_not_implemented": "Without Post-Quantum Cryptography Exposure, sensitive data with long confidentiality lifetimes remains protected only by quantum-vulnerable cryptography, exposing it to future decryption. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unaddressed Security / Compliance Exposure (R-GV-2), Inability to Demonstrate Due Diligence / Due Care (R-GV-9), Long-Term Confidentiality Loss from Cryptographic Obsolescence (R-IP-1), and most likely increases susceptibility to Human Error (MT-9), Data Quality Degradation / Data Poisoning (MT-12), Harvest Now / Decrypt Later (HNDL) (MT-28), Cryptographic Compromise / Cryptanalytic Capability Advancement (MT-31).", "compensating_control_1": { "control_id": "VPM-05", "name": "Vulnerability Ranking", "description": "Mechanisms exist to identify and assign a risk ranking to newly discovered security vulnerabilities using reputable outside sources for security vulnerability information.", "justification": "Vulnerability Ranking (VPM-05) provides vulnerability management that compensates for the absence of Post-Quantum Cryptography Exposure (QTS-07.2) by reducing the exploitable attack surface by addressing known weaknesses and prioritizing critical remediations. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "RSK-07", "name": "Risk-Based Security Categorization", "description": "Mechanisms exist to categorize Technology Assets, Applications, Services and/or Data (TAASD) in accordance with applicable laws, regulations and contractual obligations that:\n(1) Document the security categorization results (including supporting rationale) in the security plan for systems; and\n(2) Ensure the security categorization decision is reviewed and approved by the asset owner.", "justification": "Risk-Based Security Categorization (RSK-07) provides risk identification and prioritization that compensates for the absence of Post-Quantum Cryptography Exposure (QTS-07.2) by enabling informed decisions about where to focus resources to manage residual exposure. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "QTS-08", "risk_if_not_implemented": "Without Quantum Threat Intelligence Monitoring, sensitive data with long confidentiality lifetimes remains protected only by quantum-vulnerable cryptography, exposing it to future decryption. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Undetected / Delayed Detection of Adverse Activity (R-SA-1), and most likely increases susceptibility to Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11), Cryptographic Compromise / Cryptanalytic Capability Advancement (MT-31).", "compensating_control_1": { "control_id": "THR-02", "name": "Threat Intelligence Program", "description": "Mechanisms exist to implement a threat intelligence program that includes a cross-organization information-sharing capability that can influence the development of the system and security architectures, selection of security solutions, monitoring, threat hunting, response and recovery activities.", "justification": "Threat Intelligence Program (THR-02) provides policy-level governance that compensates for the absence of Quantum Threat Intelligence Monitoring (QTS-08) by establishing documented expectations, accountability structures, and organizational guardrails. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "THR-04", "name": "Threat Intelligence Feeds", "description": "Mechanisms exist to maintain situational awareness of vulnerabilities and evolving threats by leveraging the knowledge of attacker tactics, techniques and procedures to facilitate the implementation of preventative and compensating controls.", "justification": "Threat Intelligence Feeds (THR-04) provides threat intelligence and situational awareness that compensates for the absence of Quantum Threat Intelligence Monitoring (QTS-08) by providing early warning of threats and informing proactive security posture adjustments. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "QTS-08.1", "risk_if_not_implemented": "Without Collaboration & Information Sharing, sensitive data with long confidentiality lifetimes remains protected only by quantum-vulnerable cryptography, exposing it to future decryption. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Undetected / Delayed Detection of Adverse Activity (R-SA-1), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Cryptographic Compromise / Cryptanalytic Capability Advancement (MT-31).", "compensating_control_1": { "control_id": "GOV-16", "name": "Contacts With Groups & Associations", "description": "Mechanisms exist to establish contact with selected groups and associations within the security, compliance and resilience communities to: \n(1) Facilitate ongoing cybersecurity and data protection education and training for organizational personnel;\n(2) Maintain currency with recommended cybersecurity and data protection practices, techniques and technologies; and\n(3) Share current cybersecurity and/or data protection-related information including threats, vulnerabilities and incidents.", "justification": "Contacts With Groups & Associations (GOV-16) provides overlapping security capability that compensates for the absence of Collaboration & Information Sharing (QTS-08.1) by addressing related risk objectives through an alternative control mechanism. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "THR-02", "name": "Threat Intelligence Program", "description": "Mechanisms exist to implement a threat intelligence program that includes a cross-organization information-sharing capability that can influence the development of the system and security architectures, selection of security solutions, monitoring, threat hunting, response and recovery activities.", "justification": "Threat Intelligence Program (THR-02) provides policy-level governance that compensates for the absence of Collaboration & Information Sharing (QTS-08.1) by establishing documented expectations, accountability structures, and organizational guardrails. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "QTS-09", "risk_if_not_implemented": "Without Crypto-Agility Architecture, sensitive data with long confidentiality lifetimes remains protected only by quantum-vulnerable cryptography, exposing it to future decryption. Based on the risk and threat mapping for this control, no risk is rated Likely; risks rated Possible include Business / Service Interruption (R-BC-1), Exposure from Unaddressed Vulnerabilities (R-EX-6), Third-Party Dependency Failure (R-SC-6), and most likely increases susceptibility to Human Error (MT-9), Harvest Now / Decrypt Later (HNDL) (MT-28), Cryptographic Compromise / Cryptanalytic Capability Advancement (MT-31).", "compensating_control_1": { "control_id": "SEA-05", "name": "Secure Engineering Principles", "description": "Mechanisms exist to facilitate the implementation of industry-recognized security, compliance and resilience practices in the specification, design, development, implementation and modification of Technology Assets, Applications and/or Services (TAAS).", "justification": "Secure Engineering Principles (SEA-05) provides secure engineering and architectural guidance that compensates for the absence of Crypto-Agility Architecture (QTS-09) by embedding security requirements into design processes as an alternative control mechanism. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CRY-10", "name": "Cryptographic Key Management", "description": "Mechanisms exist to facilitate cryptographic key management controls to protect the confidentiality, integrity and availability of keys.", "justification": "Cryptographic Key Management (CRY-10) provides cryptographic protection and key governance that compensates for the absence of Crypto-Agility Architecture (QTS-09) by ensuring data confidentiality and integrity through alternative or complementary cryptographic mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "QTS-09.1", "risk_if_not_implemented": "Without Entropy Source & Random Bit Generation, sensitive data with long confidentiality lifetimes remains protected only by quantum-vulnerable cryptography, exposing it to future decryption. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Long-Term Confidentiality Loss from Cryptographic Obsolescence (R-IP-1), Loss of Confidentiality (R-IP-2), and most likely increases susceptibility to Technical / Mechanical Failure (MT-10), Harvest Now / Decrypt Later (HNDL) (MT-28), Cryptographic Compromise / Cryptanalytic Capability Advancement (MT-31).", "compensating_control_1": { "control_id": "CRY-10", "name": "Cryptographic Key Management", "description": "Mechanisms exist to facilitate cryptographic key management controls to protect the confidentiality, integrity and availability of keys.", "justification": "Cryptographic Key Management (CRY-10) provides cryptographic protection and key governance that compensates for the absence of Entropy Source & Random Bit Generation (QTS-09.1) by ensuring data confidentiality and integrity through alternative or complementary cryptographic mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CFG-04", "name": "Secure Baseline Configurations", "description": "Mechanisms exist to develop, document and maintain secure baseline configurations for Technology Assets, Applications and/or Services (TAAS) that are consistent with industry-accepted hardening standards.", "justification": "Secure Baseline Configurations (CFG-04) provides configuration and supply-chain hardening that compensates for the absence of Entropy Source & Random Bit Generation (QTS-09.1) by enforcing secure settings and trusted software sources to reduce inherent exposure. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "QTS-09.2", "risk_if_not_implemented": "Without Stateful Hash-Based Signatures for Firmware & Code Signing, embedded and IoT technologies may operate with unknown, insecure or unmonitored configurations, creating exploitable footholds. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Modification / Loss of System Integrity (R-AM-2), Long-Term Confidentiality Loss from Cryptographic Obsolescence (R-IP-1), Loss of Authenticity / Provenance (R-IP-5), and most likely increases susceptibility to Human Error (MT-9), Harvest Now / Decrypt Later (HNDL) (MT-28), Cryptographic Compromise / Cryptanalytic Capability Advancement (MT-31).", "compensating_control_1": { "control_id": "CRY-09", "name": "Public Key Infrastructure (PKI)", "description": "Mechanisms exist to securely implement an internal Public Key Infrastructure (PKI) infrastructure or obtain PKI services from a reputable PKI service provider.", "justification": "Public Key Infrastructure (PKI) (CRY-09) provides cryptographic protection and key governance that compensates for the absence of Stateful Hash-Based Signatures for Firmware & Code Signing (QTS-09.2) by ensuring data confidentiality and integrity through alternative or complementary cryptographic mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CFG-08.2", "name": "Integrity Assurance & Enforcement (IAE)", "description": "Automated mechanisms exist to:\n(1) Identify unauthorized deviations from an approved secure baseline configuration; and\n(2) Implement automated resiliency actions to remediate the unauthorized change.", "justification": "Integrity Assurance & Enforcement (IAE) (CFG-08.2) provides configuration and supply-chain hardening that compensates for the absence of Stateful Hash-Based Signatures for Firmware & Code Signing (QTS-09.2) by enforcing secure settings and trusted software sources to reduce inherent exposure. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "QTS-09.3", "risk_if_not_implemented": "Without Approved Post-Quantum Cryptography (PQC) Algorithm Use, sensitive data with long confidentiality lifetimes remains protected only by quantum-vulnerable cryptography, exposing it to future decryption. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unaddressed Security / Compliance Exposure (R-GV-2), Long-Term Confidentiality Loss from Cryptographic Obsolescence (R-IP-1), and most likely increases susceptibility to Statutory / Regulatory / Contractual Change (MT-11), Harvest Now / Decrypt Later (HNDL) (MT-28), Cryptographic Compromise / Cryptanalytic Capability Advancement (MT-31).", "compensating_control_1": { "control_id": "CRY-02", "name": "Use of Cryptographic Controls", "description": "Mechanisms exist to facilitate the implementation of cryptographic protections controls using known public standards and trusted cryptographic technologies.", "justification": "Use of Cryptographic Controls (CRY-02) provides cryptographic protection and key governance that compensates for the absence of Approved Post-Quantum Cryptography (PQC) Algorithm Use (QTS-09.3) by ensuring data confidentiality and integrity through alternative or complementary cryptographic mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CFG-04", "name": "Secure Baseline Configurations", "description": "Mechanisms exist to develop, document and maintain secure baseline configurations for Technology Assets, Applications and/or Services (TAAS) that are consistent with industry-accepted hardening standards.", "justification": "Secure Baseline Configurations (CFG-04) provides configuration and supply-chain hardening that compensates for the absence of Approved Post-Quantum Cryptography (PQC) Algorithm Use (QTS-09.3) by enforcing secure settings and trusted software sources to reduce inherent exposure. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "QTS-09.4", "risk_if_not_implemented": "Without Post-Quantum Cryptography (PQC) Validation Requirements, sensitive data with long confidentiality lifetimes remains protected only by quantum-vulnerable cryptography, exposing it to future decryption. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Long-Term Confidentiality Loss from Cryptographic Obsolescence (R-IP-1), and most likely increases susceptibility to Harvest Now / Decrypt Later (HNDL) (MT-28), Cryptographic Compromise / Cryptanalytic Capability Advancement (MT-31).", "compensating_control_1": { "control_id": "CRY-02", "name": "Use of Cryptographic Controls", "description": "Mechanisms exist to facilitate the implementation of cryptographic protections controls using known public standards and trusted cryptographic technologies.", "justification": "Use of Cryptographic Controls (CRY-02) provides cryptographic protection and key governance that compensates for the absence of Post-Quantum Cryptography (PQC) Validation Requirements (QTS-09.4) by ensuring data confidentiality and integrity through alternative or complementary cryptographic mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "IAO-11", "name": "Technical Verification", "description": "Mechanisms exist to perform Control Validation Testing (CVT) activities to evaluate the design, implementation and effectiveness of technical security, compliance and resilience controls.", "justification": "Technical Verification (IAO-11) provides periodic assessment and verification that compensates for the absence of Post-Quantum Cryptography (PQC) Validation Requirements (QTS-09.4) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "QTS-09.5", "risk_if_not_implemented": "Without Deprecated Cryptographic Algorithms, data in transit and at rest may be exposed through weak, misconfigured or compromised cryptographic protections. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Exposure from Unaddressed Vulnerabilities (R-EX-6), Long-Term Confidentiality Loss from Cryptographic Obsolescence (R-IP-1), Loss of Confidentiality (R-IP-2), and most likely increases susceptibility to Harvest Now / Decrypt Later (HNDL) (MT-28), Cryptographic Compromise / Cryptanalytic Capability Advancement (MT-31).", "compensating_control_1": { "control_id": "CRY-02", "name": "Use of Cryptographic Controls", "description": "Mechanisms exist to facilitate the implementation of cryptographic protections controls using known public standards and trusted cryptographic technologies.", "justification": "Use of Cryptographic Controls (CRY-02) provides cryptographic protection and key governance that compensates for the absence of Deprecated Cryptographic Algorithms (QTS-09.5) by ensuring data confidentiality and integrity through alternative or complementary cryptographic mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "VPM-12", "name": "Vulnerability Scanning", "description": "Mechanisms exist to detect vulnerabilities and configuration errors by routine vulnerability scanning of systems and applications.", "justification": "Vulnerability Scanning (VPM-12) provides vulnerability management that compensates for the absence of Deprecated Cryptographic Algorithms (QTS-09.5) by reducing the exploitable attack surface by addressing known weaknesses and prioritizing critical remediations. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "QTS-09.6", "risk_if_not_implemented": "Without Post-Quantum Cryptography (PQC) Key Management, sensitive data with long confidentiality lifetimes remains protected only by quantum-vulnerable cryptography, exposing it to future decryption. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Long-Term Confidentiality Loss from Cryptographic Obsolescence (R-IP-1), Loss of Confidentiality (R-IP-2), and most likely increases susceptibility to Harvest Now / Decrypt Later (HNDL) (MT-28), Cryptographic Compromise / Cryptanalytic Capability Advancement (MT-31).", "compensating_control_1": { "control_id": "CRY-10", "name": "Cryptographic Key Management", "description": "Mechanisms exist to facilitate cryptographic key management controls to protect the confidentiality, integrity and availability of keys.", "justification": "Cryptographic Key Management (CRY-10) provides cryptographic protection and key governance that compensates for the absence of Post-Quantum Cryptography (PQC) Key Management (QTS-09.6) by ensuring data confidentiality and integrity through alternative or complementary cryptographic mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CRY-13", "name": "Certificate Monitoring", "description": "Automated mechanisms exist to discover when new certificates are issued for organization-controlled domains.", "justification": "Certificate Monitoring (CRY-13) provides detective monitoring capability that compensates for the absence of Post-Quantum Cryptography (PQC) Key Management (QTS-09.6) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "QTS-09.7", "risk_if_not_implemented": "Without Quantum-Safe Public Key Infrastructure (PKI) Transition, sensitive data with long confidentiality lifetimes remains protected only by quantum-vulnerable cryptography, exposing it to future decryption. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Long-Term Confidentiality Loss from Cryptographic Obsolescence (R-IP-1), and most likely increases susceptibility to Harvest Now / Decrypt Later (HNDL) (MT-28), Cryptographic Compromise / Cryptanalytic Capability Advancement (MT-31).", "compensating_control_1": { "control_id": "CRY-09", "name": "Public Key Infrastructure (PKI)", "description": "Mechanisms exist to securely implement an internal Public Key Infrastructure (PKI) infrastructure or obtain PKI services from a reputable PKI service provider.", "justification": "Public Key Infrastructure (PKI) (CRY-09) provides cryptographic protection and key governance that compensates for the absence of Quantum-Safe Public Key Infrastructure (PKI) Transition (QTS-09.7) by ensuring data confidentiality and integrity through alternative or complementary cryptographic mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CRY-10", "name": "Cryptographic Key Management", "description": "Mechanisms exist to facilitate cryptographic key management controls to protect the confidentiality, integrity and availability of keys.", "justification": "Cryptographic Key Management (CRY-10) provides cryptographic protection and key governance that compensates for the absence of Quantum-Safe Public Key Infrastructure (PKI) Transition (QTS-09.7) by ensuring data confidentiality and integrity through alternative or complementary cryptographic mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "QTS-09.8", "risk_if_not_implemented": "Without Algorithm Negotiation Integrity, sensitive data with long confidentiality lifetimes remains protected only by quantum-vulnerable cryptography, exposing it to future decryption. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Exposure from Unaddressed Vulnerabilities (R-EX-6), Undetected / Delayed Detection of Adverse Activity (R-SA-1), Long-Term Confidentiality Loss from Cryptographic Obsolescence (R-IP-1), Loss of Confidentiality (R-IP-2), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Harvest Now / Decrypt Later (HNDL) (MT-28), Cryptographic Compromise / Cryptanalytic Capability Advancement (MT-31).", "compensating_control_1": { "control_id": "NET-29", "name": "Session Integrity", "description": "Mechanisms exist to protect the authenticity and integrity of communications sessions.", "justification": "Session Integrity (NET-29) provides overlapping security capability that compensates for the absence of Algorithm Negotiation Integrity (QTS-09.8) by addressing related risk objectives through an alternative control mechanism. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CRY-05", "name": "Encrypting Data In Transit", "description": "Cryptographic mechanisms exist to prevent the unauthorized disclosure of data in transit.", "justification": "Encrypting Data In Transit (CRY-05) provides overlapping security capability that compensates for the absence of Algorithm Negotiation Integrity (QTS-09.8) by addressing related risk objectives through an alternative control mechanism. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "QTS-09.9", "risk_if_not_implemented": "Without Hybrid / Composite Cryptography, data in transit and at rest may be exposed through weak, misconfigured or compromised cryptographic protections. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Long-Term Confidentiality Loss from Cryptographic Obsolescence (R-IP-1), and most likely increases susceptibility to Harvest Now / Decrypt Later (HNDL) (MT-28), Cryptographic Compromise / Cryptanalytic Capability Advancement (MT-31).", "compensating_control_1": { "control_id": "CRY-02", "name": "Use of Cryptographic Controls", "description": "Mechanisms exist to facilitate the implementation of cryptographic protections controls using known public standards and trusted cryptographic technologies.", "justification": "Use of Cryptographic Controls (CRY-02) provides cryptographic protection and key governance that compensates for the absence of Hybrid / Composite Cryptography (QTS-09.9) by ensuring data confidentiality and integrity through alternative or complementary cryptographic mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CRY-10", "name": "Cryptographic Key Management", "description": "Mechanisms exist to facilitate cryptographic key management controls to protect the confidentiality, integrity and availability of keys.", "justification": "Cryptographic Key Management (CRY-10) provides cryptographic protection and key governance that compensates for the absence of Hybrid / Composite Cryptography (QTS-09.9) by ensuring data confidentiality and integrity through alternative or complementary cryptographic mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "QTS-09.10", "risk_if_not_implemented": "Without Cryptographic Application Programming Interface (API) Abstraction, data in transit and at rest may be exposed through weak, misconfigured or compromised cryptographic protections. Based on the risk and threat mapping for this control, no risk is rated Likely; risks rated Possible include Reduced Operational Productivity (R-BC-3), Exposure from Unaddressed Vulnerabilities (R-EX-6), Concentration / Single-Point Dependency Failure (R-OR-2), and most likely increases susceptibility to Harvest Now / Decrypt Later (HNDL) (MT-28), Cryptographic Compromise / Cryptanalytic Capability Advancement (MT-31).", "compensating_control_1": { "control_id": "SEA-05", "name": "Secure Engineering Principles", "description": "Mechanisms exist to facilitate the implementation of industry-recognized security, compliance and resilience practices in the specification, design, development, implementation and modification of Technology Assets, Applications and/or Services (TAAS).", "justification": "Secure Engineering Principles (SEA-05) provides secure engineering and architectural guidance that compensates for the absence of Cryptographic Application Programming Interface (API) Abstraction (QTS-09.10) by embedding security requirements into design processes as an alternative control mechanism. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "TDA-05", "name": "Secure Software Development Practices (SSDP)", "description": "Mechanisms exist to develop applications based on Secure Software Development Practices (SSDP).", "justification": "Secure Software Development Practices (SSDP) (TDA-05) provides overlapping security capability that compensates for the absence of Cryptographic Application Programming Interface (API) Abstraction (QTS-09.10) by addressing related risk objectives through an alternative control mechanism. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "QTS-10", "risk_if_not_implemented": "Without Post-Quantum Cryptography (PQC) Implementation Validation & Interoperability Testing, sensitive data with long confidentiality lifetimes remains protected only by quantum-vulnerable cryptography, exposing it to future decryption. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Inability to Demonstrate Due Diligence / Due Care (R-GV-9), and most likely increases susceptibility to Human Error (MT-9).", "compensating_control_1": { "control_id": "TDA-17", "name": "Security, Compliance & Resilience Testing Throughout Development", "description": "Mechanisms exist to require system developers/integrators consult with security, compliance and/or resilience personnel to: \n(1) Create and implement a Security Testing and Evaluation (ST&E) plan, or similar capability;\n(2) Implement a verifiable flaw remediation process to correct weaknesses and deficiencies identified during the control testing and evaluation process; and\n(3) Document the results.", "justification": "Security, Compliance & Resilience Testing Throughout Development (TDA-17) provides periodic assessment and verification that compensates for the absence of PQC Implementation Validation & Interoperability Testing (QTS-10) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "IAO-11", "name": "Technical Verification", "description": "Mechanisms exist to perform Control Validation Testing (CVT) activities to evaluate the design, implementation and effectiveness of technical security, compliance and resilience controls.", "justification": "Technical Verification (IAO-11) provides periodic assessment and verification that compensates for the absence of PQC Implementation Validation & Interoperability Testing (QTS-10) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "RSK-03", "risk_if_not_implemented": "Without Risk Management Resourcing, risks may remain unidentified, unowned or unmanaged, leaving decision-makers without a defensible basis for prioritization and treatment. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Uncontrolled Internal Security / Privacy Exposure (R-GV-4), Loss of Critical Knowledge / Capability (R-PE-1), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Economic Shock / Market Disruption (MT-16), Workforce Shortage / Loss of Critical Skills / Labor Disruption (MT-25).", "compensating_control_1": { "control_id": "CPL-02", "name": "Statutory, Regulatory & Contractual Compliance", "description": "Mechanisms exist to facilitate the identification and implementation of relevant statutory, regulatory and contractual controls.", "justification": "Statutory, Regulatory & Contractual Compliance (CPL-02) provides overlapping security capability that compensates for the absence of Risk Management Resourcing (RSK-03) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "RSK-02", "name": "Risk Management Program", "description": "Mechanisms exist to facilitate the implementation of strategic, operational and tactical risk management controls that are aligned with:\n(1) The organization's Enterprise Risk Management (ERM); and\n(2) Industry-recognized cybersecurity risk management practices.", "justification": "Risk Management Program (RSK-02) provides policy-level governance that compensates for the absence of Risk Management Resourcing (RSK-03) by establishing documented expectations, accountability structures, and organizational guardrails. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "RSK-04", "risk_if_not_implemented": "Without Risk Culture, risks may remain unidentified, unowned or unmanaged, leaving decision-makers without a defensible basis for prioritization and treatment. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unperformed / Unowned Control Responsibilities (R-GV-3), Unreliable Assurance / Decision Information (R-GV-10), Lack of a security-minded workforce (R-SA-2), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9).", "compensating_control_1": { "control_id": "SAT-04", "name": "Security, Compliance & Resilience Awareness Training", "description": "Mechanisms exist to provide all employees and contractors appropriate security, compliance and resilience awareness education and training that is relevant for their job function.", "justification": "Security, Compliance & Resilience Awareness Training (SAT-04) provides personnel training and awareness that compensates for the absence of Risk Culture (RSK-04) by reducing human-factor risk by equipping personnel to recognize and respond to relevant threats. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "GOV-02", "name": "Security, Compliance & Resilience Program (SCRP)", "description": "Mechanisms exist to facilitate the design, implementation, and monitoring of security, compliance and resilience governance controls.", "justification": "Security, Compliance & Resilience Program (SCRP) (GOV-02) provides resilience and recovery capability that compensates for the absence of Risk Culture (RSK-04) by ensuring the organization can restore operations and data when the primary control is absent. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "RSK-05", "risk_if_not_implemented": "Without Risk Framing, risks may remain unidentified, unowned or unmanaged, leaving decision-makers without a defensible basis for prioritization and treatment. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unaddressed Security / Compliance Exposure (R-GV-2), Unreliable Assurance / Decision Information (R-GV-10), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11).", "compensating_control_1": { "control_id": "GOV-02", "name": "Security, Compliance & Resilience Program (SCRP)", "description": "Mechanisms exist to facilitate the design, implementation, and monitoring of security, compliance and resilience governance controls.", "justification": "Security, Compliance & Resilience Program (SCRP) (GOV-02) provides resilience and recovery capability that compensates for the absence of Risk Framing (RSK-05) by ensuring the organization can restore operations and data when the primary control is absent. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CPL-02", "name": "Statutory, Regulatory & Contractual Compliance", "description": "Mechanisms exist to facilitate the identification and implementation of relevant statutory, regulatory and contractual controls.", "justification": "Statutory, Regulatory & Contractual Compliance (CPL-02) provides overlapping security capability that compensates for the absence of Risk Framing (RSK-05) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "RSK-05.1", "risk_if_not_implemented": "Without Risk Tolerance, risks may remain unidentified, unowned or unmanaged, leaving decision-makers without a defensible basis for prioritization and treatment. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unreliable Assurance / Decision Information (R-GV-10), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9).", "compensating_control_1": { "control_id": "RSK-02", "name": "Risk Management Program", "description": "Mechanisms exist to facilitate the implementation of strategic, operational and tactical risk management controls that are aligned with:\n(1) The organization's Enterprise Risk Management (ERM); and\n(2) Industry-recognized cybersecurity risk management practices.", "justification": "Risk Management Program (RSK-02) provides policy-level governance that compensates for the absence of Risk Tolerance (RSK-05.1) by establishing documented expectations, accountability structures, and organizational guardrails. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "GOV-02", "name": "Security, Compliance & Resilience Program (SCRP)", "description": "Mechanisms exist to facilitate the design, implementation, and monitoring of security, compliance and resilience governance controls.", "justification": "Security, Compliance & Resilience Program (SCRP) (GOV-02) provides resilience and recovery capability that compensates for the absence of Risk Tolerance (RSK-05.1) by ensuring the organization can restore operations and data when the primary control is absent. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "RSK-05.2", "risk_if_not_implemented": "Without Risk Threshold, risks may remain unidentified, unowned or unmanaged, leaving decision-makers without a defensible basis for prioritization and treatment. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unaddressed Security / Compliance Exposure (R-GV-2), Unreliable Assurance / Decision Information (R-GV-10), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9).", "compensating_control_1": { "control_id": "GOV-02", "name": "Security, Compliance & Resilience Program (SCRP)", "description": "Mechanisms exist to facilitate the design, implementation, and monitoring of security, compliance and resilience governance controls.", "justification": "Security, Compliance & Resilience Program (SCRP) (GOV-02) provides resilience and recovery capability that compensates for the absence of Risk Threshold (RSK-05.2) by ensuring the organization can restore operations and data when the primary control is absent. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "RSK-02", "name": "Risk Management Program", "description": "Mechanisms exist to facilitate the implementation of strategic, operational and tactical risk management controls that are aligned with:\n(1) The organization's Enterprise Risk Management (ERM); and\n(2) Industry-recognized cybersecurity risk management practices.", "justification": "Risk Management Program (RSK-02) provides policy-level governance that compensates for the absence of Risk Threshold (RSK-05.2) by establishing documented expectations, accountability structures, and organizational guardrails. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "RSK-05.3", "risk_if_not_implemented": "Without Risk Appetite, risks may remain unidentified, unowned or unmanaged, leaving decision-makers without a defensible basis for prioritization and treatment. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unreliable Assurance / Decision Information (R-GV-10), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9).", "compensating_control_1": { "control_id": "CPL-02", "name": "Statutory, Regulatory & Contractual Compliance", "description": "Mechanisms exist to facilitate the identification and implementation of relevant statutory, regulatory and contractual controls.", "justification": "Statutory, Regulatory & Contractual Compliance (CPL-02) provides overlapping security capability that compensates for the absence of Risk Appetite (RSK-05.3) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "GOV-02", "name": "Security, Compliance & Resilience Program (SCRP)", "description": "Mechanisms exist to facilitate the design, implementation, and monitoring of security, compliance and resilience governance controls.", "justification": "Security, Compliance & Resilience Program (SCRP) (GOV-02) provides resilience and recovery capability that compensates for the absence of Risk Appetite (RSK-05.3) by ensuring the organization can restore operations and data when the primary control is absent. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "RSK-06", "risk_if_not_implemented": "Without Material Risks, risks may remain unidentified, unowned or unmanaged, leaving decision-makers without a defensible basis for prioritization and treatment. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unreliable Assurance / Decision Information (R-GV-10), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9).", "compensating_control_1": { "control_id": "RSK-13", "name": "Risk Assessment", "description": "Mechanisms exist to conduct recurring assessments of risk that includes the likelihood and magnitude of harm, from unauthorized access, use, disclosure, disruption, modification or destruction of the organization's Technology Assets, Applications, Services and/or Data (TAASD).", "justification": "Risk Assessment (RSK-13) provides periodic assessment and assurance that compensates for the absence of Material Risks (RSK-06) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "MON-06", "name": "Monitoring Reporting", "description": "Mechanisms exist to provide an event log report generation capability to aid in detecting and assessing anomalous activities.", "justification": "Monitoring Reporting (MON-06) provides detective monitoring capability that compensates for the absence of Material Risks (RSK-06) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "RSK-06.1", "risk_if_not_implemented": "Without Executive Leadership Approval For Managing Material Risk, risks may remain unidentified, unowned or unmanaged, leaving decision-makers without a defensible basis for prioritization and treatment. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unperformed / Unowned Control Responsibilities (R-GV-3), Inability to Demonstrate Due Diligence / Due Care (R-GV-9), Unreliable Assurance / Decision Information (R-GV-10), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Conflict of Interest (COI) / Undue Influence / Insider Misconduct (MT-15).", "compensating_control_1": { "control_id": "CPL-07", "name": "Executive Leadership Oversight of Security, Compliance & Resilience Controls", "description": "Mechanisms exist to provide a security, compliance and resilience controls oversight function that reports to the organization's executive leadership.", "justification": "Executive Leadership Oversight of Security, Compliance & Resilience Controls (CPL-07) provides resilience and recovery capability that compensates for the absence of Executive Leadership Approval For Managing Material Risk (RSK-06.1) by ensuring the organization can restore operations and data when the primary control is absent. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "RSK-22", "name": "Risk Monitoring", "description": "Mechanisms exist to monitor risk as an integral part of the continuous monitoring strategy, including: \n(1) The effectiveness of security, compliance and resilience controls; \n(2) Changes to the organization's risk profile; and \n(3) Changes to Technology Assets, Applications and/or Services (TAAS) that affect risk.", "justification": "Risk Monitoring (RSK-22) provides detective monitoring capability that compensates for the absence of Executive Leadership Approval For Managing Material Risk (RSK-06.1) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "RSK-06.2", "risk_if_not_implemented": "Without Documented Justification For Material Risk Management Decisions, risks may remain unidentified, unowned or unmanaged, leaving decision-makers without a defensible basis for prioritization and treatment. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Inability to Demonstrate Due Diligence / Due Care (R-GV-9), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9).", "compensating_control_1": { "control_id": "CPL-07", "name": "Executive Leadership Oversight of Security, Compliance & Resilience Controls", "description": "Mechanisms exist to provide a security, compliance and resilience controls oversight function that reports to the organization's executive leadership.", "justification": "Executive Leadership Oversight of Security, Compliance & Resilience Controls (CPL-07) provides resilience and recovery capability that compensates for the absence of Documented Justification For Material Risk Management Decisions (RSK-06.2) by ensuring the organization can restore operations and data when the primary control is absent. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "RSK-06.1", "name": "Executive Leadership Approval For Managing Material Risk", "description": "Mechanisms exist to obtain executive leadership approval for risk management decisions involving material risk.", "justification": "Executive Leadership Approval For Managing Material Risk (RSK-06.1) provides risk identification and prioritization that compensates for the absence of Documented Justification For Material Risk Management Decisions (RSK-06.2) by enabling informed decisions about where to focus resources to manage residual exposure. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "RSK-07", "risk_if_not_implemented": "Without Risk-Based Security Categorization, risks may remain unidentified, unowned or unmanaged, leaving decision-makers without a defensible basis for prioritization and treatment. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unaddressed Security / Compliance Exposure (R-GV-2), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11).", "compensating_control_1": { "control_id": "RSK-13", "name": "Risk Assessment", "description": "Mechanisms exist to conduct recurring assessments of risk that includes the likelihood and magnitude of harm, from unauthorized access, use, disclosure, disruption, modification or destruction of the organization's Technology Assets, Applications, Services and/or Data (TAASD).", "justification": "Risk Assessment (RSK-13) provides periodic assessment and assurance that compensates for the absence of Risk-Based Security Categorization (RSK-07) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "DCH-04", "name": "Data & Asset Classification", "description": "Mechanisms exist to ensure data and assets are categorized in accordance with applicable statutory, regulatory and contractual requirements.", "justification": "Data & Asset Classification (DCH-04) provides overlapping security capability that compensates for the absence of Risk-Based Security Categorization (RSK-07) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "RSK-07.1", "risk_if_not_implemented": "Without Impact-Level Prioritization, risks may remain unidentified, unowned or unmanaged, leaving decision-makers without a defensible basis for prioritization and treatment. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unaddressed Security / Compliance Exposure (R-GV-2), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9).", "compensating_control_1": { "control_id": "DCH-04", "name": "Data & Asset Classification", "description": "Mechanisms exist to ensure data and assets are categorized in accordance with applicable statutory, regulatory and contractual requirements.", "justification": "Data & Asset Classification (DCH-04) provides overlapping security capability that compensates for the absence of Impact-Level Prioritization (RSK-07.1) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "RSK-13", "name": "Risk Assessment", "description": "Mechanisms exist to conduct recurring assessments of risk that includes the likelihood and magnitude of harm, from unauthorized access, use, disclosure, disruption, modification or destruction of the organization's Technology Assets, Applications, Services and/or Data (TAASD).", "justification": "Risk Assessment (RSK-13) provides periodic assessment and assurance that compensates for the absence of Impact-Level Prioritization (RSK-07.1) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "RSK-08", "risk_if_not_implemented": "Without Business Impact Analysis (BIA), risks may remain unidentified, unowned or unmanaged, leaving decision-makers without a defensible basis for prioritization and treatment. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unaddressed Security / Compliance Exposure (R-GV-2), Inability to Demonstrate Due Diligence / Due Care (R-GV-9), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11).", "compensating_control_1": { "control_id": "BCD-02", "name": "Business Continuity Management System (BCMS)", "description": "Mechanisms exist to operate a Business Continuity Management System (BCMS) to achieve resilient Technology Assets, Applications, Services and/or Data (TAASD) during:\n(1) Routine operations; and\n(2) Adverse conditions.", "justification": "Business Continuity Management System (BCMS) (BCD-02) provides resilience and recovery capability that compensates for the absence of Business Impact Analysis (BIA) (RSK-08) by ensuring the organization can restore operations and data when the primary control is absent. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "RSK-13", "name": "Risk Assessment", "description": "Mechanisms exist to conduct recurring assessments of risk that includes the likelihood and magnitude of harm, from unauthorized access, use, disclosure, disruption, modification or destruction of the organization's Technology Assets, Applications, Services and/or Data (TAASD).", "justification": "Risk Assessment (RSK-13) provides periodic assessment and assurance that compensates for the absence of Business Impact Analysis (BIA) (RSK-08) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "RSK-09", "risk_if_not_implemented": "Without Risk Identification, risks may remain unidentified, unowned or unmanaged, leaving decision-makers without a defensible basis for prioritization and treatment. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unaddressed Security / Compliance Exposure (R-GV-2), Inability to Demonstrate Due Diligence / Due Care (R-GV-9), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11).", "compensating_control_1": { "control_id": "THR-02", "name": "Threat Intelligence Program", "description": "Mechanisms exist to implement a threat intelligence program that includes a cross-organization information-sharing capability that can influence the development of the system and security architectures, selection of security solutions, monitoring, threat hunting, response and recovery activities.", "justification": "Threat Intelligence Program (THR-02) provides policy-level governance that compensates for the absence of Risk Identification (RSK-09) by establishing documented expectations, accountability structures, and organizational guardrails. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "AST-04", "name": "Asset Inventories", "description": "Mechanisms exist to perform inventories of Technology Assets, Applications, Services and/or Data (TAASD) that:\n(1) Accurately reflects the current TAASD in use; \n(2) Identifies authorized software products, including business justification details;\n(3) Is at the level of granularity deemed necessary for tracking and reporting;\n(4) Includes organization-defined information deemed necessary to achieve effective property accountability; and\n(5) Is available for review and audit by designated organizational personnel.", "justification": "Asset Inventories (AST-04) provides overlapping security capability that compensates for the absence of Risk Identification (RSK-09) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "RSK-10", "risk_if_not_implemented": "Without Risk Catalog, risks may remain unidentified, unowned or unmanaged, leaving decision-makers without a defensible basis for prioritization and treatment. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unaddressed Security / Compliance Exposure (R-GV-2), Inability to Demonstrate Due Diligence / Due Care (R-GV-9), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11).", "compensating_control_1": { "control_id": "AST-04", "name": "Asset Inventories", "description": "Mechanisms exist to perform inventories of Technology Assets, Applications, Services and/or Data (TAASD) that:\n(1) Accurately reflects the current TAASD in use; \n(2) Identifies authorized software products, including business justification details;\n(3) Is at the level of granularity deemed necessary for tracking and reporting;\n(4) Includes organization-defined information deemed necessary to achieve effective property accountability; and\n(5) Is available for review and audit by designated organizational personnel.", "justification": "Asset Inventories (AST-04) provides overlapping security capability that compensates for the absence of Risk Catalog (RSK-10) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "THR-02", "name": "Threat Intelligence Program", "description": "Mechanisms exist to implement a threat intelligence program that includes a cross-organization information-sharing capability that can influence the development of the system and security architectures, selection of security solutions, monitoring, threat hunting, response and recovery activities.", "justification": "Threat Intelligence Program (THR-02) provides policy-level governance that compensates for the absence of Risk Catalog (RSK-10) by establishing documented expectations, accountability structures, and organizational guardrails. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "RSK-11", "risk_if_not_implemented": "Without Risk Owner, risks may remain unidentified, unowned or unmanaged, leaving decision-makers without a defensible basis for prioritization and treatment. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unaddressed Security / Compliance Exposure (R-GV-2), Unperformed / Unowned Control Responsibilities (R-GV-3), Inability to Demonstrate Due Diligence / Due Care (R-GV-9), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9).", "compensating_control_1": { "control_id": "GOV-05", "name": "Assigned Security, Compliance & Resilience Responsibilities", "description": "Mechanisms exist to assign one or more qualified individuals with the mission and resources to centrally-manage, coordinate, develop, implement and maintain an enterprise-wide Security, Compliance & Resilience Program (SCRP).", "justification": "Assigned Security, Compliance & Resilience Responsibilities (GOV-05) provides resilience and recovery capability that compensates for the absence of Risk Owner (RSK-11) by ensuring the organization can restore operations when the primary control is absent. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "RSK-17", "name": "Risk Remediation", "description": "Mechanisms exist to remediate risks to an acceptable level.", "justification": "Risk Remediation (RSK-17) provides vulnerability management that compensates for the absence of Risk Owner (RSK-11) by reducing the exploitable attack surface by addressing known weaknesses and prioritizing critical remediations. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "RSK-12", "risk_if_not_implemented": "Without Risk Assessment Methodology, risks may remain unidentified, unowned or unmanaged, leaving decision-makers without a defensible basis for prioritization and treatment. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unaddressed Security / Compliance Exposure (R-GV-2), Inability to Demonstrate Due Diligence / Due Care (R-GV-9), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11).", "compensating_control_1": { "control_id": "CPL-05", "name": "Conformity Monitoring", "description": "Mechanisms exist to validate that Technology Assets, Applications, Services and/or Data (TAASD) conform to the organization's security, compliance and/or resilience policies, standards and other applicable requirements.", "justification": "Conformity Monitoring (CPL-05) provides periodic assessment and assurance that compensates for the absence of Risk Assessment Methodology (RSK-12) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "RSK-13", "name": "Risk Assessment", "description": "Mechanisms exist to conduct recurring assessments of risk that includes the likelihood and magnitude of harm, from unauthorized access, use, disclosure, disruption, modification or destruction of the organization's Technology Assets, Applications, Services and/or Data (TAASD).", "justification": "Risk Assessment (RSK-13) provides periodic assessment and assurance that compensates for the absence of Risk Assessment Methodology (RSK-12) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "RSK-13.1", "risk_if_not_implemented": "Without Instances Requiring A Risk Assessment, risks may remain unidentified, unowned or unmanaged, leaving decision-makers without a defensible basis for prioritization and treatment. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unaddressed Security / Compliance Exposure (R-GV-2), Inability to Demonstrate Due Diligence / Due Care (R-GV-9), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11).", "compensating_control_1": { "control_id": "RSK-13", "name": "Risk Assessment", "description": "Mechanisms exist to conduct recurring assessments of risk that includes the likelihood and magnitude of harm, from unauthorized access, use, disclosure, disruption, modification or destruction of the organization's Technology Assets, Applications, Services and/or Data (TAASD).", "justification": "Risk Assessment (RSK-13) provides periodic assessment and assurance that compensates for the absence of Instances Requiring A Risk Assessment (RSK-13.1) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "MON-02", "name": "Continuous Monitoring", "description": "Mechanisms exist to facilitate the implementation of enterprise-wide monitoring controls.", "justification": "Continuous Monitoring (MON-02) provides detective monitoring capability that compensates for the absence of Instances Requiring A Risk Assessment (RSK-13.1) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "RSK-13.2", "risk_if_not_implemented": "Without Risk Assessment Update, risks may remain unidentified, unowned or unmanaged, leaving decision-makers without a defensible basis for prioritization and treatment. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Exposure from Unaddressed Vulnerabilities (R-EX-6), Unaddressed Security / Compliance Exposure (R-GV-2), Inability to Demonstrate Due Diligence / Due Care (R-GV-9), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11), Data Quality Degradation / Data Poisoning (MT-12).", "compensating_control_1": { "control_id": "RSK-13", "name": "Risk Assessment", "description": "Mechanisms exist to conduct recurring assessments of risk that includes the likelihood and magnitude of harm, from unauthorized access, use, disclosure, disruption, modification or destruction of the organization's Technology Assets, Applications, Services and/or Data (TAASD).", "justification": "Risk Assessment (RSK-13) provides periodic assessment and assurance that compensates for the absence of Risk Assessment Update (RSK-13.2) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CPL-05", "name": "Conformity Monitoring", "description": "Mechanisms exist to validate that Technology Assets, Applications, Services and/or Data (TAASD) conform to the organization's security, compliance and/or resilience policies, standards and other applicable requirements.", "justification": "Conformity Monitoring (CPL-05) provides periodic assessment and assurance that compensates for the absence of Risk Assessment Update (RSK-13.2) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "RSK-13.3", "risk_if_not_implemented": "Without Risk Assessment Stakeholder Involvement, risks may remain unidentified, unowned or unmanaged, leaving decision-makers without a defensible basis for prioritization and treatment. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unaddressed Security / Compliance Exposure (R-GV-2), Inability to Demonstrate Due Diligence / Due Care (R-GV-9), Unreliable Assurance / Decision Information (R-GV-10), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9).", "compensating_control_1": { "control_id": "MON-02", "name": "Continuous Monitoring", "description": "Mechanisms exist to facilitate the implementation of enterprise-wide monitoring controls.", "justification": "Continuous Monitoring (MON-02) provides detective monitoring capability that compensates for the absence of Risk Assessment Stakeholder Involvement (RSK-13.3) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "RSK-13", "name": "Risk Assessment", "description": "Mechanisms exist to conduct recurring assessments of risk that includes the likelihood and magnitude of harm, from unauthorized access, use, disclosure, disruption, modification or destruction of the organization's Technology Assets, Applications, Services and/or Data (TAASD).", "justification": "Risk Assessment (RSK-13) provides periodic assessment and assurance that compensates for the absence of Risk Assessment Stakeholder Involvement (RSK-13.3) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "RSK-15", "risk_if_not_implemented": "Without Risk Ranking, risks may remain unidentified, unowned or unmanaged, leaving decision-makers without a defensible basis for prioritization and treatment. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Exposure from Unaddressed Vulnerabilities (R-EX-6), Unaddressed Security / Compliance Exposure (R-GV-2), Inability to Demonstrate Due Diligence / Due Care (R-GV-9), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Data Quality Degradation / Data Poisoning (MT-12).", "compensating_control_1": { "control_id": "RSK-13", "name": "Risk Assessment", "description": "Mechanisms exist to conduct recurring assessments of risk that includes the likelihood and magnitude of harm, from unauthorized access, use, disclosure, disruption, modification or destruction of the organization's Technology Assets, Applications, Services and/or Data (TAASD).", "justification": "Risk Assessment (RSK-13) provides periodic assessment and assurance that compensates for the absence of Risk Ranking (RSK-15) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "MON-06", "name": "Monitoring Reporting", "description": "Mechanisms exist to provide an event log report generation capability to aid in detecting and assessing anomalous activities.", "justification": "Monitoring Reporting (MON-06) provides detective monitoring capability that compensates for the absence of Risk Ranking (RSK-15) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "RSK-16", "risk_if_not_implemented": "Without Risk Response, risks may remain unidentified, unowned or unmanaged, leaving decision-makers without a defensible basis for prioritization and treatment. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unaddressed Security / Compliance Exposure (R-GV-2), Lack of oversight of internal controls (R-GV-6), Inability to Demonstrate Due Diligence / Due Care (R-GV-9), Incident Persistence / Recurrence (R-IR-3), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9).", "compensating_control_1": { "control_id": "CHG-02", "name": "Change Management Program", "description": "Mechanisms exist to facilitate the implementation of a change management program.", "justification": "Change Management Program (CHG-02) provides policy-level governance that compensates for the absence of Risk Response (RSK-16) by establishing documented expectations, accountability structures, and organizational guardrails. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "VPM-06", "name": "Vulnerability Remediation Process", "description": "Mechanisms exist to ensure that vulnerabilities are properly identified, tracked and remediated.", "justification": "Vulnerability Remediation Process (VPM-06) provides vulnerability management that compensates for the absence of Risk Response (RSK-16) by reducing the exploitable attack surface by addressing known weaknesses before they are leveraged. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "RSK-16.1", "risk_if_not_implemented": "Without Risk Treatment Options, risks may remain unidentified, unowned or unmanaged, leaving decision-makers without a defensible basis for prioritization and treatment. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unaddressed Security / Compliance Exposure (R-GV-2), Inability to Demonstrate Due Diligence / Due Care (R-GV-9), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11), Data Quality Degradation / Data Poisoning (MT-12), Conflict of Interest (COI) / Undue Influence / Insider Misconduct (MT-15).", "compensating_control_1": { "control_id": "RSK-17", "name": "Risk Remediation", "description": "Mechanisms exist to remediate risks to an acceptable level.", "justification": "Risk Remediation (RSK-17) provides vulnerability management that compensates for the absence of Risk Treatment Options (RSK-16.1) by reducing the exploitable attack surface by addressing known weaknesses before they are leveraged. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CHG-02", "name": "Change Management Program", "description": "Mechanisms exist to facilitate the implementation of a change management program.", "justification": "Change Management Program (CHG-02) provides policy-level governance that compensates for the absence of Risk Treatment Options (RSK-16.1) by establishing documented expectations, accountability structures, and organizational guardrails. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "RSK-17.1", "risk_if_not_implemented": "Without Risk Treatment Plan (RTP), risks may remain unidentified, unowned or unmanaged, leaving decision-makers without a defensible basis for prioritization and treatment. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unaddressed Security / Compliance Exposure (R-GV-2), Unperformed / Unowned Control Responsibilities (R-GV-3), Inability to Demonstrate Due Diligence / Due Care (R-GV-9), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11), Conflict of Interest (COI) / Undue Influence / Insider Misconduct (MT-15).", "compensating_control_1": { "control_id": "CHG-02", "name": "Change Management Program", "description": "Mechanisms exist to facilitate the implementation of a change management program.", "justification": "Change Management Program (CHG-02) provides policy-level governance that compensates for the absence of Risk Treatment Plan (RTP) (RSK-17.1) by establishing documented expectations, accountability structures, and organizational guardrails. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "RSK-17", "name": "Risk Remediation", "description": "Mechanisms exist to remediate risks to an acceptable level.", "justification": "Risk Remediation (RSK-17) provides vulnerability management that compensates for the absence of Risk Treatment Plan (RTP) (RSK-17.1) by reducing the exploitable attack surface by addressing known weaknesses before they are leveraged. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "RSK-17.2", "risk_if_not_implemented": "Without Documented Alternatives, risks may remain unidentified, unowned or unmanaged, leaving decision-makers without a defensible basis for prioritization and treatment. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Inability to Demonstrate Due Diligence / Due Care (R-GV-9), Unreliable Assurance / Decision Information (R-GV-10), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11), Data Quality Degradation / Data Poisoning (MT-12), Conflict of Interest (COI) / Undue Influence / Insider Misconduct (MT-15).", "compensating_control_1": { "control_id": "RSK-22", "name": "Risk Monitoring", "description": "Mechanisms exist to monitor risk as an integral part of the continuous monitoring strategy, including: \n(1) The effectiveness of security, compliance and resilience controls; \n(2) Changes to the organization's risk profile; and \n(3) Changes to Technology Assets, Applications and/or Services (TAAS) that affect risk.", "justification": "Risk Monitoring (RSK-22) provides detective monitoring capability that compensates for the absence of Documented Alternatives (RSK-17.2) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CPL-07", "name": "Executive Leadership Oversight of Security, Compliance & Resilience Controls", "description": "Mechanisms exist to provide a security, compliance and resilience controls oversight function that reports to the organization's executive leadership.", "justification": "Executive Leadership Oversight of Security, Compliance & Resilience Controls (CPL-07) provides resilience and recovery capability that compensates for the absence of Documented Alternatives (RSK-17.2) by ensuring the organization can restore operations and data when the primary control is absent. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "RSK-18", "risk_if_not_implemented": "Without Compensating Countermeasures, risks may remain unidentified, unowned or unmanaged, leaving decision-makers without a defensible basis for prioritization and treatment. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unaddressed Security / Compliance Exposure (R-GV-2), Uncontrolled Internal Security / Privacy Exposure (R-GV-4), Inability to Demonstrate Due Diligence / Due Care (R-GV-9), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9).", "compensating_control_1": { "control_id": "VPM-06", "name": "Vulnerability Remediation Process", "description": "Mechanisms exist to ensure that vulnerabilities are properly identified, tracked and remediated.", "justification": "Vulnerability Remediation Process (VPM-06) provides vulnerability management that compensates for the absence of Compensating Countermeasures (RSK-06.2) by reducing the exploitable attack surface by addressing known weaknesses before they are leveraged. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "RSK-17", "name": "Risk Remediation", "description": "Mechanisms exist to remediate risks to an acceptable level.", "justification": "Risk Remediation (RSK-17) provides vulnerability management that compensates for the absence of Compensating Countermeasures (RSK-06.2) by reducing the exploitable attack surface by addressing known weaknesses before they are leveraged. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "RSK-19", "risk_if_not_implemented": "Without Data Protection Impact Assessment (DPIA), risks may remain unidentified, unowned or unmanaged, leaving decision-makers without a defensible basis for prioritization and treatment. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Regulatory / Legal / Contractual Financial Liability (R-EX-5), Unaddressed Security / Compliance Exposure (R-GV-2), Inability to Demonstrate Due Diligence / Due Care (R-GV-9), Privacy Harm / Unauthorized Processing (R-IP-6), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11), Conflict of Interest (COI) / Undue Influence / Insider Misconduct (MT-15).", "compensating_control_1": { "control_id": "PRI-02", "name": "Data Privacy Program", "description": "Mechanisms exist to facilitate the implementation and operation of data protection controls throughout the data lifecycle to ensure all forms of Personal Data (PD) are processed lawfully, fairly and transparently.", "justification": "Data Privacy Program (PRI-02) provides policy-level governance that compensates for the absence of Data Protection Impact Assessment (DPIA) (RSK-19) by establishing documented expectations, accountability structures, and organizational guardrails. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "RSK-13", "name": "Risk Assessment", "description": "Mechanisms exist to conduct recurring assessments of risk that includes the likelihood and magnitude of harm, from unauthorized access, use, disclosure, disruption, modification or destruction of the organization's Technology Assets, Applications, Services and/or Data (TAASD).", "justification": "Risk Assessment (RSK-13) provides periodic assessment and assurance that compensates for the absence of Data Protection Impact Assessment (DPIA) (RSK-19) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "RSK-20.1", "risk_if_not_implemented": "Without AI & Autonomous Technologies Supply Chain Impacts, supplier and External Service Provider (ESP) weaknesses, incidents or failures may propagate into the organization's environment unmanaged. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unaddressed Security / Compliance Exposure (R-GV-2), Uncontrolled Third-Party Security / Privacy Exposure (R-GV-5), Inability to Demonstrate Due Diligence / Due Care (R-GV-9), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11), Conflict of Interest (COI) / Undue Influence / Insider Misconduct (MT-15).", "compensating_control_1": { "control_id": "TPM-02", "name": "Third-Party Management", "description": "Mechanisms exist to facilitate the implementation of third-party management controls.", "justification": "Third-Party Management (TPM-02) provides third-party oversight that compensates for the absence of AI & Autonomous Technologies Supply Chain Impacts (RSK-20.1) by extending security obligations contractually and monitoring third-party risk in lieu of direct control. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "RSK-20", "name": "Supply Chain Risk Management (SCRM) Plan", "description": "Mechanisms exist to develop a plan for Supply Chain Risk Management (SCRM) associated with the development, acquisition, maintenance and disposal of Technology Assets, Applications and/or Services (TAAS), including documenting selected mitigating actions and monitoring performance against those plans.", "justification": "Supply Chain Risk Management (SCRM) Plan (RSK-20) provides risk identification and prioritization that compensates for the absence of AI & Autonomous Technologies Supply Chain Impacts (RSK-20.1) by enabling informed decisions about where to focus resources to manage residual exposure. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "RSK-21", "risk_if_not_implemented": "Without Supply Chain Risk Assessment (SCRA), supplier and External Service Provider (ESP) weaknesses, incidents or failures may propagate into the organization's environment unmanaged. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unaddressed Security / Compliance Exposure (R-GV-2), Uncontrolled Third-Party Security / Privacy Exposure (R-GV-5), Lack of oversight of third-party controls (R-GV-7), Inability to Demonstrate Due Diligence / Due Care (R-GV-9), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11), Data Quality Degradation / Data Poisoning (MT-12), Conflict of Interest (COI) / Undue Influence / Insider Misconduct (MT-15).", "compensating_control_1": { "control_id": "RSK-13", "name": "Risk Assessment", "description": "Mechanisms exist to conduct recurring assessments of risk that includes the likelihood and magnitude of harm, from unauthorized access, use, disclosure, disruption, modification or destruction of the organization's Technology Assets, Applications, Services and/or Data (TAASD).", "justification": "Risk Assessment (RSK-13) provides periodic assessment and assurance that compensates for the absence of Supply Chain Risk Assessment (RSK-21) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "TPM-02", "name": "Third-Party Management", "description": "Mechanisms exist to facilitate the implementation of third-party management controls.", "justification": "Third-Party Management (TPM-02) provides third-party oversight that compensates for the absence of Supply Chain Risk Assessment (RSK-21) by extending security obligations contractually and monitoring third-party risk in lieu of direct control. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "RSK-22", "risk_if_not_implemented": "Without Risk Monitoring, malicious, anomalous or unauthorized activity may go undetected or be detected too late to prevent or limit harm. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unaddressed Security / Compliance Exposure (R-GV-2), Lack of oversight of internal controls (R-GV-6), Inability to Demonstrate Due Diligence / Due Care (R-GV-9), Unreliable Assurance / Decision Information (R-GV-10), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11), Data Quality Degradation / Data Poisoning (MT-12), Conflict of Interest (COI) / Undue Influence / Insider Misconduct (MT-15).", "compensating_control_1": { "control_id": "MON-02", "name": "Continuous Monitoring", "description": "Mechanisms exist to facilitate the implementation of enterprise-wide monitoring controls.", "justification": "Continuous Monitoring (MON-02) provides detective monitoring capability that compensates for the absence of Risk Monitoring (RSK-22) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CPL-07", "name": "Executive Leadership Oversight of Security, Compliance & Resilience Controls", "description": "Mechanisms exist to provide a security, compliance and resilience controls oversight function that reports to the organization's executive leadership.", "justification": "Executive Leadership Oversight of Security, Compliance & Resilience Controls (CPL-07) provides resilience and recovery capability that compensates for the absence of Risk Monitoring (RSK-22) by ensuring the organization can restore operations and data when the primary control is absent. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "SEA-02", "risk_if_not_implemented": "Without Security, Compliance & Resilience Aware Design, security may be bolted on rather than designed in, resulting in structural weaknesses that are costly to remediate and easy to exploit. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unaddressed Security / Compliance Exposure (R-GV-2), Uncontrolled Internal Security / Privacy Exposure (R-GV-4), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9).", "compensating_control_1": { "control_id": "SEA-05", "name": "Secure Engineering Principles", "description": "Mechanisms exist to facilitate the implementation of industry-recognized security, compliance and resilience practices in the specification, design, development, implementation and modification of Technology Assets, Applications and/or Services (TAAS).", "justification": "Secure Engineering Principles (SEA-05) provides secure engineering and architectural guidance that compensates for the absence of Security-Aware Design (SEA-02) by embedding security requirements into design processes as an alternative control mechanism. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "PRM-08", "name": "Security, Compliance & Resilience In Project Management", "description": "Mechanisms exist to assess security, compliance and resilience controls as part of Technology Assets, Applications and/or Services (TAAS) project development to determine whether controls are implemented correctly, operating as intended and producing the desired outcome with respect to meeting requirements.", "justification": "Security, Compliance & Resilience In Project Management (PRM-08) provides resilience and recovery capability that compensates for the absence of Security-Aware Design (SEA-02) by ensuring the organization can restore operations when the primary control is absent. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "SEA-02.1", "risk_if_not_implemented": "Without Achieving Security, Compliance & Resilience Requirements, security may be bolted on rather than designed in, resulting in structural weaknesses that are costly to remediate and easy to exploit. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Business / Service Interruption (R-BC-1), Recovery Failure / Unacceptable Recovery Delay (R-OR-1), Loss of Data / Service Availability (R-IP-4), and most likely increases susceptibility to Technical / Mechanical Failure (MT-10), Hazardous / Degraded Operational Environment (MT-21).", "compensating_control_1": { "control_id": "CFG-04", "name": "Secure Baseline Configurations", "description": "Mechanisms exist to develop, document and maintain secure baseline configurations for Technology Assets, Applications and/or Services (TAAS) that are consistent with industry-accepted hardening standards.", "justification": "Secure Baseline Configurations (CFG-04) provides configuration hardening that compensates for the absence of Achieving Resilience Requirements (SEA-02.1) by eliminating unnecessary services and enforcing secure settings to reduce inherent exposure. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "SEA-05", "name": "Secure Engineering Principles", "description": "Mechanisms exist to facilitate the implementation of industry-recognized security, compliance and resilience practices in the specification, design, development, implementation and modification of Technology Assets, Applications and/or Services (TAAS).", "justification": "Secure Engineering Principles (SEA-05) provides overlapping security capability that compensates for the absence of Achieving Resilience Requirements (SEA-02.1) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "SEA-02.2", "risk_if_not_implemented": "Without Flexible Technology Stack, security may be bolted on rather than designed in, resulting in structural weaknesses that are costly to remediate and easy to exploit. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Concentration / Single-Point Dependency Failure (R-OR-2), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9).", "compensating_control_1": { "control_id": "SEA-04", "name": "Alignment With Enterprise Architecture", "description": "Mechanisms exist to develop an enterprise architecture, aligned with industry-recognized leading practices, with consideration for security, compliance and resilience principles that addresses risk to organizational operations, assets, individuals and other organizations.", "justification": "Alignment With Enterprise Architecture (SEA-04) provides secure engineering and architectural guidance that compensates for the absence of Flexible Technology Stack (SEA-02.2) by embedding security requirements into design and lifecycle processes as an alternative control mechanism. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "AST-37", "name": "Technology Lifecycle Management", "description": "Mechanisms exist to manage the usable lifecycles of Technology Assets, Applications and/or Services (TAAS).", "justification": "Technology Lifecycle Management (AST-37) provides detective monitoring capability that compensates for the absence of Flexible Technology Stack (SEA-02.2) by identifying unauthorized, anomalous or non-compliant activity that the primary control would have prevented. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "SEA-03", "risk_if_not_implemented": "Without Secure Architecture Principles, security may be bolted on rather than designed in, resulting in structural weaknesses that are costly to remediate and easy to exploit. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unaddressed Security / Compliance Exposure (R-GV-2), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9).", "compensating_control_1": { "control_id": "SEA-05", "name": "Secure Engineering Principles", "description": "Mechanisms exist to facilitate the implementation of industry-recognized security, compliance and resilience practices in the specification, design, development, implementation and modification of Technology Assets, Applications and/or Services (TAAS).", "justification": "Secure Engineering Principles (SEA-05) provides secure engineering and architectural guidance that compensates for the absence of Secure Architecture Principles (SEA-03) by embedding security requirements into design processes as an alternative control mechanism. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "TDA-04", "name": "Developer Architecture & Design", "description": "Mechanisms exist to require the developers of Technology Assets, Applications and/or Services (TAAS) to produce a design specification and security architecture that: \n(1) Is consistent with and supportive of the organization's security architecture which is established within and is an integrated part of the organization's enterprise architecture;\n(2) Accurately and completely describes the required security functionality and the allocation of security, compliance and resilience controls among physical and logical components; and\n(3) Expresses how individual security functions, mechanisms and services work together to provide required security capabilities and a unified approach to protection.", "justification": "Developer Architecture & Design (TDA-04) provides secure engineering and architectural guidance that compensates for the absence of Secure Architecture Principles (SEA-03) by embedding security requirements into design processes as an alternative control mechanism. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "SEA-04", "risk_if_not_implemented": "Without Alignment With Enterprise Architecture, security may be bolted on rather than designed in, resulting in structural weaknesses that are costly to remediate and easy to exploit. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Failure to Support Business / Mission Objectives (R-GV-1), Unaddressed Security / Compliance Exposure (R-GV-2), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9).", "compensating_control_1": { "control_id": "SEA-05", "name": "Secure Engineering Principles", "description": "Mechanisms exist to facilitate the implementation of industry-recognized security, compliance and resilience practices in the specification, design, development, implementation and modification of Technology Assets, Applications and/or Services (TAAS).", "justification": "Secure Engineering Principles (SEA-05) provides overlapping security capability that compensates for the absence of Alignment With Enterprise Architecture (SEA-04) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "NET-06", "name": "Network Segmentation (macrosegmentation)", "description": "Mechanisms exist to implement network segmentation within network architectures to isolate Technology Assets, Applications and/or Services (TAAS) from other network resources.", "justification": "Network Segmentation (macrosegmentation) (NET-06) provides network-level access restriction that compensates for the absence of Alignment With Enterprise Architecture (SEA-04) by limiting attacker reach and lateral movement opportunities across the environment. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "SEA-07", "risk_if_not_implemented": "Without System Partitioning, security may be bolted on rather than designed in, resulting in structural weaknesses that are costly to remediate and easy to exploit. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Access (R-AC-4), System / Service Compromise (R-EX-7), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9).", "compensating_control_1": { "control_id": "END-03", "name": "Endpoint Protection Mechanisms", "description": "Mechanisms exist to protect the confidentiality, integrity, availability and safety of endpoint devices.", "justification": "Endpoint Protection Mechanisms (END-03) provides overlapping security capability that compensates for the absence of System Partitioning (SEA-07) by addressing related risk objectives through an alternative control mechanism aligned with Technology applicability. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "NET-06", "name": "Network Segmentation (macrosegmentation)", "description": "Mechanisms exist to implement network segmentation within network architectures to isolate Technology Assets, Applications and/or Services (TAAS) from other network resources.", "justification": "Network Segmentation (macrosegmentation) (NET-06) provides network-level access restriction that compensates for the absence of System Partitioning (SEA-07) by limiting attacker reach and lateral movement opportunities across the environment. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "SEA-08", "risk_if_not_implemented": "Without Application Partitioning, security may be bolted on rather than designed in, resulting in structural weaknesses that are costly to remediate and easy to exploit. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Excessive or Unauthorized Privilege (R-AC-2), Unauthorized Privilege Elevation (R-AC-3), Unauthorized Access (R-AC-4), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "NET-06", "name": "Network Segmentation (macrosegmentation)", "description": "Mechanisms exist to implement network segmentation within network architectures to isolate Technology Assets, Applications and/or Services (TAAS) from other network resources.", "justification": "Network Segmentation (macrosegmentation) (NET-06) provides network-level access restriction that compensates for the absence of Application Partitioning (SEA-08) by limiting attacker reach and lateral movement opportunities across the environment. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "SEA-06", "name": "Defense-In-Depth (DiD) Architecture", "description": "Mechanisms exist to implement security functions as a layered structure minimizing interactions between layers of the design and avoiding any dependence by lower layers on the functionality or correctness of higher layers.", "justification": "Defense-In-Depth (DiD) Architecture (SEA-06) provides overlapping security capability that compensates for the absence of Application Partitioning (SEA-08) by addressing related risk objectives through an alternative control mechanism aligned with Technology applicability. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "SEA-09", "risk_if_not_implemented": "Without Process Isolation, security may be bolted on rather than designed in, resulting in structural weaknesses that are costly to remediate and easy to exploit. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Privilege Elevation (R-AC-3), Unauthorized Access (R-AC-4), Loss of Confidentiality (R-IP-2), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "NET-06", "name": "Network Segmentation (macrosegmentation)", "description": "Mechanisms exist to implement network segmentation within network architectures to isolate Technology Assets, Applications and/or Services (TAAS) from other network resources.", "justification": "Network Segmentation (macrosegmentation) (NET-06) provides network-level access restriction that compensates for the absence of Process Isolation (SEA-09) by limiting attacker reach and lateral movement opportunities across the environment. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CFG-03", "name": "Least Functionality", "description": "Mechanisms exist to configure Technology Assets, Applications and/or Services (TAAS) to provide only essential capabilities by specifically prohibiting or restricting the use of ports, protocols, and/or services.", "justification": "Least Functionality (CFG-03) provides configuration hardening that compensates for the absence of Process Isolation (SEA-09) by eliminating unnecessary services and enforcing secure settings to reduce inherent exposure. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "SEA-10", "risk_if_not_implemented": "Without Security Function Isolation, security may be bolted on rather than designed in, resulting in structural weaknesses that are costly to remediate and easy to exploit. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Privilege Elevation (R-AC-3), Unauthorized Access (R-AC-4), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "CFG-03", "name": "Least Functionality", "description": "Mechanisms exist to configure Technology Assets, Applications and/or Services (TAAS) to provide only essential capabilities by specifically prohibiting or restricting the use of ports, protocols, and/or services.", "justification": "Least Functionality (CFG-03) provides configuration hardening that compensates for the absence of Security Function Isolation (SEA-10) by eliminating unnecessary services and enforcing secure settings to reduce inherent exposure. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "NET-06", "name": "Network Segmentation (macrosegmentation)", "description": "Mechanisms exist to implement network segmentation within network architectures to isolate Technology Assets, Applications and/or Services (TAAS) from other network resources.", "justification": "Network Segmentation (macrosegmentation) (NET-06) provides network-level access restriction that compensates for the absence of Security Function Isolation (SEA-10) by limiting attacker reach and lateral movement opportunities across the environment. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "SEA-11", "risk_if_not_implemented": "Without Hardware Separation, security may be bolted on rather than designed in, resulting in structural weaknesses that are costly to remediate and easy to exploit. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Access (R-AC-4), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Product Defect / Design Failure (MT-23).", "compensating_control_1": { "control_id": "NET-06", "name": "Network Segmentation (macrosegmentation)", "description": "Mechanisms exist to implement network segmentation within network architectures to isolate Technology Assets, Applications and/or Services (TAAS) from other network resources.", "justification": "Network Segmentation (macrosegmentation) (NET-06) provides network-level access restriction that compensates for the absence of Hardware Separation (SEA-11) by limiting attacker reach and lateral movement opportunities across the environment. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "SEA-09", "name": "Process Isolation", "description": "Mechanisms exist to implement a separate execution domain for each executing process.", "justification": "Process Isolation (SEA-09) provides overlapping security capability that compensates for the absence of Hardware Separation (SEA-11) by addressing related risk objectives through an alternative control mechanism aligned with Technology applicability. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "SEA-12", "risk_if_not_implemented": "Without Thread Separation, security may be bolted on rather than designed in, resulting in structural weaknesses that are costly to remediate and easy to exploit. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Access (R-AC-4), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Product Defect / Design Failure (MT-23).", "compensating_control_1": { "control_id": "SEA-09", "name": "Process Isolation", "description": "Mechanisms exist to implement a separate execution domain for each executing process.", "justification": "Process Isolation (SEA-09) provides overlapping security capability that compensates for the absence of Thread Separation (SEA-12) by addressing related risk objectives through an alternative control mechanism aligned with Technology applicability. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CFG-03", "name": "Least Functionality", "description": "Mechanisms exist to configure Technology Assets, Applications and/or Services (TAAS) to provide only essential capabilities by specifically prohibiting or restricting the use of ports, protocols, and/or services.", "justification": "Least Functionality (CFG-03) provides configuration hardening that compensates for the absence of Thread Separation (SEA-12) by eliminating unnecessary services and enforcing secure settings to reduce inherent exposure. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "SEA-13", "risk_if_not_implemented": "Without System Privileges Isolation, users, services and processes may obtain or retain access beyond authorized need, enabling misuse or escalation. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Privilege Elevation (R-AC-3), and most likely increases susceptibility to Malicious Cyber Activity (MT-2).", "compensating_control_1": { "control_id": "CFG-03", "name": "Least Functionality", "description": "Mechanisms exist to configure Technology Assets, Applications and/or Services (TAAS) to provide only essential capabilities by specifically prohibiting or restricting the use of ports, protocols, and/or services.", "justification": "Least Functionality (CFG-03) provides configuration hardening that compensates for the absence of System Privileges Isolation (SEA-13) by eliminating unnecessary services and enforcing secure settings to reduce inherent exposure. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "SEA-09", "name": "Process Isolation", "description": "Mechanisms exist to implement a separate execution domain for each executing process.", "justification": "Process Isolation (SEA-09) provides overlapping security capability that compensates for the absence of System Privileges Isolation (SEA-13) by addressing related risk objectives through an alternative control mechanism aligned with Technology applicability. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "SEA-14", "risk_if_not_implemented": "Without Information In Shared Resources, security may be bolted on rather than designed in, resulting in structural weaknesses that are costly to remediate and easy to exploit. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Access (R-AC-4), Loss of Confidentiality (R-IP-2), and most likely increases susceptibility to Malicious Cyber Activity (MT-2).", "compensating_control_1": { "control_id": "CRY-07", "name": "Encrypting Data At Rest", "description": "Cryptographic mechanisms exist to prevent the unauthorized disclosure of data at rest.", "justification": "Encrypting Data At Rest (CRY-07) provides cryptographic protection that compensates for the absence of Information In Shared Resources (SEA-14) by ensuring data confidentiality and integrity through alternative technical means. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "IAC-30", "name": "Least Privilege", "description": "Mechanisms exist to utilize the concept of least privilege, allowing only authorized access to processes necessary to accomplish assigned tasks in accordance with organizational business functions.", "justification": "Least Privilege (IAC-30) provides access control enforcement that compensates for the absence of Information In Shared Resources (SEA-14) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "SEA-15", "risk_if_not_implemented": "Without Fail Secure, security may be bolted on rather than designed in, resulting in structural weaknesses that are costly to remediate and easy to exploit. Based on the risk and threat mapping for this control, no risk is rated Likely; risks rated Possible include Unauthorized Access (R-AC-4), Unauthorized Modification / Loss of System Integrity (R-AM-2), Business / Service Interruption (R-BC-1), and most likely increases susceptibility to Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "BCD-02", "name": "Business Continuity Management System (BCMS)", "description": "Mechanisms exist to operate a Business Continuity Management System (BCMS) to achieve resilient Technology Assets, Applications, Services and/or Data (TAASD) during:\n(1) Routine operations; and\n(2) Adverse conditions.", "justification": "Business Continuity Management System (BCMS) (BCD-02) provides resilience and recovery capability that compensates for the absence of Fail Secure (SEA-15) by ensuring the organization can restore operations and data when the primary control is absent. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "AST-40", "name": "Predictable Failure Analysis", "description": "Mechanisms exist to determine the Mean Time to Failure (MTTF) for system components in specific environments of operation.", "justification": "Predictable Failure Analysis (AST-40) provides overlapping security capability that compensates for the absence of Fail Secure (SEA-15) by addressing related risk objectives through an alternative control mechanism aligned with Technology applicability. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "SEA-16", "risk_if_not_implemented": "Without Fail Safe, security may be bolted on rather than designed in, resulting in structural weaknesses that are costly to remediate and easy to exploit. Based on the risk and threat mapping for this control, no risk is rated Likely; risks rated Possible include Business / Service Interruption (R-BC-1), System / Data Compromise (Technical Vector) (R-BC-4), System / Service Compromise (R-EX-7), and most likely increases susceptibility to Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "AST-40", "name": "Predictable Failure Analysis", "description": "Mechanisms exist to determine the Mean Time to Failure (MTTF) for system components in specific environments of operation.", "justification": "Predictable Failure Analysis (AST-40) provides overlapping security capability that compensates for the absence of Fail Safe (SEA-16) by addressing related risk objectives through an alternative control mechanism aligned with Technology applicability. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "BCD-02", "name": "Business Continuity Management System (BCMS)", "description": "Mechanisms exist to operate a Business Continuity Management System (BCMS) to achieve resilient Technology Assets, Applications, Services and/or Data (TAASD) during:\n(1) Routine operations; and\n(2) Adverse conditions.", "justification": "Business Continuity Management System (BCMS) (BCD-02) provides resilience and recovery capability that compensates for the absence of Fail Safe (SEA-16) by ensuring the organization can restore operations and data when the primary control is absent. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "SEA-17", "risk_if_not_implemented": "Without Non-Persistence, security may be bolted on rather than designed in, resulting in structural weaknesses that are costly to remediate and easy to exploit. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Incident Persistence / Recurrence (R-IR-3), and most likely increases susceptibility to Malicious Cyber Activity (MT-2).", "compensating_control_1": { "control_id": "CFG-03", "name": "Least Functionality", "description": "Mechanisms exist to configure Technology Assets, Applications and/or Services (TAAS) to provide only essential capabilities by specifically prohibiting or restricting the use of ports, protocols, and/or services.", "justification": "Least Functionality (CFG-03) provides configuration hardening that compensates for the absence of Non-Persistence (SEA-17) by eliminating unnecessary services and enforcing secure settings to reduce inherent exposure. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "BCD-24", "name": "Data Backups", "description": "Mechanisms exist to create recurring backups of data, software and/or system images, as well as verify the integrity of these backups, to ensure the availability of the data to satisfy Recovery Time Objectives (RTOs) and Recovery Point Objectives (RPOs).", "justification": "Data Backups (BCD-24) provides resilience and recovery capability that compensates for the absence of Non-Persistence (SEA-17) by ensuring the organization can restore operations and data when the primary control is absent. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "SEA-17.1", "risk_if_not_implemented": "Without Non-Persistent Information, security may be bolted on rather than designed in, resulting in structural weaknesses that are costly to remediate and easy to exploit. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Retention / Inability to Dispose of Data (R-AM-3). No threat is rated Likely for this control; threats rated Possible include Malicious Cyber Activity (MT-2), Dysfunctional Management Practices (MT-8), Human Error (MT-9).", "compensating_control_1": { "control_id": "DCH-18", "name": "Digital Media Sanitization", "description": "Mechanisms exist to sanitize digital media with the strength and integrity commensurate with the classification or sensitivity of the information prior to disposal, release out of organizational control or release for reuse.", "justification": "Digital Media Sanitization (DCH-18) provides overlapping security capability that compensates for the absence of Non-Persistent Information (SEA-17.1) by addressing related risk objectives through an alternative control mechanism. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CFG-04.5", "name": "Session Termination", "description": "Automated mechanisms exist to log out users, both locally on the network and for remote sessions, at the end of the session or after an organization-defined period of inactivity.", "justification": "Session Termination (CFG-04.5) provides overlapping security capability that compensates for the absence of Non-Persistent Information (SEA-17.1) by addressing related risk objectives through an alternative control mechanism. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "SEA-18", "risk_if_not_implemented": "Without Information Output Filtering, security may be bolted on rather than designed in, resulting in structural weaknesses that are costly to remediate and easy to exploit. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss of Data Integrity (R-IP-3). No threat is rated Likely for this control; threats rated Possible include Malicious Cyber Activity (MT-2), Dysfunctional Management Practices (MT-8), Human Error (MT-9).", "compensating_control_1": { "control_id": "IAC-25", "name": "Access Enforcement", "description": "Mechanisms exist to enforce Logical Access Control (LAC) permissions that conform to the principle of \"least privilege.\"", "justification": "Access Enforcement (IAC-25) provides access control enforcement that compensates for the absence of Information Output Filtering (SEA-18) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "MON-02", "name": "Continuous Monitoring", "description": "Mechanisms exist to facilitate the implementation of enterprise-wide monitoring controls.", "justification": "Continuous Monitoring (MON-02) provides detective monitoring capability that compensates for the absence of Information Output Filtering (SEA-18) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "SEA-19", "risk_if_not_implemented": "Without Memory Protection, security may be bolted on rather than designed in, resulting in structural weaknesses that are costly to remediate and easy to exploit. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Access (R-AC-4), System / Data Compromise (Technical Vector) (R-BC-4), System / Service Compromise (R-EX-7), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Product Defect / Design Failure (MT-23).", "compensating_control_1": { "control_id": "CFG-03", "name": "Least Functionality", "description": "Mechanisms exist to configure Technology Assets, Applications and/or Services (TAAS) to provide only essential capabilities by specifically prohibiting or restricting the use of ports, protocols, and/or services.", "justification": "Least Functionality (CFG-03) provides configuration hardening that compensates for the absence of Memory Protection (SEA-19) by eliminating unnecessary services and enforcing secure settings to reduce inherent exposure. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "END-03", "name": "Endpoint Protection Mechanisms", "description": "Mechanisms exist to protect the confidentiality, integrity, availability and safety of endpoint devices.", "justification": "Endpoint Protection Mechanisms (END-03) provides overlapping security capability that compensates for the absence of Memory Protection (SEA-19) by addressing related risk objectives through an alternative control mechanism aligned with Technology applicability. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "SEA-20", "risk_if_not_implemented": "Without Honeypots, security may be bolted on rather than designed in, resulting in structural weaknesses that are costly to remediate and easy to exploit. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Undetected / Delayed Detection of Adverse Activity (R-SA-1), and most likely increases susceptibility to Malicious Cyber Activity (MT-2).", "compensating_control_1": { "control_id": "NET-31", "name": "Network Intrusion Detection / Prevention Systems (NIDS / NIPS)", "description": "Mechanisms exist to employ Network Intrusion Detection / Prevention Systems (NIDS/NIPS) to detect and/or prevent intrusions into the network.", "justification": "Network Intrusion Detection / Prevention Systems (NIDS / NIPS) (NET-31) provides detective monitoring capability that compensates for the absence of Honeypots (SEA-20) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "MON-02", "name": "Continuous Monitoring", "description": "Mechanisms exist to facilitate the implementation of enterprise-wide monitoring controls.", "justification": "Continuous Monitoring (MON-02) provides detective monitoring capability that compensates for the absence of Honeypots (SEA-20) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "SEA-21", "risk_if_not_implemented": "Without Honeyclients, security may be bolted on rather than designed in, resulting in structural weaknesses that are costly to remediate and easy to exploit. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Undetected / Delayed Detection of Adverse Activity (R-SA-1), and most likely increases susceptibility to Malicious Cyber Activity (MT-2).", "compensating_control_1": { "control_id": "NET-31", "name": "Network Intrusion Detection / Prevention Systems (NIDS / NIPS)", "description": "Mechanisms exist to employ Network Intrusion Detection / Prevention Systems (NIDS/NIPS) to detect and/or prevent intrusions into the network.", "justification": "Network Intrusion Detection / Prevention Systems (NIDS / NIPS) (NET-31) provides detective monitoring capability that compensates for the absence of Honeyclients (SEA-21) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "MON-16", "name": "Anomalous Behavior", "description": "Mechanisms exist to utilize User & Entity Behavior Analytics (UEBA) and/or User Activity Monitoring (UAM) solutions to detect and respond to anomalous behavior that could indicate account compromise or other malicious activities.", "justification": "Anomalous Behavior (MON-16) provides detective monitoring capability that compensates for the absence of Honeyclients (SEA-21) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "SEA-22", "risk_if_not_implemented": "Without Heterogeneity, security may be bolted on rather than designed in, resulting in structural weaknesses that are costly to remediate and easy to exploit. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Concentration / Single-Point Dependency Failure (R-OR-2), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Product Defect / Design Failure (MT-23).", "compensating_control_1": { "control_id": "SEA-06", "name": "Defense-In-Depth (DiD) Architecture", "description": "Mechanisms exist to implement security functions as a layered structure minimizing interactions between layers of the design and avoiding any dependence by lower layers on the functionality or correctness of higher layers.", "justification": "Defense-In-Depth (DiD) Architecture (SEA-06) provides overlapping security capability that compensates for the absence of Heterogeneity (SEA-22) by addressing related risk objectives through an alternative control mechanism aligned with Technology applicability. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "NET-06", "name": "Network Segmentation (macrosegmentation)", "description": "Mechanisms exist to implement network segmentation within network architectures to isolate Technology Assets, Applications and/or Services (TAAS) from other network resources.", "justification": "Network Segmentation (macrosegmentation) (NET-06) provides network-level access restriction that compensates for the absence of Heterogeneity (SEA-22) by limiting attacker reach and lateral movement opportunities across the environment. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "SEA-23", "risk_if_not_implemented": "Without Virtualization Techniques, security may be bolted on rather than designed in, resulting in structural weaknesses that are costly to remediate and easy to exploit. Based on the risk and threat mapping for this control, no risk is rated Likely; risks rated Possible include Business / Service Interruption (R-BC-1), Reduced Operational Productivity (R-BC-3), System / Data Compromise (Technical Vector) (R-BC-4), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "NET-06", "name": "Network Segmentation (macrosegmentation)", "description": "Mechanisms exist to implement network segmentation within network architectures to isolate Technology Assets, Applications and/or Services (TAAS) from other network resources.", "justification": "Network Segmentation (macrosegmentation) (NET-06) provides network-level access restriction that compensates for the absence of Virtualization Techniques (SEA-23) by limiting attacker reach and lateral movement opportunities across the environment. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "SEA-06", "name": "Defense-In-Depth (DiD) Architecture", "description": "Mechanisms exist to implement security functions as a layered structure minimizing interactions between layers of the design and avoiding any dependence by lower layers on the functionality or correctness of higher layers.", "justification": "Defense-In-Depth (DiD) Architecture (SEA-06) provides overlapping security capability that compensates for the absence of Virtualization Techniques (SEA-23) by addressing related risk objectives through an alternative control mechanism aligned with Technology applicability. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "SEA-23.1", "risk_if_not_implemented": "Without Virtual Machine Images, security may be bolted on rather than designed in, resulting in structural weaknesses that are costly to remediate and easy to exploit. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Modification / Loss of System Integrity (R-AM-2), Loss of Data Integrity (R-IP-3), Loss of Authenticity / Provenance (R-IP-5), and most likely increases susceptibility to Malicious Cyber Activity (MT-2).", "compensating_control_1": { "control_id": "CFG-04", "name": "Secure Baseline Configurations", "description": "Mechanisms exist to develop, document and maintain secure baseline configurations for Technology Assets, Applications and/or Services (TAAS) that are consistent with industry-accepted hardening standards.", "justification": "Secure Baseline Configurations (CFG-04) provides configuration hardening that compensates for the absence of Virtual Machine Images (SEA-23.1) by eliminating unnecessary services and enforcing secure settings to reduce inherent exposure. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CHG-03", "name": "Configuration Change Control", "description": "Mechanisms exist to govern the technical configuration change control processes.", "justification": "Configuration Change Control (CHG-03) provides configuration hardening that compensates for the absence of Virtual Machine Images (SEA-23.1) by eliminating unnecessary services and enforcing secure settings to reduce inherent exposure. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "SEA-24", "risk_if_not_implemented": "Without Concealment & Misdirection, security may be bolted on rather than designed in, resulting in structural weaknesses that are costly to remediate and easy to exploit. Based on the risk and threat mapping for this control, no risk is rated Likely; risks rated Possible include Unauthorized Access (R-AC-4), System / Data Compromise (Technical Vector) (R-BC-4), System / Data Compromise (Non-Technical Vector) (R-BC-5), and most likely increases susceptibility to Malicious Cyber Activity (MT-2).", "compensating_control_1": { "control_id": "NET-06", "name": "Network Segmentation (macrosegmentation)", "description": "Mechanisms exist to implement network segmentation within network architectures to isolate Technology Assets, Applications and/or Services (TAAS) from other network resources.", "justification": "Network Segmentation (macrosegmentation) (NET-06) provides network-level access restriction that compensates for the absence of Concealment & Misdirection (SEA-24) by limiting attacker reach and lateral movement opportunities across the environment. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "MON-02", "name": "Continuous Monitoring", "description": "Mechanisms exist to facilitate the implementation of enterprise-wide monitoring controls.", "justification": "Continuous Monitoring (MON-02) provides detective monitoring capability that compensates for the absence of Concealment & Misdirection (SEA-24) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "SEA-24.1", "risk_if_not_implemented": "Without Randomness, security may be bolted on rather than designed in, resulting in structural weaknesses that are costly to remediate and easy to exploit. Based on the risk and threat mapping for this control, no risk is rated Likely; risks rated Possible include Unauthorized Access (R-AC-4), System / Data Compromise (Technical Vector) (R-BC-4), Exposure from Unaddressed Vulnerabilities (R-EX-6), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "MON-02", "name": "Continuous Monitoring", "description": "Mechanisms exist to facilitate the implementation of enterprise-wide monitoring controls.", "justification": "Continuous Monitoring (MON-02) provides detective monitoring capability that compensates for the absence of Randomness (SEA-24.1) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "NET-06", "name": "Network Segmentation (macrosegmentation)", "description": "Mechanisms exist to implement network segmentation within network architectures to isolate Technology Assets, Applications and/or Services (TAAS) from other network resources.", "justification": "Network Segmentation (macrosegmentation) (NET-06) provides network-level access restriction that compensates for the absence of Randomness (SEA-24.1) by limiting attacker reach and lateral movement opportunities across the environment. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "SEA-24.2", "risk_if_not_implemented": "Without Change Processing & Storage Locations, security may be bolted on rather than designed in, resulting in structural weaknesses that are costly to remediate and easy to exploit. Based on the risk and threat mapping for this control, no risk is rated Likely; risks rated Possible include Unauthorized Access (R-AC-4), Business / Service Interruption (R-BC-1), System / Data Compromise (Technical Vector) (R-BC-4), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "NET-06", "name": "Network Segmentation (macrosegmentation)", "description": "Mechanisms exist to implement network segmentation within network architectures to isolate Technology Assets, Applications and/or Services (TAAS) from other network resources.", "justification": "Network Segmentation (macrosegmentation) (NET-06) provides network-level access restriction that compensates for the absence of Change Processing & Storage Locations (SEA-24.2) by limiting attacker reach and lateral movement opportunities across the environment. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "SEA-24", "name": "Concealment & Misdirection", "description": "Mechanisms exist to utilize concealment and misdirection techniques for Technology Assets, Applications and/or Services (TAAS) to confuse and mislead adversaries.", "justification": "Concealment & Misdirection (SEA-24) provides overlapping security capability that compensates for the absence of Change Processing & Storage Locations (SEA-24.2) by addressing related risk objectives through an alternative control mechanism aligned with Technology applicability. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "SEA-25", "risk_if_not_implemented": "Without Distributed Processing & Storage, security may be bolted on rather than designed in, resulting in structural weaknesses that are costly to remediate and easy to exploit. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Concentration / Single-Point Dependency Failure (R-OR-2), and most likely increases susceptibility to natural threats NT-2, NT-3, NT-4, NT-5, NT-6, NT-8, NT-11, NT-12, NT-13, NT-14; Utility Service Disruption (MT-7), Technical / Mechanical Failure (MT-10), Infrastructure Failure / Degradation (MT-27).", "compensating_control_1": { "control_id": "BCD-24", "name": "Data Backups", "description": "Mechanisms exist to create recurring backups of data, software and/or system images, as well as verify the integrity of these backups, to ensure the availability of the data to satisfy Recovery Time Objectives (RTOs) and Recovery Point Objectives (RPOs).", "justification": "Data Backups (BCD-24) provides resilience and recovery capability that compensates for the absence of Distributed Processing & Storage (SEA-25) by ensuring the organization can restore operations and data when the primary control is absent. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "NET-06", "name": "Network Segmentation (macrosegmentation)", "description": "Mechanisms exist to implement network segmentation within network architectures to isolate Technology Assets, Applications and/or Services (TAAS) from other network resources.", "justification": "Network Segmentation (macrosegmentation) (NET-06) provides network-level access restriction that compensates for the absence of Distributed Processing & Storage (SEA-25) by limiting attacker reach and lateral movement opportunities across the environment. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "SEA-26", "risk_if_not_implemented": "Without Non-Modifiable Executable Programs, security, compliance and resilience activities may lack direction, ownership and executive support, leaving required controls unperformed. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Modification / Loss of System Integrity (R-AM-2), and most likely increases susceptibility to Malicious Cyber Activity (MT-2).", "compensating_control_1": { "control_id": "CFG-08.2", "name": "Integrity Assurance & Enforcement (IAE)", "description": "Automated mechanisms exist to:\n(1) Identify unauthorized deviations from an approved secure baseline configuration; and\n(2) Implement automated resiliency actions to remediate the unauthorized change.", "justification": "Integrity Assurance & Enforcement (IAE) (CFG-08.2) provides configuration hardening that compensates for the absence of Non-Modifiable Executable Programs (SEA-26) by eliminating unnecessary services and enforcing secure settings to reduce inherent exposure. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "MON-28", "name": "File Activity Monitoring (FAM)", "description": "Automated mechanisms exist to monitor sensitive and/or regulated data in Technology Assets, Applications and/or Services (TAAS) and data repositories.", "justification": "File Activity Monitoring (FAM) (MON-28) provides detective monitoring capability that compensates for the absence of Non-Modifiable Executable Programs (SEA-26) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "SEA-27", "risk_if_not_implemented": "Without Secure Log-On Procedures (Trusted Path), unauthorized individuals, devices or services may gain access to Technology Assets, Applications, Services, Data and/or Facilities (TAASDF). Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Identity Compromise / Impersonation (R-AC-5), and most likely increases susceptibility to Malicious Cyber Activity (MT-2).", "compensating_control_1": { "control_id": "CFG-04.1", "name": "Account Lockout", "description": "Mechanisms exist to enforce a limit for consecutive invalid login attempts by a user during an organization-defined time period and automatically locks the account when the maximum number of unsuccessful attempts is exceeded.", "justification": "Account Lockout (CFG-04.1) provides access control enforcement that compensates for the absence of Secure Log-On Procedures (SEA-17) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "MON-18.1", "name": "Session Audit", "description": "Mechanisms exist to provide session audit capabilities that can: \n(1) Capture and log all content related to a user session; and\n(2) Remotely view all content related to an established user session in real time.", "justification": "Session Audit (MON-18.1) provides detective monitoring capability that compensates for the absence of Secure Log-On Procedures (SEA-17) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "SEA-28", "risk_if_not_implemented": "Without System Use Notification (Logon Banner), unauthorized individuals, devices or services may gain access to Technology Assets, Applications, Services, Data and/or Facilities (TAASDF). Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Regulatory / Legal / Contractual Financial Liability (R-EX-5), and most likely increases susceptibility to Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11).", "compensating_control_1": { "control_id": "GOV-04", "name": "Publishing Security, Compliance & Resilience Documentation", "description": "Mechanisms exist to establish, maintain and disseminate policies, standards and procedures necessary for secure, compliant and resilient capabilities.", "justification": "Publishing Security, Compliance & Resilience Documentation (GOV-04) provides resilience and recovery capability that compensates for the absence of System Use Notification (Logon Banner) (SEA-28) by ensuring the organization can restore operations and data when the primary control is absent. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "SAT-04", "name": "Security, Compliance & Resilience Awareness Training", "description": "Mechanisms exist to provide all employees and contractors appropriate security, compliance and resilience awareness education and training that is relevant for their job function.", "justification": "Security, Compliance & Resilience Awareness Training (SAT-04) provides personnel training and awareness that compensates for the absence of System Use Notification (Logon Banner) (SEA-28) by reducing human-factor risk by equipping personnel to recognize and respond to relevant threats. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "SEA-28.1", "risk_if_not_implemented": "Without Standardized Microsoft Windows Banner, security may be bolted on rather than designed in, resulting in structural weaknesses that are costly to remediate and easy to exploit. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Regulatory / Legal / Contractual Financial Liability (R-EX-5), and most likely increases susceptibility to Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11).", "compensating_control_1": { "control_id": "SAT-04", "name": "Security, Compliance & Resilience Awareness Training", "description": "Mechanisms exist to provide all employees and contractors appropriate security, compliance and resilience awareness education and training that is relevant for their job function.", "justification": "Security, Compliance & Resilience Awareness Training (SAT-04) provides personnel training and awareness that compensates for the absence of Standardized Microsoft Windows Banner (SEA-28.1) by reducing human-factor risk by equipping personnel to recognize and respond to relevant threats. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "GOV-04", "name": "Publishing Security, Compliance & Resilience Documentation", "description": "Mechanisms exist to establish, maintain and disseminate policies, standards and procedures necessary for secure, compliant and resilient capabilities.", "justification": "Publishing Security, Compliance & Resilience Documentation (GOV-04) provides resilience and recovery capability that compensates for the absence of Standardized Microsoft Windows Banner (SEA-28.1) by ensuring the organization can restore operations and data when the primary control is absent. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "SEA-28.2", "risk_if_not_implemented": "Without Truncated Banner, security may be bolted on rather than designed in, resulting in structural weaknesses that are costly to remediate and easy to exploit. Based on the risk and threat mapping for this control, no risk is rated Likely; risks rated Possible include Regulatory / Legal / Contractual Financial Liability (R-EX-5), Loss of Authorization / Certification / License (R-EX-11), Inability to Demonstrate Due Diligence / Due Care (R-GV-9), and most likely increases susceptibility to Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11).", "compensating_control_1": { "control_id": "GOV-04", "name": "Publishing Security, Compliance & Resilience Documentation", "description": "Mechanisms exist to establish, maintain and disseminate policies, standards and procedures necessary for secure, compliant and resilient capabilities.", "justification": "Publishing Security, Compliance & Resilience Documentation (GOV-04) provides resilience and recovery capability that compensates for the absence of Truncated Banner (SEA-28.2) by ensuring the organization can restore operations and data when the primary control is absent. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "SEA-28", "name": "System Use Notification (Logon Banner)", "description": "Mechanisms exist to utilize system use notification / logon banners that display an approved system use notification message or banner before granting access to Technology Assets, Applications and/or Services (TAAS).", "justification": "System Use Notification (Logon Banner) (SEA-28) provides detective monitoring capability that compensates for the absence of Truncated Banner (SEA-28.2) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "SEA-29", "risk_if_not_implemented": "Without Previous Logon Notification, unauthorized individuals, devices or services may gain access to Technology Assets, Applications, Services, Data and/or Facilities (TAASDF). Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Undetected / Delayed Detection of Adverse Activity (R-SA-1), and most likely increases susceptibility to Human Error (MT-9).", "compensating_control_1": { "control_id": "MON-18.1", "name": "Session Audit", "description": "Mechanisms exist to provide session audit capabilities that can: \n(1) Capture and log all content related to a user session; and\n(2) Remotely view all content related to an established user session in real time.", "justification": "Session Audit (MON-18.1) provides detective monitoring capability that compensates for the absence of Previous Logon Notification (SEA-29) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CFG-04.5", "name": "Session Termination", "description": "Automated mechanisms exist to log out users, both locally on the network and for remote sessions, at the end of the session or after an organization-defined period of inactivity.", "justification": "Session Termination (CFG-04.5) provides overlapping security capability that compensates for the absence of Previous Logon Notification (SEA-29) by addressing related risk objectives through an alternative control mechanism aligned with Technology applicability. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "SEA-30", "risk_if_not_implemented": "Without Clock Synchronization, security may be bolted on rather than designed in, resulting in structural weaknesses that are costly to remediate and easy to exploit. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss of Investigative / Evidentiary Capability (R-IR-1), and most likely increases susceptibility to Space Weather (NT-9); Human Error (MT-9), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "MON-11", "name": "Time Stamps", "description": "Mechanisms exist to configure Technology Assets, Applications and/or Services (TAAS) to use an authoritative time source to generate time stamps for event logs and security-relevant telemetry.", "justification": "Time Stamps (MON-11) provides overlapping security capability that compensates for the absence of Clock Synchronization (SEA-30) by addressing related risk objectives through an alternative control mechanism aligned with Technology applicability. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "MON-05", "name": "Centralized Collection of Event Logs & Security-Relevant Telemetry", "description": "Mechanisms exist to utilize a Security Incident Event Manager (SIEM), or similar automated tool, to support the centralized collection of event logs and security-relevant telemetry.", "justification": "Centralized Collection of Event Logs & Security-Relevant Telemetry (MON-05) provides detective monitoring capability that compensates for the absence of Clock Synchronization (SEA-30) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "SEA-31", "risk_if_not_implemented": "Without Application Container, security may be bolted on rather than designed in, resulting in structural weaknesses that are costly to remediate and easy to exploit. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Access (R-AC-4), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9).", "compensating_control_1": { "control_id": "NET-06", "name": "Network Segmentation (macrosegmentation)", "description": "Mechanisms exist to implement network segmentation within network architectures to isolate Technology Assets, Applications and/or Services (TAAS) from other network resources.", "justification": "Network Segmentation (macrosegmentation) (NET-06) provides network-level access restriction that compensates for the absence of Application Container (SEA-31) by limiting attacker reach and lateral movement opportunities across the environment. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CFG-03", "name": "Least Functionality", "description": "Mechanisms exist to configure Technology Assets, Applications and/or Services (TAAS) to provide only essential capabilities by specifically prohibiting or restricting the use of ports, protocols, and/or services.", "justification": "Least Functionality (CFG-03) provides configuration hardening that compensates for the absence of Application Container (SEA-31) by eliminating unnecessary services and enforcing secure settings to reduce inherent exposure. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "SEA-32", "risk_if_not_implemented": "Without Privileged Environments, users, services and processes may obtain or retain access beyond authorized need, enabling misuse or escalation. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Privilege Elevation (R-AC-3), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9).", "compensating_control_1": { "control_id": "IAC-30", "name": "Least Privilege", "description": "Mechanisms exist to utilize the concept of least privilege, allowing only authorized access to processes necessary to accomplish assigned tasks in accordance with organizational business functions.", "justification": "Least Privilege (IAC-30) provides access control enforcement that compensates for the absence of Privileged Environments (SEA-32) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CFG-03", "name": "Least Functionality", "description": "Mechanisms exist to configure Technology Assets, Applications and/or Services (TAAS) to provide only essential capabilities by specifically prohibiting or restricting the use of ports, protocols, and/or services.", "justification": "Least Functionality (CFG-03) provides configuration hardening that compensates for the absence of Privileged Environments (SEA-32) by eliminating unnecessary services and enforcing secure settings to reduce inherent exposure. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "OPS-02", "risk_if_not_implemented": "Without Operations Security, security, compliance and resilience activities may lack direction, ownership and executive support, leaving required controls unperformed. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unaddressed Security / Compliance Exposure (R-GV-2), Unperformed / Unowned Control Responsibilities (R-GV-3), Uncontrolled Internal Security / Privacy Exposure (R-GV-4), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9).", "compensating_control_1": { "control_id": "GOV-02", "name": "Security, Compliance & Resilience Program (SCRP)", "description": "Mechanisms exist to facilitate the design, implementation, and monitoring of security, compliance and resilience governance controls.", "justification": "Security, Compliance & Resilience Program (SCRP) (GOV-02) provides resilience and recovery capability that compensates for the absence of Operations Security (OPS-02) by ensuring the organization can restore operations and data when the primary control is absent. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "MON-02", "name": "Continuous Monitoring", "description": "Mechanisms exist to facilitate the implementation of enterprise-wide monitoring controls.", "justification": "Continuous Monitoring (MON-02) provides detective monitoring capability that compensates for the absence of Operations Security (OPS-02) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "OPS-03", "risk_if_not_implemented": "Without Security Concept Of Operations (CONOPS), security, compliance and resilience activities may lack direction, ownership and executive support, leaving required controls unperformed. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unaddressed Security / Compliance Exposure (R-GV-2), Inability to Demonstrate Due Diligence / Due Care (R-GV-9), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9).", "compensating_control_1": { "control_id": "GOV-04", "name": "Publishing Security, Compliance & Resilience Documentation", "description": "Mechanisms exist to establish, maintain and disseminate policies, standards and procedures necessary for secure, compliant and resilient capabilities.", "justification": "Publishing Security, Compliance & Resilience Documentation (GOV-04) provides resilience and recovery capability that compensates for the absence of Security Concept Of Operations (CONOPS) (OPS-03) by ensuring the organization can restore operations and data when the primary control is absent. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "RSK-02", "name": "Risk Management Program", "description": "Mechanisms exist to facilitate the implementation of strategic, operational and tactical risk management controls that are aligned with:\n(1) The organization's Enterprise Risk Management (ERM); and\n(2) Industry-recognized cybersecurity risk management practices.", "justification": "Risk Management Program (RSK-02) provides policy-level governance that compensates for the absence of Security Concept Of Operations (CONOPS) (OPS-03) by establishing documented expectations, accountability structures, and organizational guardrails. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "OPS-04", "risk_if_not_implemented": "Without Standardized Operating Procedures (SOP), security, compliance and resilience activities may lack direction, ownership and executive support, leaving required controls unperformed. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unperformed / Unowned Control Responsibilities (R-GV-3), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9).", "compensating_control_1": { "control_id": "MON-02", "name": "Continuous Monitoring", "description": "Mechanisms exist to facilitate the implementation of enterprise-wide monitoring controls.", "justification": "Continuous Monitoring (MON-02) provides detective monitoring capability that compensates for the absence of Standardized Operating Procedures (SOP) (OPS-04) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "GOV-02", "name": "Security, Compliance & Resilience Program (SCRP)", "description": "Mechanisms exist to facilitate the design, implementation, and monitoring of security, compliance and resilience governance controls.", "justification": "Security, Compliance & Resilience Program (SCRP) (GOV-02) provides resilience and recovery capability that compensates for the absence of Standardized Operating Procedures (SOP) (OPS-04) by ensuring the organization can restore operations and data when the primary control is absent. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "OPS-04.1", "risk_if_not_implemented": "Without System Administrative Processes, users, services and processes may obtain or retain access beyond authorized need, enabling misuse or escalation. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Modification / Loss of System Integrity (R-AM-2), Unperformed / Unowned Control Responsibilities (R-GV-3), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Workforce Shortage / Loss of Critical Skills / Labor Disruption (MT-25).", "compensating_control_1": { "control_id": "IAC-30", "name": "Least Privilege", "description": "Mechanisms exist to utilize the concept of least privilege, allowing only authorized access to processes necessary to accomplish assigned tasks in accordance with organizational business functions.", "justification": "Least Privilege (IAC-30) provides access control enforcement that compensates for the absence of System Administrative Processes (OPS-04.1) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "MON-18.1", "name": "Session Audit", "description": "Mechanisms exist to provide session audit capabilities that can: \n(1) Capture and log all content related to a user session; and\n(2) Remotely view all content related to an established user session in real time.", "justification": "Session Audit (MON-18.1) provides detective monitoring capability that compensates for the absence of System Administrative Processes (OPS-04.1) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "OPS-04.2", "risk_if_not_implemented": "Without Database Administrative Processes, users, services and processes may obtain or retain access beyond authorized need, enabling misuse or escalation. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Data Loss / Integrity Compromise (R-BC-2), Unperformed / Unowned Control Responsibilities (R-GV-3), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Workforce Shortage / Loss of Critical Skills / Labor Disruption (MT-25).", "compensating_control_1": { "control_id": "IAC-10", "name": "Privileged Account Management (PAM)", "description": "Mechanisms exist to restrict and control privileged access rights for users and Technology Assets, Applications and/or Services (TAAS).", "justification": "Privileged Account Management (PAM) (IAC-10) provides access control enforcement that compensates for the absence of Database Administrative Processes (OPS-04.2) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "MON-18.1", "name": "Session Audit", "description": "Mechanisms exist to provide session audit capabilities that can: \n(1) Capture and log all content related to a user session; and\n(2) Remotely view all content related to an established user session in real time.", "justification": "Session Audit (MON-18.1) provides detective monitoring capability that compensates for the absence of Database Administrative Processes (OPS-04.2) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "OPS-05", "risk_if_not_implemented": "Without Service Delivery\n(Business Process Support), security, compliance and resilience activities may lack direction, ownership and executive support, leaving required controls unperformed. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Business / Service Interruption (R-BC-1), Failure to Support Business / Mission Objectives (R-GV-1), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Workforce Shortage / Loss of Critical Skills / Labor Disruption (MT-25).", "compensating_control_1": { "control_id": "BCD-02", "name": "Business Continuity Management System (BCMS)", "description": "Mechanisms exist to operate a Business Continuity Management System (BCMS) to achieve resilient Technology Assets, Applications, Services and/or Data (TAASD) during:\n(1) Routine operations; and\n(2) Adverse conditions.", "justification": "Business Continuity Management System (BCMS) (BCD-02) provides resilience and recovery capability that compensates for the absence of Service Delivery\n(Business Process Support) (OPS-05) by ensuring the organization can restore operations and data when the primary control is absent. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CAP-02", "name": "Capacity & Performance Management", "description": "Mechanisms exist to facilitate the implementation of capacity management controls to ensure optimal system performance to meet expected and anticipated future capacity requirements.", "justification": "Capacity & Performance Management (CAP-02) provides overlapping security capability that compensates for the absence of Service Delivery\n(Business Process Support) (OPS-05) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "OPS-06", "risk_if_not_implemented": "Without Secure Practices Guidelines, security, compliance and resilience activities may lack direction, ownership and executive support, leaving required controls unperformed. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Uncontrolled Internal Security / Privacy Exposure (R-GV-4), Harm from Unauthorized / Unintended Product or Service Use (R-SC-5), and most likely increases susceptibility to Human Error (MT-9).", "compensating_control_1": { "control_id": "GOV-04", "name": "Publishing Security, Compliance & Resilience Documentation", "description": "Mechanisms exist to establish, maintain and disseminate policies, standards and procedures necessary for secure, compliant and resilient capabilities.", "justification": "Publishing Security, Compliance & Resilience Documentation (GOV-04) provides resilience and recovery capability that compensates for the absence of Secure Practices Guidelines (OPS-06) by ensuring the organization can restore operations and data when the primary control is absent. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "SAT-04", "name": "Security, Compliance & Resilience Awareness Training", "description": "Mechanisms exist to provide all employees and contractors appropriate security, compliance and resilience awareness education and training that is relevant for their job function.", "justification": "Security, Compliance & Resilience Awareness Training (SAT-04) provides personnel training and awareness that compensates for the absence of Secure Practices Guidelines (OPS-06) by reducing human-factor risk by equipping personnel to recognize and respond to relevant threats. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "OPS-07", "risk_if_not_implemented": "Without Security Operations Center (SOC), security, compliance and resilience activities may lack direction, ownership and executive support, leaving required controls unperformed. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Delayed Containment / Increased Incident Impact (R-IR-2), Undetected / Delayed Detection of Adverse Activity (R-SA-1), and most likely increases susceptibility to Pandemic (Disease) Outbreaks (NT-7); Malicious Cyber Activity (MT-2), Utility Service Disruption (MT-7), Human Error (MT-9), Technical / Mechanical Failure (MT-10), Workforce Shortage / Loss of Critical Skills / Labor Disruption (MT-25).", "compensating_control_1": { "control_id": "MON-02", "name": "Continuous Monitoring", "description": "Mechanisms exist to facilitate the implementation of enterprise-wide monitoring controls.", "justification": "Continuous Monitoring (MON-02) provides detective monitoring capability that compensates for the absence of Security Operations Center (SOC) (OPS-07) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "IRO-02", "name": "Incident Response Operations", "description": "Mechanisms exist to implement and govern processes and documentation to facilitate an organization-wide response capability for cybersecurity and data protection-related incidents.", "justification": "Incident Response Operations (IRO-02) provides incident response capability that compensates for the absence of Security Operations Center (SOC) (OPS-07) by enabling timely detection, containment, and recovery from security events in the absence of the primary control. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "OPS-08", "risk_if_not_implemented": "Without Security Orchestration, Automation, and Response (SOAR), security, compliance and resilience activities may lack direction, ownership and executive support, leaving required controls unperformed. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Delayed Containment / Increased Incident Impact (R-IR-2), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9), Technical / Mechanical Failure (MT-10), Data Quality Degradation / Data Poisoning (MT-12).", "compensating_control_1": { "control_id": "IRO-02", "name": "Incident Response Operations", "description": "Mechanisms exist to implement and govern processes and documentation to facilitate an organization-wide response capability for cybersecurity and data protection-related incidents.", "justification": "Incident Response Operations (IRO-02) provides incident response capability that compensates for the absence of Security Orchestration, Automation, and Response (SOAR) (OPS-08) by enabling timely detection, containment, and recovery from security events in the absence of the primary control. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "MON-02", "name": "Continuous Monitoring", "description": "Mechanisms exist to facilitate the implementation of enterprise-wide monitoring controls.", "justification": "Continuous Monitoring (MON-02) provides detective monitoring capability that compensates for the absence of Security Orchestration, Automation, and Response (SOAR) (OPS-08) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "OPS-09", "risk_if_not_implemented": "Without Shadow Information Technology Detection, malicious, anomalous or unauthorized activity may go undetected or be detected too late to prevent or limit harm. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Access (R-AC-4), Unaddressed Security / Compliance Exposure (R-GV-2), Undetected / Delayed Detection of Adverse Activity (R-SA-1), Harm from Unauthorized / Unintended Product or Service Use (R-SC-5), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "AST-04", "name": "Asset Inventories", "description": "Mechanisms exist to perform inventories of Technology Assets, Applications, Services and/or Data (TAASD) that:\n(1) Accurately reflects the current TAASD in use; \n(2) Identifies authorized software products, including business justification details;\n(3) Is at the level of granularity deemed necessary for tracking and reporting;\n(4) Includes organization-defined information deemed necessary to achieve effective property accountability; and\n(5) Is available for review and audit by designated organizational personnel.", "justification": "Asset Inventories (AST-04) provides overlapping security capability that compensates for the absence of Shadow Information Technology Detection (OPS-09) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "MON-02", "name": "Continuous Monitoring", "description": "Mechanisms exist to facilitate the implementation of enterprise-wide monitoring controls.", "justification": "Continuous Monitoring (MON-02) provides detective monitoring capability that compensates for the absence of Shadow Information Technology Detection (OPS-09) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "SAT-02", "risk_if_not_implemented": "Without Security, Compliance & Resilience-Minded Workforce, essential knowledge and skills may be unavailable when needed, degrading the organization's ability to operate and protect itself. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Lack of a security-minded workforce (R-SA-2), and most likely increases susceptibility to Human Error (MT-9).", "compensating_control_1": { "control_id": "GOV-02", "name": "Security, Compliance & Resilience Program (SCRP)", "description": "Mechanisms exist to facilitate the design, implementation, and monitoring of security, compliance and resilience governance controls.", "justification": "Security, Compliance & Resilience Program (SCRP) (GOV-02) provides resilience and recovery capability that compensates for the absence of Security, Compliance & Resilience-Minded Workforce (SAT-02) by ensuring the organization can restore operations and data when the primary control is absent. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "HRS-02", "name": "Human Resources Security Management", "description": "Mechanisms exist to facilitate the implementation of personnel security controls.", "justification": "Human Resources Security Management (HRS-02) provides overlapping security capability that compensates for the absence of Security, Compliance & Resilience-Minded Workforce (SAT-02) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "SAT-03", "risk_if_not_implemented": "Without Maintaining Workforce Development Relevancy, essential knowledge and skills may be unavailable when needed, degrading the organization's ability to operate and protect itself. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Lack of a security-minded workforce (R-SA-2), and most likely increases susceptibility to Human Error (MT-9).", "compensating_control_1": { "control_id": "HRS-02", "name": "Human Resources Security Management", "description": "Mechanisms exist to facilitate the implementation of personnel security controls.", "justification": "Human Resources Security Management (HRS-02) provides overlapping security capability that compensates for the absence of Maintaining Workforce Development Relevancy (SAT-03) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "GOV-02", "name": "Security, Compliance & Resilience Program (SCRP)", "description": "Mechanisms exist to facilitate the design, implementation, and monitoring of security, compliance and resilience governance controls.", "justification": "Security, Compliance & Resilience Program (SCRP) (GOV-02) provides resilience and recovery capability that compensates for the absence of Maintaining Workforce Development Relevancy (SAT-03) by ensuring the organization can restore operations and data when the primary control is absent. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "SAT-04", "risk_if_not_implemented": "Without Security, Compliance & Resilience Awareness Training, personnel are more likely to make unsafe decisions, fall victim to social engineering, mishandle data or violate requirements. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Lack of a security-minded workforce (R-SA-2), and most likely increases susceptibility to Human Error (MT-9).", "compensating_control_1": { "control_id": "GOV-04", "name": "Publishing Security, Compliance & Resilience Documentation", "description": "Mechanisms exist to establish, maintain and disseminate policies, standards and procedures necessary for secure, compliant and resilient capabilities.", "justification": "Publishing Security, Compliance & Resilience Documentation (GOV-04) provides resilience and recovery capability that compensates for the absence of Security, Compliance & Resilience Awareness Training (SAT-04) by ensuring the organization can restore operations and data when the primary control is absent. Given the people-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "SAT-05", "name": "Role-Based Security, Compliance & Resilience Training", "description": "Mechanisms exist to provide role-based security, compliance and resilience-related training: \n(1) Before authorizing access to the system or performing assigned duties; \n(2) When required by system changes; and \n(3) Annually thereafter.", "justification": "Role-Based Security, Compliance & Resilience Training (SAT-05) provides personnel training and awareness that compensates for the absence of Security, Compliance & Resilience Awareness Training (SAT-04) by reducing human-factor risk by equipping personnel to recognize and respond to relevant threats. Given the people-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "SAT-04.1", "risk_if_not_implemented": "Without Simulated Cyber Attack Scenario Training, personnel are more likely to make unsafe decisions, fall victim to social engineering, mishandle data or violate requirements. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Lack of a security-minded workforce (R-SA-2), and most likely increases susceptibility to Human Error (MT-9).", "compensating_control_1": { "control_id": "SAT-10", "name": "Security, Compliance & Resilience Training Records", "description": "Mechanisms exist to document, retain and monitor individual training activities, including:\n(1) Initial security, compliance and resilience awareness training;\n(2) Recurring awareness training; and\n(3) Technology Assets, Applications and/or Services (TAAS)-specific training.", "justification": "Security, Compliance & Resilience Training Records (SAT-10) provides personnel training and awareness that compensates for the absence of Simulated Cyber Attack Scenario Training (SAT-04.1) by reducing human-factor risk by equipping personnel to recognize and respond to relevant threats. Given the people-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "SAT-04", "name": "Security, Compliance & Resilience Awareness Training", "description": "Mechanisms exist to provide all employees and contractors appropriate security, compliance and resilience awareness education and training that is relevant for their job function.", "justification": "Security, Compliance & Resilience Awareness Training (SAT-04) provides personnel training and awareness that compensates for the absence of Simulated Cyber Attack Scenario Training (SAT-04.1) by reducing human-factor risk by equipping personnel to recognize and respond to relevant threats. Given the people-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "SAT-05", "risk_if_not_implemented": "Without Role-Based Security, Compliance & Resilience Training, users, services and processes may obtain or retain access beyond authorized need, enabling misuse or escalation. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Lack of a security-minded workforce (R-SA-2), and most likely increases susceptibility to Human Error (MT-9).", "compensating_control_1": { "control_id": "SAT-04", "name": "Security, Compliance & Resilience Awareness Training", "description": "Mechanisms exist to provide all employees and contractors appropriate security, compliance and resilience awareness education and training that is relevant for their job function.", "justification": "Security, Compliance & Resilience Awareness Training (SAT-04) provides personnel training and awareness that compensates for the absence of Role-Based Security, Compliance & Resilience Training (SAT-05) by reducing human-factor risk by equipping personnel to recognize and respond to relevant threats. Given the people-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "SAT-10", "name": "Security, Compliance & Resilience Training Records", "description": "Mechanisms exist to document, retain and monitor individual training activities, including:\n(1) Initial security, compliance and resilience awareness training;\n(2) Recurring awareness training; and\n(3) Technology Assets, Applications and/or Services (TAAS)-specific training.", "justification": "Security, Compliance & Resilience Training Records (SAT-10) provides personnel training and awareness that compensates for the absence of Role-Based Security, Compliance & Resilience Training (SAT-05) by reducing human-factor risk by equipping personnel to recognize and respond to relevant threats. Given the people-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "SAT-05.1", "risk_if_not_implemented": "Without Sensitive / Regulated Data Storage, Handling & Processing, sensitive and/or regulated data may be disclosed, altered or lost through inadequate classification, handling or protection. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Lack of a security-minded workforce (R-SA-2), and most likely increases susceptibility to Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11).", "compensating_control_1": { "control_id": "SAT-05", "name": "Role-Based Security, Compliance & Resilience Training", "description": "Mechanisms exist to provide role-based security, compliance and resilience-related training: \n(1) Before authorizing access to the system or performing assigned duties; \n(2) When required by system changes; and \n(3) Annually thereafter.", "justification": "Role-Based Security, Compliance & Resilience Training (SAT-05) provides personnel training and awareness that compensates for the absence of Sensitive / Regulated Data Storage, Handling & Processing (SAT-05.1) by reducing human-factor risk by equipping personnel to recognize and respond to relevant threats. Given the people-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "SAT-10", "name": "Security, Compliance & Resilience Training Records", "description": "Mechanisms exist to document, retain and monitor individual training activities, including:\n(1) Initial security, compliance and resilience awareness training;\n(2) Recurring awareness training; and\n(3) Technology Assets, Applications and/or Services (TAAS)-specific training.", "justification": "Security, Compliance & Resilience Training Records (SAT-10) provides personnel training and awareness that compensates for the absence of Sensitive / Regulated Data Storage, Handling & Processing (SAT-05.1) by reducing human-factor risk by equipping personnel to recognize and respond to relevant threats. Given the people-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "SAT-05.2", "risk_if_not_implemented": "Without Privileged User Training, users, services and processes may obtain or retain access beyond authorized need, enabling misuse or escalation. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unperformed / Unowned Control Responsibilities (R-GV-3), Lack of a security-minded workforce (R-SA-2), and most likely increases susceptibility to Human Error (MT-9).", "compensating_control_1": { "control_id": "SAT-04", "name": "Security, Compliance & Resilience Awareness Training", "description": "Mechanisms exist to provide all employees and contractors appropriate security, compliance and resilience awareness education and training that is relevant for their job function.", "justification": "Security, Compliance & Resilience Awareness Training (SAT-04) provides personnel training and awareness that compensates for the absence of Privileged Users (SAT-05.2) by reducing human-factor risk by equipping personnel to recognize and respond to relevant threats. Given the people-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "SAT-10", "name": "Security, Compliance & Resilience Training Records", "description": "Mechanisms exist to document, retain and monitor individual training activities, including:\n(1) Initial security, compliance and resilience awareness training;\n(2) Recurring awareness training; and\n(3) Technology Assets, Applications and/or Services (TAAS)-specific training.", "justification": "Security, Compliance & Resilience Training Records (SAT-10) provides personnel training and awareness that compensates for the absence of Privileged Users (SAT-05.2) by reducing human-factor risk by equipping personnel to recognize and respond to relevant threats. Given the people-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "SAT-05.3", "risk_if_not_implemented": "Without AI & Autonomous Technologies Risk Management Training, personnel are more likely to make unsafe decisions, fall victim to social engineering, mishandle data or violate requirements. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Lack of a security-minded workforce (R-SA-2), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Workforce Shortage / Loss of Critical Skills / Labor Disruption (MT-25).", "compensating_control_1": { "control_id": "AAT-02", "name": "Artificial Intelligence (AI) & Autonomous Technologies Governance", "description": "Mechanisms exist to ensure policies, processes, procedures and practices related to the mapping, measuring and managing of Artificial Intelligence (AI) and Autonomous Technologies (AAT)-related risks are in place, transparent and implemented effectively.", "justification": "Artificial Intelligence (AI) & Autonomous Technologies Governance (AAT-02) provides detective monitoring capability that compensates for the absence of AI & Autonomous Technologies Training (SAT-05.3) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the people-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "GOV-04", "name": "Publishing Security, Compliance & Resilience Documentation", "description": "Mechanisms exist to establish, maintain and disseminate policies, standards and procedures necessary for secure, compliant and resilient capabilities.", "justification": "Publishing Security, Compliance & Resilience Documentation (GOV-04) provides resilience and recovery capability that compensates for the absence of AI & Autonomous Technologies Training (SAT-05.3) by ensuring the organization can restore operations and data when the primary control is absent. Given the people-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "SAT-05.4", "risk_if_not_implemented": "Without Vendor-Specific Security, Compliance & Resilience Training, supplier and External Service Provider (ESP) weaknesses, incidents or failures may propagate into the organization's environment unmanaged. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Lack of a security-minded workforce (R-SA-2), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Workforce Shortage / Loss of Critical Skills / Labor Disruption (MT-25).", "compensating_control_1": { "control_id": "SAT-10", "name": "Security, Compliance & Resilience Training Records", "description": "Mechanisms exist to document, retain and monitor individual training activities, including:\n(1) Initial security, compliance and resilience awareness training;\n(2) Recurring awareness training; and\n(3) Technology Assets, Applications and/or Services (TAAS)-specific training.", "justification": "Security, Compliance & Resilience Training Records (SAT-10) provides personnel training and awareness that compensates for the absence of Vendor Security, Compliance & Resilience Training (SAT-05.4) by reducing human-factor risk by equipping personnel to recognize and respond to relevant threats. Given the people-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "SAT-05", "name": "Role-Based Security, Compliance & Resilience Training", "description": "Mechanisms exist to provide role-based security, compliance and resilience-related training: \n(1) Before authorizing access to the system or performing assigned duties; \n(2) When required by system changes; and \n(3) Annually thereafter.", "justification": "Role-Based Security, Compliance & Resilience Training (SAT-05) provides personnel training and awareness that compensates for the absence of Vendor Security, Compliance & Resilience Training (SAT-05.4) by reducing human-factor risk by equipping personnel to recognize and respond to relevant threats. Given the people-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "SAT-06", "risk_if_not_implemented": "Without Cyber Threat Environment Situational Awareness, personnel are more likely to make unsafe decisions, fall victim to social engineering, mishandle data or violate requirements. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Lack of a security-minded workforce (R-SA-2), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Dysfunctional Management Practices (MT-8), Human Error (MT-9), Workforce Shortage / Loss of Critical Skills / Labor Disruption (MT-25).", "compensating_control_1": { "control_id": "SAT-10", "name": "Security, Compliance & Resilience Training Records", "description": "Mechanisms exist to document, retain and monitor individual training activities, including:\n(1) Initial security, compliance and resilience awareness training;\n(2) Recurring awareness training; and\n(3) Technology Assets, Applications and/or Services (TAAS)-specific training.", "justification": "Security, Compliance & Resilience Training Records (SAT-10) provides personnel training and awareness that compensates for the absence of Cyber Threat Environment (SAT-06) by reducing human-factor risk by equipping personnel to recognize and respond to relevant threats. Given the people-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "SAT-04", "name": "Security, Compliance & Resilience Awareness Training", "description": "Mechanisms exist to provide all employees and contractors appropriate security, compliance and resilience awareness education and training that is relevant for their job function.", "justification": "Security, Compliance & Resilience Awareness Training (SAT-04) provides personnel training and awareness that compensates for the absence of Cyber Threat Environment (SAT-06) by reducing human-factor risk by equipping personnel to recognize and respond to relevant threats. Given the people-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "SAT-06.1", "risk_if_not_implemented": "Without Social Engineering & Mining, personnel are more likely to make unsafe decisions, fall victim to social engineering, mishandle data or violate requirements. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to System / Data Compromise (Non-Technical Vector) (R-BC-5), Undetected / Delayed Detection of Adverse Activity (R-SA-1), Lack of a security-minded workforce (R-SA-2), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Dysfunctional Management Practices (MT-8), Human Error (MT-9), Workforce Shortage / Loss of Critical Skills / Labor Disruption (MT-25).", "compensating_control_1": { "control_id": "SAT-12", "name": "Security, Compliance & Resilience Knowledge Sharing", "description": "Mechanisms exist to improve knowledge sharing across security, compliance and resilience personnel allowing for:\n(1) Efficient operations; and\n(2) Rapid and effective response to incidents.", "justification": "Security, Compliance & Resilience Knowledge Sharing (SAT-12) provides personnel training and awareness that compensates for the absence of Social Engineering & Mining (SAT-06.1) by reducing human-factor risk by equipping personnel to recognize and respond to relevant threats. Given the people-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "SAT-04", "name": "Security, Compliance & Resilience Awareness Training", "description": "Mechanisms exist to provide all employees and contractors appropriate security, compliance and resilience awareness education and training that is relevant for their job function.", "justification": "Security, Compliance & Resilience Awareness Training (SAT-04) provides personnel training and awareness that compensates for the absence of Social Engineering & Mining (SAT-06.1) by reducing human-factor risk by equipping personnel to recognize and respond to relevant threats. Given the people-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "SAT-06.2", "risk_if_not_implemented": "Without Suspicious Communications & Anomalous System Behavior, malicious, anomalous or unauthorized activity may go undetected or be detected too late to prevent or limit harm. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to System / Data Compromise (Technical Vector) (R-BC-4), Undetected / Delayed Detection of Adverse Activity (R-SA-1), Lack of a security-minded workforce (R-SA-2), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Dysfunctional Management Practices (MT-8), Human Error (MT-9), Workforce Shortage / Loss of Critical Skills / Labor Disruption (MT-25).", "compensating_control_1": { "control_id": "SAT-04", "name": "Security, Compliance & Resilience Awareness Training", "description": "Mechanisms exist to provide all employees and contractors appropriate security, compliance and resilience awareness education and training that is relevant for their job function.", "justification": "Security, Compliance & Resilience Awareness Training (SAT-04) provides personnel training and awareness that compensates for the absence of Suspicious Communications & Anomalous System Behavior (SAT-06.2) by reducing human-factor risk by equipping personnel to recognize and respond to relevant threats. Given the people-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "SAT-05", "name": "Role-Based Security, Compliance & Resilience Training", "description": "Mechanisms exist to provide role-based security, compliance and resilience-related training: \n(1) Before authorizing access to the system or performing assigned duties; \n(2) When required by system changes; and \n(3) Annually thereafter.", "justification": "Role-Based Security, Compliance & Resilience Training (SAT-05) provides personnel training and awareness that compensates for the absence of Suspicious Communications & Anomalous System Behavior (SAT-06.2) by reducing human-factor risk by equipping personnel to recognize and respond to relevant threats. Given the people-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "SAT-06.3", "risk_if_not_implemented": "Without Counterintelligence Training, personnel are more likely to make unsafe decisions, fall victim to social engineering, mishandle data or violate requirements. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Undetected / Delayed Detection of Adverse Activity (R-SA-1), Lack of a security-minded workforce (R-SA-2), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Workforce Shortage / Loss of Critical Skills / Labor Disruption (MT-25).", "compensating_control_1": { "control_id": "SAT-10", "name": "Security, Compliance & Resilience Training Records", "description": "Mechanisms exist to document, retain and monitor individual training activities, including:\n(1) Initial security, compliance and resilience awareness training;\n(2) Recurring awareness training; and\n(3) Technology Assets, Applications and/or Services (TAAS)-specific training.", "justification": "Security, Compliance & Resilience Training Records (SAT-10) provides personnel training and awareness that compensates for the absence of Counterintelligence Training (SAT-06.3) by reducing human-factor risk by equipping personnel to recognize and respond to relevant threats. Given the people-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "SAT-05", "name": "Role-Based Security, Compliance & Resilience Training", "description": "Mechanisms exist to provide role-based security, compliance and resilience-related training: \n(1) Before authorizing access to the system or performing assigned duties; \n(2) When required by system changes; and \n(3) Annually thereafter.", "justification": "Role-Based Security, Compliance & Resilience Training (SAT-05) provides personnel training and awareness that compensates for the absence of Counterintelligence Training (SAT-06.3) by reducing human-factor risk by equipping personnel to recognize and respond to relevant threats. Given the people-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "SAT-06.4", "risk_if_not_implemented": "Without Anti-Counterfeit Training, counterfeit, non-conforming or compromised components and services may enter the environment through the supply chain. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Undetected / Delayed Detection of Adverse Activity (R-SA-1), Lack of a security-minded workforce (R-SA-2), Counterfeit / Non-Conforming Component Impact (R-SC-7), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Counterfeit / Non-Conforming Products (MT-20), Workforce Shortage / Loss of Critical Skills / Labor Disruption (MT-25).", "compensating_control_1": { "control_id": "RSK-20", "name": "Supply Chain Risk Management (SCRM) Plan", "description": "Mechanisms exist to develop a plan for Supply Chain Risk Management (SCRM) associated with the development, acquisition, maintenance and disposal of Technology Assets, Applications and/or Services (TAAS), including documenting selected mitigating actions and monitoring performance against those plans.", "justification": "Supply Chain Risk Management (SCRM) Plan (RSK-20) provides risk identification and prioritization that compensates for the absence of Anti-Counterfeit Training (SAT-06.4) by enabling informed decisions about where to focus resources to manage residual exposure. Given the people-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "TPM-21", "name": "Third-Party Incident Response & Recovery Capabilities", "description": "Mechanisms exist to ensure response/recovery planning and testing are conducted with critical suppliers/providers.", "justification": "Third-Party Incident Response & Recovery Capabilities (TPM-21) provides resilience and recovery capability that compensates for the absence of Anti-Counterfeit Training (SAT-06.4) by ensuring the organization can restore operations and data when the primary control is absent. Given the people-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "SAT-06.5", "risk_if_not_implemented": "Without Quantum Security Awareness, sensitive data with long confidentiality lifetimes remains protected only by quantum-vulnerable cryptography, exposing it to future decryption. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Lack of a security-minded workforce (R-SA-2), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Workforce Shortage / Loss of Critical Skills / Labor Disruption (MT-25).", "compensating_control_1": { "control_id": "SAT-04", "name": "Security, Compliance & Resilience Awareness Training", "description": "Mechanisms exist to provide all employees and contractors appropriate security, compliance and resilience awareness education and training that is relevant for their job function.", "justification": "Security, Compliance & Resilience Awareness Training (SAT-04) provides personnel training and awareness that compensates for the absence of Quantum Security Awareness (SAT-06.5) by equipping personnel with the knowledge and skills needed to recognize and respond to relevant threats. Given the people-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "SAT-05", "name": "Role-Based Security, Compliance & Resilience Training", "description": "Mechanisms exist to provide role-based security, compliance and resilience-related training: \n(1) Before authorizing access to the system or performing assigned duties; \n(2) When required by system changes; and \n(3) Annually thereafter.", "justification": "Role-Based Security, Compliance & Resilience Training (SAT-05) provides personnel training and awareness that compensates for the absence of Quantum Security Awareness (SAT-06.5) by equipping personnel with the knowledge and skills needed to recognize and respond to relevant threats. Given the people-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "SAT-07", "risk_if_not_implemented": "Without Continuing Professional Education (CPE) - Security, Compliance & Resilience Personnel, personnel are more likely to make unsafe decisions, fall victim to social engineering, mishandle data or violate requirements. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Lack of a security-minded workforce (R-SA-2), Loss of Critical Knowledge / Capability (R-PE-1), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Workforce Shortage / Loss of Critical Skills / Labor Disruption (MT-25).", "compensating_control_1": { "control_id": "SAT-05", "name": "Role-Based Security, Compliance & Resilience Training", "description": "Mechanisms exist to provide role-based security, compliance and resilience-related training: \n(1) Before authorizing access to the system or performing assigned duties; \n(2) When required by system changes; and \n(3) Annually thereafter.", "justification": "Role-Based Security, Compliance & Resilience Training (SAT-05) provides personnel training and awareness that compensates for the absence of Continuing Professional Education (CPE) - Security, Compliance & Resilience Personnel (SAT-07) by reducing human-factor risk by equipping personnel to recognize and respond to relevant threats. Given the people-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "SAT-04", "name": "Security, Compliance & Resilience Awareness Training", "description": "Mechanisms exist to provide all employees and contractors appropriate security, compliance and resilience awareness education and training that is relevant for their job function.", "justification": "Security, Compliance & Resilience Awareness Training (SAT-04) provides personnel training and awareness that compensates for the absence of Continuing Professional Education (CPE) - Security, Compliance & Resilience Personnel (SAT-07) by reducing human-factor risk by equipping personnel to recognize and respond to relevant threats. Given the people-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "SAT-08", "risk_if_not_implemented": "Without Continuing Professional Education (CPE) - DevOps Personnel, personnel are more likely to make unsafe decisions, fall victim to social engineering, mishandle data or violate requirements. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Lack of a security-minded workforce (R-SA-2), Loss of Critical Knowledge / Capability (R-PE-1), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Workforce Shortage / Loss of Critical Skills / Labor Disruption (MT-25).", "compensating_control_1": { "control_id": "SAT-04", "name": "Security, Compliance & Resilience Awareness Training", "description": "Mechanisms exist to provide all employees and contractors appropriate security, compliance and resilience awareness education and training that is relevant for their job function.", "justification": "Security, Compliance & Resilience Awareness Training (SAT-04) provides personnel training and awareness that compensates for the absence of Continuing Professional Education (CPE) - DevOps Personnel (SAT-08) by reducing human-factor risk by equipping personnel to recognize and respond to relevant threats. Given the people-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "SAT-05", "name": "Role-Based Security, Compliance & Resilience Training", "description": "Mechanisms exist to provide role-based security, compliance and resilience-related training: \n(1) Before authorizing access to the system or performing assigned duties; \n(2) When required by system changes; and \n(3) Annually thereafter.", "justification": "Role-Based Security, Compliance & Resilience Training (SAT-05) provides personnel training and awareness that compensates for the absence of Continuing Professional Education (CPE) - DevOps Personnel (SAT-08) by reducing human-factor risk by equipping personnel to recognize and respond to relevant threats. Given the people-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "SAT-09", "risk_if_not_implemented": "Without Practical Security Training Exercises, personnel are more likely to make unsafe decisions, fall victim to social engineering, mishandle data or violate requirements. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Lack of a security-minded workforce (R-SA-2), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Workforce Shortage / Loss of Critical Skills / Labor Disruption (MT-25).", "compensating_control_1": { "control_id": "SAT-10", "name": "Security, Compliance & Resilience Training Records", "description": "Mechanisms exist to document, retain and monitor individual training activities, including:\n(1) Initial security, compliance and resilience awareness training;\n(2) Recurring awareness training; and\n(3) Technology Assets, Applications and/or Services (TAAS)-specific training.", "justification": "Security, Compliance & Resilience Training Records (SAT-10) provides personnel training and awareness that compensates for the absence of Practical Exercises (SAT-09) by reducing human-factor risk by equipping personnel to recognize and respond to relevant threats. Given the people-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "SAT-04", "name": "Security, Compliance & Resilience Awareness Training", "description": "Mechanisms exist to provide all employees and contractors appropriate security, compliance and resilience awareness education and training that is relevant for their job function.", "justification": "Security, Compliance & Resilience Awareness Training (SAT-04) provides personnel training and awareness that compensates for the absence of Practical Exercises (SAT-09) by reducing human-factor risk by equipping personnel to recognize and respond to relevant threats. Given the people-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "SAT-10", "risk_if_not_implemented": "Without Security, Compliance & Resilience Training Records, personnel are more likely to make unsafe decisions, fall victim to social engineering, mishandle data or violate requirements. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Inability to Demonstrate Due Diligence / Due Care (R-GV-9), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Workforce Shortage / Loss of Critical Skills / Labor Disruption (MT-25).", "compensating_control_1": { "control_id": "SAT-05", "name": "Role-Based Security, Compliance & Resilience Training", "description": "Mechanisms exist to provide role-based security, compliance and resilience-related training: \n(1) Before authorizing access to the system or performing assigned duties; \n(2) When required by system changes; and \n(3) Annually thereafter.", "justification": "Role-Based Security, Compliance & Resilience Training (SAT-05) provides personnel training and awareness that compensates for the absence of Security, Compliance & Resilience Training Records (SAT-10) by reducing human-factor risk by equipping personnel to recognize and respond to relevant threats. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "SAT-04", "name": "Security, Compliance & Resilience Awareness Training", "description": "Mechanisms exist to provide all employees and contractors appropriate security, compliance and resilience awareness education and training that is relevant for their job function.", "justification": "Security, Compliance & Resilience Awareness Training (SAT-10) provides personnel training and awareness that compensates for the absence of Security, Compliance & Resilience Training Records (SAT-10) by reducing human-factor risk by equipping personnel to recognize and respond to relevant threats. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "SAT-11", "risk_if_not_implemented": "Without Training Feedback, personnel are more likely to make unsafe decisions, fall victim to social engineering, mishandle data or violate requirements. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Inability to Demonstrate Due Diligence / Due Care (R-GV-9), Unreliable Assurance / Decision Information (R-GV-10), Lack of a security-minded workforce (R-SA-2), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Data Quality Degradation / Data Poisoning (MT-12).", "compensating_control_1": { "control_id": "SAT-10", "name": "Security, Compliance & Resilience Training Records", "description": "Mechanisms exist to document, retain and monitor individual training activities, including:\n(1) Initial security, compliance and resilience awareness training;\n(2) Recurring awareness training; and\n(3) Technology Assets, Applications and/or Services (TAAS)-specific training.", "justification": "Security, Compliance & Resilience Training Records (SAT-10) provides personnel training and awareness that compensates for the absence of Training Feedback (SAT-11) by equipping personnel with the knowledge and skills needed to recognize and respond to relevant threats. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "GOV-12", "name": "Measures of Performance", "description": "Mechanisms exist to develop, report and monitor Security, Compliance & Resilience Program (SCRP) measures of performance.", "justification": "Measures of Performance (GOV-12) provides overlapping security capability that compensates for the absence of Training Feedback (SAT-11) by addressing related risk objectives through an alternative control mechanism. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "SAT-12", "risk_if_not_implemented": "Without Security, Compliance & Resilience Knowledge Sharing, essential knowledge and skills may be unavailable when needed, degrading the organization's ability to operate and protect itself. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Reduced Operational Productivity (R-BC-3), Delayed Containment / Increased Incident Impact (R-IR-2), Loss of Critical Knowledge / Capability (R-PE-1), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Workforce Shortage / Loss of Critical Skills / Labor Disruption (MT-25).", "compensating_control_1": { "control_id": "SAT-04", "name": "Security, Compliance & Resilience Awareness Training", "description": "Mechanisms exist to provide all employees and contractors appropriate security, compliance and resilience awareness education and training that is relevant for their job function.", "justification": "Security, Compliance & Resilience Awareness Training (SAT-04) provides personnel training and awareness that compensates for the absence of Security, Compliance & Resilience Knowledge Sharing (SAT-12) by reducing human-factor risk by equipping personnel to recognize and respond to relevant threats. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "GOV-04", "name": "Publishing Security, Compliance & Resilience Documentation", "description": "Mechanisms exist to establish, maintain and disseminate policies, standards and procedures necessary for secure, compliant and resilient capabilities.", "justification": "Publishing Security, Compliance & Resilience Documentation (GOV-04) provides resilience and recovery capability that compensates for the absence of Security, Compliance & Resilience Knowledge Sharing (SAT-12) by ensuring the organization can restore operations and data when the primary control is absent. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "TDA-03", "risk_if_not_implemented": "Without Development Methods, Techniques & Processes, applications may be built and deployed with exploitable design and coding weaknesses that adversaries can leverage. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Modification / Loss of System Integrity (R-AM-2), Exposure from Unaddressed Vulnerabilities (R-EX-6), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Product Defect / Design Failure (MT-23).", "compensating_control_1": { "control_id": "TDA-11.1", "name": "Minimum Viable Product (MVP) Security Requirements", "description": "Mechanisms exist to design, develop and produce Technology Assets, Applications and/or Services (TAAS) in such a way that risk-based technical and functional specifications ensure Minimum Viable Product (MVP) criteria establish an appropriate level of security and resiliency based on applicable risks and threats.", "justification": "Minimum Viable Product (MVP) Security Requirements (TDA-11.1) provides overlapping security capability that compensates for the absence of Development Methods, Techniques & Processes (TDA-03) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "PRM-09", "name": "Security, Compliance & Resilience Requirements Definition", "description": "Mechanisms exist to proactively govern Technology Assets, Applications and/or Services (TAAS) by:\n(1) Defining technical security, compliance and resilience requirements; and\n(2) Performing a criticality analysis at predefined decision points in the Secure Development Life Cycle (SDLC).", "justification": "Security, Compliance & Resilience Requirements Definition (PRM-09) provides resilience and recovery capability that compensates for the absence of Development Methods, Techniques & Processes (TDA-03) by ensuring the organization can restore operations and data when the primary control is absent. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "TDA-03.1", "risk_if_not_implemented": "Without Software Assurance Maturity Model (SAMM), AI and autonomous systems may produce unreliable, biased or unsafe outputs, act outside authorized scope, or expose sensitive data. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Lack of oversight of internal controls (R-GV-6), Inability to Demonstrate Due Diligence / Due Care (R-GV-9), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9).", "compensating_control_1": { "control_id": "CPL-05", "name": "Conformity Monitoring", "description": "Mechanisms exist to validate that Technology Assets, Applications, Services and/or Data (TAASD) conform to the organization's security, compliance and/or resilience policies, standards and other applicable requirements.", "justification": "Conformity Monitoring (CPL-05) provides periodic assessment and assurance that compensates for the absence of Software Assurance Maturity Model (SAMM) (TDA-03.1) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "TDA-05", "name": "Secure Software Development Practices (SSDP)", "description": "Mechanisms exist to develop applications based on Secure Software Development Practices (SSDP).", "justification": "Secure Software Development Practices (SSDP) (TDA-05) provides overlapping security capability that compensates for the absence of Software Assurance Maturity Model (SAMM) (TDA-03.1) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "TDA-03.2", "risk_if_not_implemented": "Without Secure Settings By Default, applications may be built and deployed with exploitable design and coding weaknesses that adversaries can leverage. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Access (R-AC-4), Exposure from Unaddressed Vulnerabilities (R-EX-6), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9).", "compensating_control_1": { "control_id": "TDA-17", "name": "Security, Compliance & Resilience Testing Throughout Development", "description": "Mechanisms exist to require system developers/integrators consult with security, compliance and/or resilience personnel to: \n(1) Create and implement a Security Testing and Evaluation (ST&E) plan, or similar capability;\n(2) Implement a verifiable flaw remediation process to correct weaknesses and deficiencies identified during the control testing and evaluation process; and\n(3) Document the results.", "justification": "Security, Compliance & Resilience Testing Throughout Development (TDA-17) provides periodic assessment and assurance that compensates for the absence of Secure Settings By Default (TDA-03.2) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "IAO-04", "name": "Control Validation Testing (CVT)", "description": "Mechanisms exist to formally assess the security, compliance and resilience controls in Technology Assets, Applications and/or Services (TAAS) through Information Assurance Program (IAP) activities to determine the extent to which the controls are implemented correctly, operating as intended and producing the desired outcome with respect to meeting expected requirements.", "justification": "Control Validation Testing (CVT) (IAO-04) provides periodic assessment and assurance that compensates for the absence of Secure Settings By Default (TDA-03.2) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "TDA-04", "risk_if_not_implemented": "Without Developer Architecture & Design, security may be bolted on rather than designed in, resulting in structural weaknesses that are costly to remediate and easy to exploit. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unaddressed Security / Compliance Exposure (R-GV-2), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9).", "compensating_control_1": { "control_id": "SEA-05", "name": "Secure Engineering Principles", "description": "Mechanisms exist to facilitate the implementation of industry-recognized security, compliance and resilience practices in the specification, design, development, implementation and modification of Technology Assets, Applications and/or Services (TAAS).", "justification": "Secure Engineering Principles (SEA-05) provides overlapping security capability that compensates for the absence of Developer Architecture & Design (TDA-04) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "TDA-05", "name": "Secure Software Development Practices (SSDP)", "description": "Mechanisms exist to develop applications based on Secure Software Development Practices (SSDP).", "justification": "Secure Software Development Practices (SSDP) (TDA-04) provides overlapping security capability that compensates for the absence of Developer Architecture & Design (TDA-04) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "TDA-04.1", "risk_if_not_implemented": "Without Programming Language Selection, security, compliance and resilience activities may lack direction, ownership and executive support, leaving required controls unperformed. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Inability to Demonstrate Due Diligence / Due Care (R-GV-9), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9).", "compensating_control_1": { "control_id": "TDA-05", "name": "Secure Software Development Practices (SSDP)", "description": "Mechanisms exist to develop applications based on Secure Software Development Practices (SSDP).", "justification": "Secure Software Development Practices (SSDP) (TDA-05) provides overlapping security capability that compensates for the absence of Programming Language Selection (TDA-04.1) by addressing related risk objectives through an alternative control mechanism. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CFG-11", "name": "Software Usage Restrictions", "description": "Mechanisms exist to enforce software usage restrictions to comply with applicable contract agreements and copyright laws.", "justification": "Software Usage Restrictions (CFG-11) provides overlapping security capability that compensates for the absence of Programming Language Selection (TDA-04.1) by addressing related risk objectives through an alternative control mechanism. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "TDA-05.1", "risk_if_not_implemented": "Without Criticality Analysis During Development, the organization's most critical assets may not receive proportionate protection, leaving them disproportionately exposed to compromise. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unaddressed Security / Compliance Exposure (R-GV-2), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9).", "compensating_control_1": { "control_id": "TDA-17", "name": "Security, Compliance & Resilience Testing Throughout Development", "description": "Mechanisms exist to require system developers/integrators consult with security, compliance and/or resilience personnel to: \n(1) Create and implement a Security Testing and Evaluation (ST&E) plan, or similar capability;\n(2) Implement a verifiable flaw remediation process to correct weaknesses and deficiencies identified during the control testing and evaluation process; and\n(3) Document the results.", "justification": "Security, Compliance & Resilience Testing Throughout Development (TDA-17) provides periodic assessment and assurance that compensates for the absence of Criticality Analysis During Development (TDA-05.1) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "SEA-05", "name": "Secure Engineering Principles", "description": "Mechanisms exist to facilitate the implementation of industry-recognized security, compliance and resilience practices in the specification, design, development, implementation and modification of Technology Assets, Applications and/or Services (TAAS).", "justification": "Secure Engineering Principles (SEA-05) provides overlapping security capability that compensates for the absence of Criticality Analysis During Development (TDA-05.1) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "TDA-05.2", "risk_if_not_implemented": "Without Threat Modeling, AI and autonomous systems may produce unreliable, biased or unsafe outputs, act outside authorized scope, or expose sensitive data. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unaddressed Security / Compliance Exposure (R-GV-2), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9).", "compensating_control_1": { "control_id": "TDA-17", "name": "Security, Compliance & Resilience Testing Throughout Development", "description": "Mechanisms exist to require system developers/integrators consult with security, compliance and/or resilience personnel to: \n(1) Create and implement a Security Testing and Evaluation (ST&E) plan, or similar capability;\n(2) Implement a verifiable flaw remediation process to correct weaknesses and deficiencies identified during the control testing and evaluation process; and\n(3) Document the results.", "justification": "Security, Compliance & Resilience Testing Throughout Development (TDA-17) provides periodic assessment and assurance that compensates for the absence of Threat Modeling (TDA-05.2) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CPL-05", "name": "Conformity Monitoring", "description": "Mechanisms exist to validate that Technology Assets, Applications, Services and/or Data (TAASD) conform to the organization's security, compliance and/or resilience policies, standards and other applicable requirements.", "justification": "Conformity Monitoring (CPL-05) provides periodic assessment and assurance that compensates for the absence of Threat Modeling (TDA-05.2) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "TDA-05.3", "risk_if_not_implemented": "Without Supporting Toolchain, applications may be built and deployed with exploitable design and coding weaknesses that adversaries can leverage. Based on the risk and threat mapping for this control, no risk is rated Likely; risks rated Possible include Unauthorized Modification / Loss of System Integrity (R-AM-2), Reduced Operational Productivity (R-BC-3), System / Data Compromise (Technical Vector) (R-BC-4), and most likely increases susceptibility to Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "SEA-05", "name": "Secure Engineering Principles", "description": "Mechanisms exist to facilitate the implementation of industry-recognized security, compliance and resilience practices in the specification, design, development, implementation and modification of Technology Assets, Applications and/or Services (TAAS).", "justification": "Secure Engineering Principles (SEA-05) provides overlapping security capability that compensates for the absence of Supporting Toolchain (TDA-05.3) by addressing related risk objectives through an alternative control mechanism aligned with Technology applicability. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "TDA-05", "name": "Secure Software Development Practices (SSDP)", "description": "Mechanisms exist to develop applications based on Secure Software Development Practices (SSDP).", "justification": "Secure Software Development Practices (SSDP) (TDA-05) provides overlapping security capability that compensates for the absence of Supporting Toolchain (TDA-05.3) by addressing related risk objectives through an alternative control mechanism aligned with Technology applicability. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "TDA-05.5", "risk_if_not_implemented": "Without Software Design Root Cause Analysis (RCA), applications may be built and deployed with exploitable design and coding weaknesses that adversaries can leverage. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Lack of oversight of internal controls (R-GV-6), Incident Persistence / Recurrence (R-IR-3), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Workforce Shortage / Loss of Critical Skills / Labor Disruption (MT-25).", "compensating_control_1": { "control_id": "CPL-05", "name": "Conformity Monitoring", "description": "Mechanisms exist to validate that Technology Assets, Applications, Services and/or Data (TAASD) conform to the organization's security, compliance and/or resilience policies, standards and other applicable requirements.", "justification": "Conformity Monitoring (CPL-05) provides periodic assessment and assurance that compensates for the absence of Software Design Root Cause Analysis (TDA-05.5) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "SEA-05", "name": "Secure Engineering Principles", "description": "Mechanisms exist to facilitate the implementation of industry-recognized security, compliance and resilience practices in the specification, design, development, implementation and modification of Technology Assets, Applications and/or Services (TAAS).", "justification": "Secure Engineering Principles (SEA-05) provides overlapping security capability that compensates for the absence of Software Design Root Cause Analysis (TDA-05.5) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "TDA-06.1", "risk_if_not_implemented": "Without Product Conformity Governance, the organization may fail to meet statutory, regulatory or contractual obligations, or be unable to demonstrate conformity when required. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Regulatory / Legal / Contractual Financial Liability (R-EX-5), Loss of Authorization / Certification / License (R-EX-11), Unaddressed Security / Compliance Exposure (R-GV-2), and most likely increases susceptibility to Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11).", "compensating_control_1": { "control_id": "CPL-02", "name": "Statutory, Regulatory & Contractual Compliance", "description": "Mechanisms exist to facilitate the identification and implementation of relevant statutory, regulatory and contractual controls.", "justification": "Statutory, Regulatory & Contractual Compliance (CPL-02) provides overlapping security capability that compensates for the absence of Product Conformity Governance (TDA-06.1) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "IAO-04", "name": "Control Validation Testing (CVT)", "description": "Mechanisms exist to formally assess the security, compliance and resilience controls in Technology Assets, Applications and/or Services (TAAS) through Information Assurance Program (IAP) activities to determine the extent to which the controls are implemented correctly, operating as intended and producing the desired outcome with respect to meeting expected requirements.", "justification": "Control Validation Testing (CVT) (IAO-04) provides periodic assessment and assurance that compensates for the absence of Product Conformity Governance (TDA-06.1) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "TDA-06.2", "risk_if_not_implemented": "Without Continuous Monitoring Plan, malicious, anomalous or unauthorized activity may go undetected or be detected too late to prevent or limit harm. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Lack of oversight of internal controls (R-GV-6), Inability to Demonstrate Due Diligence / Due Care (R-GV-9), and most likely increases susceptibility to Human Error (MT-9).", "compensating_control_1": { "control_id": "IAO-04", "name": "Control Validation Testing (CVT)", "description": "Mechanisms exist to formally assess the security, compliance and resilience controls in Technology Assets, Applications and/or Services (TAAS) through Information Assurance Program (IAP) activities to determine the extent to which the controls are implemented correctly, operating as intended and producing the desired outcome with respect to meeting expected requirements.", "justification": "Control Validation Testing (CVT) (IAO-04) provides periodic assessment and assurance that compensates for the absence of Continuous Monitoring Plan (TDA-06.2) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "TDA-17", "name": "Security, Compliance & Resilience Testing Throughout Development", "description": "Mechanisms exist to require system developers/integrators consult with security, compliance and/or resilience personnel to: \n(1) Create and implement a Security Testing and Evaluation (ST&E) plan, or similar capability;\n(2) Implement a verifiable flaw remediation process to correct weaknesses and deficiencies identified during the control testing and evaluation process; and\n(3) Document the results.", "justification": "Security, Compliance & Resilience Testing Throughout Development (TDA-17) provides periodic assessment and assurance that compensates for the absence of Continuous Monitoring Plan (TDA-06.2) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "TDA-06.3", "risk_if_not_implemented": "Without Ongoing Product Security Support, applications may be built and deployed with exploitable design and coding weaknesses that adversaries can leverage. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Exposure from Unaddressed Vulnerabilities (R-EX-6), and most likely increases susceptibility to Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "PRM-09", "name": "Security, Compliance & Resilience Requirements Definition", "description": "Mechanisms exist to proactively govern Technology Assets, Applications and/or Services (TAAS) by:\n(1) Defining technical security, compliance and resilience requirements; and\n(2) Performing a criticality analysis at predefined decision points in the Secure Development Life Cycle (SDLC).", "justification": "Security, Compliance & Resilience Requirements Definition (PRM-09) provides resilience and recovery capability that compensates for the absence of Ongoing Product Security Support (TDA-06.3) by ensuring the organization can restore operations and data when the primary control is absent. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "RSK-13", "name": "Risk Assessment", "description": "Mechanisms exist to conduct recurring assessments of risk that includes the likelihood and magnitude of harm, from unauthorized access, use, disclosure, disruption, modification or destruction of the organization's Technology Assets, Applications, Services and/or Data (TAASD).", "justification": "Risk Assessment (RSK-13) provides periodic assessment and assurance that compensates for the absence of Ongoing Product Security Support (TDA-06.3) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "TDA-06.4", "risk_if_not_implemented": "Without Integrity Mechanisms for Software / Firmware Updates, embedded and IoT technologies may operate with unknown, insecure or unmonitored configurations, creating exploitable footholds. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Modification / Loss of System Integrity (R-AM-2), Loss of Authenticity / Provenance (R-IP-5), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Technical / Mechanical Failure (MT-10), Cryptographic Compromise / Cryptanalytic Capability Advancement (MT-31).", "compensating_control_1": { "control_id": "RSK-13", "name": "Risk Assessment", "description": "Mechanisms exist to conduct recurring assessments of risk that includes the likelihood and magnitude of harm, from unauthorized access, use, disclosure, disruption, modification or destruction of the organization's Technology Assets, Applications, Services and/or Data (TAASD).", "justification": "Risk Assessment (RSK-13) provides periodic assessment and assurance that compensates for the absence of Integrity Mechanisms for Software / Firmware Updates (TDA-06.4) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "TDA-02", "name": "Technology Development & Acquisition", "description": "Mechanisms exist to facilitate the implementation of tailored development and acquisition strategies, contract tools and procurement methods to meet unique business needs.", "justification": "Technology Development & Acquisition (TDA-02) provides detective monitoring capability that compensates for the absence of Integrity Mechanisms for Software / Firmware Updates (TDA-06.4) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "TDA-06.5", "risk_if_not_implemented": "Without Software Release Integrity Verification, applications may be built and deployed with exploitable design and coding weaknesses that adversaries can leverage. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss of Authenticity / Provenance (R-IP-5), and most likely increases susceptibility to Cryptographic Compromise / Cryptanalytic Capability Advancement (MT-31).", "compensating_control_1": { "control_id": "MON-18.1", "name": "Session Audit", "description": "Mechanisms exist to provide session audit capabilities that can: \n(1) Capture and log all content related to a user session; and\n(2) Remotely view all content related to an established user session in real time.", "justification": "Session Audit (MON-18.1) provides detective monitoring capability that compensates for the absence of Software Release Integrity Verification (TDA-06.5) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "IAC-30", "name": "Least Privilege", "description": "Mechanisms exist to utilize the concept of least privilege, allowing only authorized access to processes necessary to accomplish assigned tasks in accordance with organizational business functions.", "justification": "Least Privilege (IAC-30) provides access control enforcement that compensates for the absence of Software Release Integrity Verification (TDA-06.5) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "TDA-06.6", "risk_if_not_implemented": "Without Information Assurance Enabled Products, executive management, the Board of Directors (BoD) and assessors may rely on inaccurate, incomplete or unverifiable control and risk information. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Regulatory / Legal / Contractual Financial Liability (R-EX-5), Loss of Authorization / Certification / License (R-EX-11), and most likely increases susceptibility to Statutory / Regulatory / Contractual Change (MT-11), Cryptographic Compromise / Cryptanalytic Capability Advancement (MT-31).", "compensating_control_1": { "control_id": "PRM-09", "name": "Security, Compliance & Resilience Requirements Definition", "description": "Mechanisms exist to proactively govern Technology Assets, Applications and/or Services (TAAS) by:\n(1) Defining technical security, compliance and resilience requirements; and\n(2) Performing a criticality analysis at predefined decision points in the Secure Development Life Cycle (SDLC).", "justification": "Security, Compliance & Resilience Requirements Definition (PRM-09) provides resilience and recovery capability that compensates for the absence of Information Assurance Enabled Products (TDA-06.6) by ensuring the organization can restore operations and data when the primary control is absent. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "TDA-11.1", "name": "Minimum Viable Product (MVP) Security Requirements", "description": "Mechanisms exist to design, develop and produce Technology Assets, Applications and/or Services (TAAS) in such a way that risk-based technical and functional specifications ensure Minimum Viable Product (MVP) criteria establish an appropriate level of security and resiliency based on applicable risks and threats.", "justification": "Minimum Viable Product (MVP) Security Requirements (TDA-11.1) provides overlapping security capability that compensates for the absence of Information Assurance Enabled Products (TDA-06.6) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "TDA-07", "risk_if_not_implemented": "Without Disclosure of Vulnerabilities, known and exploitable vulnerabilities may remain unaddressed, giving adversaries readily available entry points. Based on the risk and threat mapping for this control, no risk is rated Likely; risks rated Possible include System / Data Compromise (Technical Vector) (R-BC-4), Contractual Default / Termination (R-EX-2), Reputational Harm / Loss of Stakeholder Trust (R-EX-4), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9).", "compensating_control_1": { "control_id": "RSK-13", "name": "Risk Assessment", "description": "Mechanisms exist to conduct recurring assessments of risk that includes the likelihood and magnitude of harm, from unauthorized access, use, disclosure, disruption, modification or destruction of the organization's Technology Assets, Applications, Services and/or Data (TAASD).", "justification": "Risk Assessment (RSK-13) provides periodic assessment and assurance that compensates for the absence of Disclosure of Vulnerabilities (TDA-07) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "TDA-11.1", "name": "Minimum Viable Product (MVP) Security Requirements", "description": "Mechanisms exist to design, develop and produce Technology Assets, Applications and/or Services (TAAS) in such a way that risk-based technical and functional specifications ensure Minimum Viable Product (MVP) criteria establish an appropriate level of security and resiliency based on applicable risks and threats.", "justification": "Minimum Viable Product (MVP) Security Requirements (TDA-11.1) provides overlapping security capability that compensates for the absence of Disclosure of Vulnerabilities (TDA-07) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "TDA-07.1", "risk_if_not_implemented": "Without Reporting Exploitable Vulnerabilities, known and exploitable vulnerabilities may remain unaddressed, giving adversaries readily available entry points. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Regulatory / Legal / Contractual Financial Liability (R-EX-5), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11).", "compensating_control_1": { "control_id": "TDA-11.1", "name": "Minimum Viable Product (MVP) Security Requirements", "description": "Mechanisms exist to design, develop and produce Technology Assets, Applications and/or Services (TAAS) in such a way that risk-based technical and functional specifications ensure Minimum Viable Product (MVP) criteria establish an appropriate level of security and resiliency based on applicable risks and threats.", "justification": "Minimum Viable Product (MVP) Security Requirements (TDA-11.1) provides overlapping security capability that compensates for the absence of Reporting Exploitable Vulnerabilities (TDA-07.1) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "RSK-13", "name": "Risk Assessment", "description": "Mechanisms exist to conduct recurring assessments of risk that includes the likelihood and magnitude of harm, from unauthorized access, use, disclosure, disruption, modification or destruction of the organization's Technology Assets, Applications, Services and/or Data (TAASD).", "justification": "Risk Assessment (RSK-13) provides periodic assessment and assurance that compensates for the absence of Reporting Exploitable Vulnerabilities (TDA-07.1) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "TDA-08", "risk_if_not_implemented": "Without Technical Documentation Artifacts, applications may be built and deployed with exploitable design and coding weaknesses that adversaries can leverage. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Regulatory / Legal / Contractual Financial Liability (R-EX-5), Loss of Authorization / Certification / License (R-EX-11), Inability to Demonstrate Due Diligence / Due Care (R-GV-9), Unreliable Assurance / Decision Information (R-GV-10), and most likely increases susceptibility to Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11), Data Quality Degradation / Data Poisoning (MT-12), Workforce Shortage / Loss of Critical Skills / Labor Disruption (MT-25).", "compensating_control_1": { "control_id": "GOV-04", "name": "Publishing Security, Compliance & Resilience Documentation", "description": "Mechanisms exist to establish, maintain and disseminate policies, standards and procedures necessary for secure, compliant and resilient capabilities.", "justification": "Publishing Security, Compliance & Resilience Documentation (GOV-04) provides resilience and recovery capability that compensates for the absence of Technical Documentation Artifacts (TDA-08) by ensuring the organization can restore operations and data when the primary control is absent. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CPL-05", "name": "Conformity Monitoring", "description": "Mechanisms exist to validate that Technology Assets, Applications, Services and/or Data (TAASD) conform to the organization's security, compliance and/or resilience policies, standards and other applicable requirements.", "justification": "Conformity Monitoring (CPL-05) provides periodic assessment and assurance that compensates for the absence of Technical Documentation Artifacts (TDA-08) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "TDA-08.1", "risk_if_not_implemented": "Without Product-Specific Risk Assessment Artifacts, risks may remain unidentified, unowned or unmanaged, leaving decision-makers without a defensible basis for prioritization and treatment. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unaddressed Security / Compliance Exposure (R-GV-2), Inability to Demonstrate Due Diligence / Due Care (R-GV-9), Unreliable Assurance / Decision Information (R-GV-10), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Data Quality Degradation / Data Poisoning (MT-12), Workforce Shortage / Loss of Critical Skills / Labor Disruption (MT-25).", "compensating_control_1": { "control_id": "CPL-05", "name": "Conformity Monitoring", "description": "Mechanisms exist to validate that Technology Assets, Applications, Services and/or Data (TAASD) conform to the organization's security, compliance and/or resilience policies, standards and other applicable requirements.", "justification": "Conformity Monitoring (CPL-05) provides periodic assessment and assurance that compensates for the absence of Product-Specific Risk Assessment Artifacts (TDA-08.1) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "GOV-04", "name": "Publishing Security, Compliance & Resilience Documentation", "description": "Mechanisms exist to establish, maintain and disseminate policies, standards and procedures necessary for secure, compliant and resilient capabilities.", "justification": "Publishing Security, Compliance & Resilience Documentation (GOV-04) provides resilience and recovery capability that compensates for the absence of Product-Specific Risk Assessment Artifacts (TDA-08.1) by ensuring the organization can restore operations and data when the primary control is absent. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "TDA-08.2", "risk_if_not_implemented": "Without Functional Properties, applications may be built and deployed with exploitable design and coding weaknesses that adversaries can leverage. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Lack of oversight of internal controls (R-GV-6), Inability to Demonstrate Due Diligence / Due Care (R-GV-9), Unreliable Assurance / Decision Information (R-GV-10), and most likely increases susceptibility to Human Error (MT-9), Data Quality Degradation / Data Poisoning (MT-12), Workforce Shortage / Loss of Critical Skills / Labor Disruption (MT-25).", "compensating_control_1": { "control_id": "CPL-05", "name": "Conformity Monitoring", "description": "Mechanisms exist to validate that Technology Assets, Applications, Services and/or Data (TAASD) conform to the organization's security, compliance and/or resilience policies, standards and other applicable requirements.", "justification": "Conformity Monitoring (CPL-05) provides periodic assessment and assurance that compensates for the absence of Functional Properties (TDA-08.2) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "GOV-04", "name": "Publishing Security, Compliance & Resilience Documentation", "description": "Mechanisms exist to establish, maintain and disseminate policies, standards and procedures necessary for secure, compliant and resilient capabilities.", "justification": "Publishing Security, Compliance & Resilience Documentation (GOV-04) provides resilience and recovery capability that compensates for the absence of Functional Properties (TDA-08.2) by ensuring the organization can restore operations and data when the primary control is absent. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "TDA-08.3", "risk_if_not_implemented": "Without Administrator Documentation, applications may be built and deployed with exploitable design and coding weaknesses that adversaries can leverage. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Exposure from Unaddressed Vulnerabilities (R-EX-6), Loss of Critical Knowledge / Capability (R-PE-1), and most likely increases susceptibility to Human Error (MT-9), Data Quality Degradation / Data Poisoning (MT-12), Workforce Shortage / Loss of Critical Skills / Labor Disruption (MT-25).", "compensating_control_1": { "control_id": "GOV-04", "name": "Publishing Security, Compliance & Resilience Documentation", "description": "Mechanisms exist to establish, maintain and disseminate policies, standards and procedures necessary for secure, compliant and resilient capabilities.", "justification": "Publishing Security, Compliance & Resilience Documentation (GOV-04) provides resilience and recovery capability that compensates for the absence of Documentation Requirements (TDA-08.3) by ensuring the organization can restore operations and data when the primary control is absent. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CPL-05", "name": "Conformity Monitoring", "description": "Mechanisms exist to validate that Technology Assets, Applications, Services and/or Data (TAASD) conform to the organization's security, compliance and/or resilience policies, standards and other applicable requirements.", "justification": "Conformity Monitoring (CPL-05) provides periodic assessment and assurance that compensates for the absence of Documentation Requirements (TDA-08.3) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "TDA-08.4", "risk_if_not_implemented": "Without Identification & Justification of Ports, Protocols & Services, applications may be built and deployed with exploitable design and coding weaknesses that adversaries can leverage. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unaddressed Security / Compliance Exposure (R-GV-2), and most likely increases susceptibility to Human Error (MT-9), Data Quality Degradation / Data Poisoning (MT-12), Workforce Shortage / Loss of Critical Skills / Labor Disruption (MT-25).", "compensating_control_1": { "control_id": "TDA-11.1", "name": "Minimum Viable Product (MVP) Security Requirements", "description": "Mechanisms exist to design, develop and produce Technology Assets, Applications and/or Services (TAAS) in such a way that risk-based technical and functional specifications ensure Minimum Viable Product (MVP) criteria establish an appropriate level of security and resiliency based on applicable risks and threats.", "justification": "Minimum Viable Product (MVP) Security Requirements (TDA-11.1) provides overlapping security capability that compensates for the absence of Identification & Justification of Ports, Protocols & Services (TDA-02.5) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "RSK-13", "name": "Risk Assessment", "description": "Mechanisms exist to conduct recurring assessments of risk that includes the likelihood and magnitude of harm, from unauthorized access, use, disclosure, disruption, modification or destruction of the organization's Technology Assets, Applications, Services and/or Data (TAASD).", "justification": "Risk Assessment (RSK-13) provides periodic assessment and assurance that compensates for the absence of Identification & Justification of Ports, Protocols & Services (TDA-02.5) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "TDA-08.5", "risk_if_not_implemented": "Without Products With Digital Elements, applications may be built and deployed with exploitable design and coding weaknesses that adversaries can leverage. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unaddressed Security / Compliance Exposure (R-GV-2), and most likely increases susceptibility to Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11), Workforce Shortage / Loss of Critical Skills / Labor Disruption (MT-25).", "compensating_control_1": { "control_id": "PRM-09", "name": "Security, Compliance & Resilience Requirements Definition", "description": "Mechanisms exist to proactively govern Technology Assets, Applications and/or Services (TAAS) by:\n(1) Defining technical security, compliance and resilience requirements; and\n(2) Performing a criticality analysis at predefined decision points in the Secure Development Life Cycle (SDLC).", "justification": "Security, Compliance & Resilience Requirements Definition (PRM-09) provides resilience and recovery capability that compensates for the absence of Products With Digital Elements (TDA-08.5) by ensuring the organization can restore operations and data when the primary control is absent. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "TDA-11.1", "name": "Minimum Viable Product (MVP) Security Requirements", "description": "Mechanisms exist to design, develop and produce Technology Assets, Applications and/or Services (TAAS) in such a way that risk-based technical and functional specifications ensure Minimum Viable Product (MVP) criteria establish an appropriate level of security and resiliency based on applicable risks and threats.", "justification": "Minimum Viable Product (MVP) Security Requirements (TDA-11.1) provides overlapping security capability that compensates for the absence of Products With Digital Elements (TDA-08.5) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "TDA-09", "risk_if_not_implemented": "Without Product Tampering and Counterfeiting (PTC), counterfeit, non-conforming or compromised components and services may enter the environment through the supply chain. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Modification / Loss of System Integrity (R-AM-2), Counterfeit / Non-Conforming Component Impact (R-SC-7), Loss of Authenticity / Provenance (R-IP-5), and most likely increases susceptibility to Human Error (MT-9), Fraud, Corruption and/or Intentional Criminal Conduct (MT-14), Counterfeit / Non-Conforming Products (MT-20), Workforce Shortage / Loss of Critical Skills / Labor Disruption (MT-25).", "compensating_control_1": { "control_id": "TPM-21", "name": "Third-Party Incident Response & Recovery Capabilities", "description": "Mechanisms exist to ensure response/recovery planning and testing are conducted with critical suppliers/providers.", "justification": "Third-Party Incident Response & Recovery Capabilities (TPM-21) provides resilience and recovery capability that compensates for the absence of Product Tampering and Counterfeiting (PTC) (TDA-09) by ensuring the organization can restore operations and data when the primary control is absent. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "RSK-20", "name": "Supply Chain Risk Management (SCRM) Plan", "description": "Mechanisms exist to develop a plan for Supply Chain Risk Management (SCRM) associated with the development, acquisition, maintenance and disposal of Technology Assets, Applications and/or Services (TAAS), including documenting selected mitigating actions and monitoring performance against those plans.", "justification": "Supply Chain Risk Management (SCRM) Plan (RSK-20) provides risk identification and prioritization that compensates for the absence of Product Tampering and Counterfeiting (PTC) (TDA-09) by enabling informed decisions about where to focus resources to manage residual exposure. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "TDA-10", "risk_if_not_implemented": "Without Customized Development of Critical Components, applications may be built and deployed with exploitable design and coding weaknesses that adversaries can leverage. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Concentration / Single-Point Dependency Failure (R-OR-2), Third-Party Dependency Failure (R-SC-6), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Workforce Shortage / Loss of Critical Skills / Labor Disruption (MT-25).", "compensating_control_1": { "control_id": "TPM-20", "name": "Foreign Ownership, Control or Influence (FOCI)", "description": "Mechanisms exist to minimize risk associated with Foreign Ownership, Control or Influence (FOCI) through Supply Chain Risk Management (SCRM) practices.", "justification": "Foreign Ownership, Control or Influence (FOCI) (TPM-20) provides overlapping security capability that compensates for the absence of Customized Development of Critical Components (TDA-10) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "RSK-20", "name": "Supply Chain Risk Management (SCRM) Plan", "description": "Mechanisms exist to develop a plan for Supply Chain Risk Management (SCRM) associated with the development, acquisition, maintenance and disposal of Technology Assets, Applications and/or Services (TAAS), including documenting selected mitigating actions and monitoring performance against those plans.", "justification": "Supply Chain Risk Management (SCRM) Plan (RSK-20) provides risk identification and prioritization that compensates for the absence of Customized Development of Critical Components (TDA-10) by enabling informed decisions about where to focus resources to manage residual exposure. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "TDA-11", "risk_if_not_implemented": "Without DevSecOps, applications may be built and deployed with exploitable design and coding weaknesses that adversaries can leverage. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unaddressed Security / Compliance Exposure (R-GV-2), Uncontrolled Internal Security / Privacy Exposure (R-GV-4), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Workforce Shortage / Loss of Critical Skills / Labor Disruption (MT-25).", "compensating_control_1": { "control_id": "SEA-05", "name": "Secure Engineering Principles", "description": "Mechanisms exist to facilitate the implementation of industry-recognized security, compliance and resilience practices in the specification, design, development, implementation and modification of Technology Assets, Applications and/or Services (TAAS).", "justification": "Secure Engineering Principles (SEA-05) provides overlapping security capability that compensates for the absence of DevSecOps (TDA-11) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "TDA-02", "name": "Technology Development & Acquisition", "description": "Mechanisms exist to facilitate the implementation of tailored development and acquisition strategies, contract tools and procurement methods to meet unique business needs.", "justification": "Technology Development & Acquisition (TDA-02) provides detective monitoring capability that compensates for the absence of DevSecOps (TDA-11) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "TDA-11.1", "risk_if_not_implemented": "Without Minimum Viable Product (MVP) Security Requirements, applications may be built and deployed with exploitable design and coding weaknesses that adversaries can leverage. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unaddressed Security / Compliance Exposure (R-GV-2), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Workforce Shortage / Loss of Critical Skills / Labor Disruption (MT-25).", "compensating_control_1": { "control_id": "PRM-09", "name": "Security, Compliance & Resilience Requirements Definition", "description": "Mechanisms exist to proactively govern Technology Assets, Applications and/or Services (TAAS) by:\n(1) Defining technical security, compliance and resilience requirements; and\n(2) Performing a criticality analysis at predefined decision points in the Secure Development Life Cycle (SDLC).", "justification": "Security, Compliance & Resilience Requirements Definition (PRM-09) provides resilience and recovery capability that compensates for the absence of Minimum Viable Product (MVP) Security Requirements (TDA-11.1) by ensuring the organization can restore operations and data when the primary control is absent. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "RSK-13", "name": "Risk Assessment", "description": "Mechanisms exist to conduct recurring assessments of risk that includes the likelihood and magnitude of harm, from unauthorized access, use, disclosure, disruption, modification or destruction of the organization's Technology Assets, Applications, Services and/or Data (TAASD).", "justification": "Risk Assessment (RSK-13) provides periodic assessment and assurance that compensates for the absence of Minimum Viable Product (MVP) Security Requirements (TDA-11.1) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "TDA-11.2", "risk_if_not_implemented": "Without Insecure Ports, Protocols & Services, applications may be built and deployed with exploitable design and coding weaknesses that adversaries can leverage. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Exposure from Unaddressed Vulnerabilities (R-EX-6), Loss of Confidentiality (R-IP-2), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9), Workforce Shortage / Loss of Critical Skills / Labor Disruption (MT-25).", "compensating_control_1": { "control_id": "PRM-09", "name": "Security, Compliance & Resilience Requirements Definition", "description": "Mechanisms exist to proactively govern Technology Assets, Applications and/or Services (TAAS) by:\n(1) Defining technical security, compliance and resilience requirements; and\n(2) Performing a criticality analysis at predefined decision points in the Secure Development Life Cycle (SDLC).", "justification": "Security, Compliance & Resilience Requirements Definition (PRM-09) provides resilience and recovery capability that compensates for the absence of Insecure Ports, Protocols & Services (TDA-11.2) by ensuring the organization can restore operations and data when the primary control is absent. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "TDA-11.1", "name": "Minimum Viable Product (MVP) Security Requirements", "description": "Mechanisms exist to design, develop and produce Technology Assets, Applications and/or Services (TAAS) in such a way that risk-based technical and functional specifications ensure Minimum Viable Product (MVP) criteria establish an appropriate level of security and resiliency based on applicable risks and threats.", "justification": "Minimum Viable Product (MVP) Security Requirements (TDA-11.1) provides overlapping security capability that compensates for the absence of Insecure Ports, Protocols & Services (TDA-11.2) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "TDA-11.3", "risk_if_not_implemented": "Without Commercial Off-The-Shelf (COTS) Security Solutions, applications may be built and deployed with exploitable design and coding weaknesses that adversaries can leverage. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Counterfeit / Non-Conforming Component Impact (R-SC-7), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Counterfeit / Non-Conforming Products (MT-20).", "compensating_control_1": { "control_id": "CPL-02", "name": "Statutory, Regulatory & Contractual Compliance", "description": "Mechanisms exist to facilitate the identification and implementation of relevant statutory, regulatory and contractual controls.", "justification": "Statutory, Regulatory & Contractual Compliance (CPL-02) provides overlapping security capability that compensates for the absence of Commercial Off-The-Shelf (COTS) Security Solutions (TDA-11.3) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "VPM-02", "name": "Vulnerability & Patch Management Program (VPMP)", "description": "Mechanisms exist to facilitate the implementation and monitoring of risk-based vulnerability management capabilities.", "justification": "Vulnerability & Patch Management Program (VPMP) (VPM-02) provides policy-level governance that compensates for the absence of Commercial Off-The-Shelf (COTS) Security Solutions (TDA-11.3) by establishing documented expectations, accountability structures, and organizational guardrails. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "TDA-11.4", "risk_if_not_implemented": "Without Logging Syntax, malicious, anomalous or unauthorized activity may go undetected or be detected too late to prevent or limit harm. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss of Accountability / Attribution (R-AC-1), Loss of Investigative / Evidentiary Capability (R-IR-1), Undetected / Delayed Detection of Adverse Activity (R-SA-1), and most likely increases susceptibility to Human Error (MT-9).", "compensating_control_1": { "control_id": "RSK-13", "name": "Risk Assessment", "description": "Mechanisms exist to conduct recurring assessments of risk that includes the likelihood and magnitude of harm, from unauthorized access, use, disclosure, disruption, modification or destruction of the organization's Technology Assets, Applications, Services and/or Data (TAASD).", "justification": "Risk Assessment (RSK-13) provides periodic assessment and assurance that compensates for the absence of Logging Syntax (TDA-11.4) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "PRM-09", "name": "Security, Compliance & Resilience Requirements Definition", "description": "Mechanisms exist to proactively govern Technology Assets, Applications and/or Services (TAAS) by:\n(1) Defining technical security, compliance and resilience requirements; and\n(2) Performing a criticality analysis at predefined decision points in the Secure Development Life Cycle (SDLC).", "justification": "Security, Compliance & Resilience Requirements Definition (PRM-09) provides resilience and recovery capability that compensates for the absence of Logging Syntax (TDA-11.4) by ensuring the organization can restore operations and data when the primary control is absent. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "TDA-11.5", "risk_if_not_implemented": "Without Physical Diagnostic & Test Interfaces, unauthorized individuals may gain physical access to facilities and equipment, enabling theft, tampering, damage or safety incidents. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Privilege Elevation (R-AC-3), Unauthorized Access (R-AC-4), Unauthorized Modification / Loss of System Integrity (R-AM-2), System / Data Compromise (Non-Technical Vector) (R-BC-5), and most likely increases susceptibility to Physical Crime (MT-5), Human Error (MT-9), Product Defect / Design Failure (MT-23).", "compensating_control_1": { "control_id": "TDA-05", "name": "Secure Software Development Practices (SSDP)", "description": "Mechanisms exist to develop applications based on Secure Software Development Practices (SSDP).", "justification": "Secure Software Development Practices (SSDP) (TDA-05) provides overlapping security capability that compensates for the absence of Physical Diagnostic & Test Interfaces (TDA-11.5) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "SEA-05", "name": "Secure Engineering Principles", "description": "Mechanisms exist to facilitate the implementation of industry-recognized security, compliance and resilience practices in the specification, design, development, implementation and modification of Technology Assets, Applications and/or Services (TAAS).", "justification": "Secure Engineering Principles (SEA-05) provides overlapping security capability that compensates for the absence of Physical Diagnostic & Test Interfaces (TDA-11.5) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "TDA-11.6", "risk_if_not_implemented": "Without Diagnostic & Test Interface Monitoring, malicious, anomalous or unauthorized activity may go undetected or be detected too late to prevent or limit harm. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss of Investigative / Evidentiary Capability (R-IR-1), Undetected / Delayed Detection of Adverse Activity (R-SA-1), and most likely increases susceptibility to Physical Crime (MT-5), Human Error (MT-9).", "compensating_control_1": { "control_id": "SEA-05", "name": "Secure Engineering Principles", "description": "Mechanisms exist to facilitate the implementation of industry-recognized security, compliance and resilience practices in the specification, design, development, implementation and modification of Technology Assets, Applications and/or Services (TAAS).", "justification": "Secure Engineering Principles (SEA-05) provides overlapping security capability that compensates for the absence of Diagnostic & Test Interface Monitoring (TDA-11.6) by addressing related risk objectives through an alternative control mechanism aligned with Technology applicability. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "TDA-04", "name": "Developer Architecture & Design", "description": "Mechanisms exist to require the developers of Technology Assets, Applications and/or Services (TAAS) to produce a design specification and security architecture that: \n(1) Is consistent with and supportive of the organization's security architecture which is established within and is an integrated part of the organization's enterprise architecture;\n(2) Accurately and completely describes the required security functionality and the allocation of security, compliance and resilience controls among physical and logical components; and\n(3) Expresses how individual security functions, mechanisms and services work together to provide required security capabilities and a unified approach to protection.", "justification": "Developer Architecture & Design (TDA-04) provides overlapping security capability that compensates for the absence of Diagnostic & Test Interface Monitoring (TDA-11.6) by addressing related risk objectives through an alternative control mechanism aligned with Technology applicability. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "TDA-12", "risk_if_not_implemented": "Without Input Data Validation, applications may be built and deployed with exploitable design and coding weaknesses that adversaries can leverage. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Modification / Loss of System Integrity (R-AM-2), System / Data Compromise (Technical Vector) (R-BC-4), System / Service Compromise (R-EX-7), Loss of Data Integrity (R-IP-3), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9), Data Quality Degradation / Data Poisoning (MT-12).", "compensating_control_1": { "control_id": "CFG-04", "name": "Secure Baseline Configurations", "description": "Mechanisms exist to develop, document and maintain secure baseline configurations for Technology Assets, Applications and/or Services (TAAS) that are consistent with industry-accepted hardening standards.", "justification": "Secure Baseline Configurations (CFG-04) provides configuration hardening that compensates for the absence of Input Data Validation (TDA-12) by eliminating unnecessary services and enforcing secure settings to reduce inherent exposure. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "TDA-05", "name": "Secure Software Development Practices (SSDP)", "description": "Mechanisms exist to develop applications based on Secure Software Development Practices (SSDP).", "justification": "Secure Software Development Practices (SSDP) (TDA-05) provides overlapping security capability that compensates for the absence of Input Data Validation (TDA-12) by addressing related risk objectives through an alternative control mechanism aligned with Technology applicability. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "TDA-12.1", "risk_if_not_implemented": "Without Error Handling, applications may be built and deployed with exploitable design and coding weaknesses that adversaries can leverage. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss of Confidentiality (R-IP-2), and most likely increases susceptibility to Human Error (MT-9).", "compensating_control_1": { "control_id": "TDA-05", "name": "Secure Software Development Practices (SSDP)", "description": "Mechanisms exist to develop applications based on Secure Software Development Practices (SSDP).", "justification": "Secure Software Development Practices (SSDP) (TDA-05) provides overlapping security capability that compensates for the absence of Error Handling (TDA-12.1) by addressing related risk objectives through an alternative control mechanism aligned with Technology applicability. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CFG-04", "name": "Secure Baseline Configurations", "description": "Mechanisms exist to develop, document and maintain secure baseline configurations for Technology Assets, Applications and/or Services (TAAS) that are consistent with industry-accepted hardening standards.", "justification": "Secure Baseline Configurations (CFG-04) provides configuration hardening that compensates for the absence of Error Handling (TDA-12.1) by eliminating unnecessary services and enforcing secure settings to reduce inherent exposure. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "TDA-12.2", "risk_if_not_implemented": "Without Designated Roles To View Error Messages, applications may be built and deployed with exploitable design and coding weaknesses that adversaries can leverage. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss of Confidentiality (R-IP-2), and most likely increases susceptibility to Human Error (MT-9).", "compensating_control_1": { "control_id": "IAC-30", "name": "Least Privilege", "description": "Mechanisms exist to utilize the concept of least privilege, allowing only authorized access to processes necessary to accomplish assigned tasks in accordance with organizational business functions.", "justification": "Least Privilege (IAC-30) provides access control enforcement that compensates for the absence of Designated Roles To View Error Messages (TDA-12.2) by restricting system and data access through alternative identity and access management mechanisms. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "SEA-18", "name": "Information Output Filtering", "description": "Mechanisms exist to validate information output from software programs and/or applications to ensure that the information is consistent with the expected content.", "justification": "Information Output Filtering (SEA-18) provides overlapping security capability that compensates for the absence of Designated Roles To View Error Messages (TDA-12.2) by addressing related risk objectives through an alternative control mechanism. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "TDA-13", "risk_if_not_implemented": "Without Minimizing Attack Surfaces, known and exploitable vulnerabilities may remain unaddressed, giving adversaries readily available entry points. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to System / Data Compromise (Technical Vector) (R-BC-4), Exposure from Unaddressed Vulnerabilities (R-EX-6), System / Service Compromise (R-EX-7), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9).", "compensating_control_1": { "control_id": "RSK-13", "name": "Risk Assessment", "description": "Mechanisms exist to conduct recurring assessments of risk that includes the likelihood and magnitude of harm, from unauthorized access, use, disclosure, disruption, modification or destruction of the organization's Technology Assets, Applications, Services and/or Data (TAASD).", "justification": "Risk Assessment (RSK-13) provides periodic assessment and assurance that compensates for the absence of Minimizing Attack Surfaces (TDA-13) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "PRM-09", "name": "Security, Compliance & Resilience Requirements Definition", "description": "Mechanisms exist to proactively govern Technology Assets, Applications and/or Services (TAAS) by:\n(1) Defining technical security, compliance and resilience requirements; and\n(2) Performing a criticality analysis at predefined decision points in the Secure Development Life Cycle (SDLC).", "justification": "Security, Compliance & Resilience Requirements Definition (PRM-09) provides resilience and recovery capability that compensates for the absence of Minimizing Attack Surfaces (TDA-13) by ensuring the organization can restore operations and data when the primary control is absent. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "TDA-13.1", "risk_if_not_implemented": "Without Pre-Established Secure Configurations, Technology Assets, Applications and/or Services (TAAS) may operate with insecure, unauthorized or drifted configurations that expand the attack surface. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Exposure from Unaddressed Vulnerabilities (R-EX-6), Uncontrolled Third-Party Security / Privacy Exposure (R-GV-5), and most likely increases susceptibility to Human Error (MT-9), Product Defect / Design Failure (MT-23).", "compensating_control_1": { "control_id": "RSK-13", "name": "Risk Assessment", "description": "Mechanisms exist to conduct recurring assessments of risk that includes the likelihood and magnitude of harm, from unauthorized access, use, disclosure, disruption, modification or destruction of the organization's Technology Assets, Applications, Services and/or Data (TAASD).", "justification": "Risk Assessment (RSK-13) provides periodic assessment and assurance that compensates for the absence of Pre-Established Secure Configurations (TDA-13.1) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "TDA-11.1", "name": "Minimum Viable Product (MVP) Security Requirements", "description": "Mechanisms exist to design, develop and produce Technology Assets, Applications and/or Services (TAAS) in such a way that risk-based technical and functional specifications ensure Minimum Viable Product (MVP) criteria establish an appropriate level of security and resiliency based on applicable risks and threats.", "justification": "Minimum Viable Product (MVP) Security Requirements (TDA-11.1) provides overlapping security capability that compensates for the absence of Pre-Established Secure Configurations (TDA-13.1) by addressing related risk objectives through an alternative control mechanism aligned with Technology applicability. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "TDA-13.2", "risk_if_not_implemented": "Without Malware Testing Prior to Release, applications may be built and deployed with exploitable design and coding weaknesses that adversaries can leverage. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Modification / Loss of System Integrity (R-AM-2), System / Data Compromise (Technical Vector) (R-BC-4), System / Service Compromise (R-EX-7), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9).", "compensating_control_1": { "control_id": "TDA-02", "name": "Technology Development & Acquisition", "description": "Mechanisms exist to facilitate the implementation of tailored development and acquisition strategies, contract tools and procurement methods to meet unique business needs.", "justification": "Technology Development & Acquisition (TDA-02) provides detective monitoring capability that compensates for the absence of Malware Testing Prior to Release (TDA-13.2) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "SEA-05", "name": "Secure Engineering Principles", "description": "Mechanisms exist to facilitate the implementation of industry-recognized security, compliance and resilience practices in the specification, design, development, implementation and modification of Technology Assets, Applications and/or Services (TAAS).", "justification": "Secure Engineering Principles (SEA-05) provides overlapping security capability that compensates for the absence of Malware Testing Prior to Release (TDA-13.2) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "TDA-14", "risk_if_not_implemented": "Without Product Testing & Reviews, applications may be built and deployed with exploitable design and coding weaknesses that adversaries can leverage. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Lack of oversight of internal controls (R-GV-6), Inability to Demonstrate Due Diligence / Due Care (R-GV-9), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Workforce Shortage / Loss of Critical Skills / Labor Disruption (MT-25).", "compensating_control_1": { "control_id": "TDA-11.1", "name": "Minimum Viable Product (MVP) Security Requirements", "description": "Mechanisms exist to design, develop and produce Technology Assets, Applications and/or Services (TAAS) in such a way that risk-based technical and functional specifications ensure Minimum Viable Product (MVP) criteria establish an appropriate level of security and resiliency based on applicable risks and threats.", "justification": "Minimum Viable Product (MVP) Security Requirements (TDA-11.1) provides overlapping security capability that compensates for the absence of Product Testing & Reviews (TDA-14) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "PRM-09", "name": "Security, Compliance & Resilience Requirements Definition", "description": "Mechanisms exist to proactively govern Technology Assets, Applications and/or Services (TAAS) by:\n(1) Defining technical security, compliance and resilience requirements; and\n(2) Performing a criticality analysis at predefined decision points in the Secure Development Life Cycle (SDLC).", "justification": "Security, Compliance & Resilience Requirements Definition (PRM-09) provides resilience and recovery capability that compensates for the absence of Product Testing & Reviews (TDA-14) by ensuring the organization can restore operations and data when the primary control is absent. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "TDA-15", "risk_if_not_implemented": "Without Secure Development Environments, applications may be built and deployed with exploitable design and coding weaknesses that adversaries can leverage. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Access (R-AC-4), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "IAC-30", "name": "Least Privilege", "description": "Mechanisms exist to utilize the concept of least privilege, allowing only authorized access to processes necessary to accomplish assigned tasks in accordance with organizational business functions.", "justification": "Least Privilege (IAC-30) provides access control enforcement that compensates for the absence of Secure Development Environments (TDA-15) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CFG-04", "name": "Secure Baseline Configurations", "description": "Mechanisms exist to develop, document and maintain secure baseline configurations for Technology Assets, Applications and/or Services (TAAS) that are consistent with industry-accepted hardening standards.", "justification": "Secure Baseline Configurations (CFG-04) provides configuration hardening that compensates for the absence of Secure Development Environments (TDA-15) by eliminating unnecessary services and enforcing secure settings to reduce inherent exposure. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "TDA-15.2", "risk_if_not_implemented": "Without Secure Migration Practices, applications may be built and deployed with exploitable design and coding weaknesses that adversaries can leverage. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Access (R-AC-4), Unauthorized Retention / Inability to Dispose of Data (R-AM-3), and most likely increases susceptibility to Human Error (MT-9).", "compensating_control_1": { "control_id": "CFG-04", "name": "Secure Baseline Configurations", "description": "Mechanisms exist to develop, document and maintain secure baseline configurations for Technology Assets, Applications and/or Services (TAAS) that are consistent with industry-accepted hardening standards.", "justification": "Secure Baseline Configurations (CFG-04) provides configuration hardening that compensates for the absence of Secure Migration Practices (TDA-15.2) by eliminating unnecessary services and enforcing secure settings to reduce inherent exposure. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "NET-06", "name": "Network Segmentation (macrosegmentation)", "description": "Mechanisms exist to implement network segmentation within network architectures to isolate Technology Assets, Applications and/or Services (TAAS) from other network resources.", "justification": "Network Segmentation (macrosegmentation) (NET-06) provides network-level access restriction that compensates for the absence of Secure Migration Practices (TDA-15.2) by limiting attacker reach and lateral movement opportunities across the environment. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "TDA-16", "risk_if_not_implemented": "Without Library Privileges, users, services and processes may obtain or retain access beyond authorized need, enabling misuse or escalation. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Excessive or Unauthorized Privilege (R-AC-2), Unauthorized Access (R-AC-4), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Technical / Mechanical Failure (MT-10), Fraud, Corruption and/or Intentional Criminal Conduct (MT-14).", "compensating_control_1": { "control_id": "IAC-30", "name": "Least Privilege", "description": "Mechanisms exist to utilize the concept of least privilege, allowing only authorized access to processes necessary to accomplish assigned tasks in accordance with organizational business functions.", "justification": "Least Privilege (IAC-30) provides access control enforcement that compensates for the absence of Library Privileges (TDA-16) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "HRS-14", "name": "Separation of Duties (SoD)", "description": "Mechanisms exist to implement and maintain Separation of Duties (SoD) to prevent potential inappropriate activity without collusion.", "justification": "Separation of Duties (SoD) (HRS-14) provides overlapping security capability that compensates for the absence of Library Privileges (TDA-16) by addressing related risk objectives through an alternative control mechanism aligned with Technology applicability. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "TDA-16.1", "risk_if_not_implemented": "Without Access to Program Source Code, applications may be built and deployed with exploitable design and coding weaknesses that adversaries can leverage. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Excessive or Unauthorized Privilege (R-AC-2), Unauthorized Modification / Loss of System Integrity (R-AM-2), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Technical / Mechanical Failure (MT-10), Fraud, Corruption and/or Intentional Criminal Conduct (MT-14).", "compensating_control_1": { "control_id": "IAC-30", "name": "Least Privilege", "description": "Mechanisms exist to utilize the concept of least privilege, allowing only authorized access to processes necessary to accomplish assigned tasks in accordance with organizational business functions.", "justification": "Least Privilege (IAC-30) provides access control enforcement that compensates for the absence of Access to Program Source Code (TDA-16.1) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "MON-18.1", "name": "Session Audit", "description": "Mechanisms exist to provide session audit capabilities that can: \n(1) Capture and log all content related to a user session; and\n(2) Remotely view all content related to an established user session in real time.", "justification": "Session Audit (MON-18.1) provides detective monitoring capability that compensates for the absence of Access to Program Source Code (TDA-16.1) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "TDA-16.2", "risk_if_not_implemented": "Without Approved Code, applications may be built and deployed with exploitable design and coding weaknesses that adversaries can leverage. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Modification / Loss of System Integrity (R-AM-2), Loss of Authenticity / Provenance (R-IP-5), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Dysfunctional Management Practices (MT-8), Human Error (MT-9), Fraud, Corruption and/or Intentional Criminal Conduct (MT-14).", "compensating_control_1": { "control_id": "MON-18.1", "name": "Session Audit", "description": "Mechanisms exist to provide session audit capabilities that can: \n(1) Capture and log all content related to a user session; and\n(2) Remotely view all content related to an established user session in real time.", "justification": "Session Audit (MON-18.1) provides detective monitoring capability that compensates for the absence of Approved Code (TDA-16.2) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "TDA-16.1", "name": "Access to Program Source Code", "description": "Mechanisms exist to limit privileges to change software resident within software libraries.", "justification": "Access to Program Source Code (TDA-16.1) provides policy-level governance that compensates for the absence of Approved Code (TDA-16.2) by establishing documented expectations, accountability structures, and organizational guardrails. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "TDA-16.3", "risk_if_not_implemented": "Without Archiving Software Releases, data, software and system images cannot be reliably restored within required recovery objectives following a disruption. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss of Authenticity / Provenance (R-IP-5), and most likely increases susceptibility to Human Error (MT-9), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "IAC-30", "name": "Least Privilege", "description": "Mechanisms exist to utilize the concept of least privilege, allowing only authorized access to processes necessary to accomplish assigned tasks in accordance with organizational business functions.", "justification": "Least Privilege (IAC-30) provides access control enforcement that compensates for the absence of Archiving Software Releases (TDA-16.3) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "TDA-16.1", "name": "Access to Program Source Code", "description": "Mechanisms exist to limit privileges to change software resident within software libraries.", "justification": "Access to Program Source Code (TDA-16.1) provides policy-level governance that compensates for the absence of Archiving Software Releases (TDA-16.3) by establishing documented expectations, accountability structures, and organizational guardrails. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "TDA-16.4", "risk_if_not_implemented": "Without Software Escrow, applications may be built and deployed with exploitable design and coding weaknesses that adversaries can leverage. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Concentration / Single-Point Dependency Failure (R-OR-2), Third-Party Dependency Failure (R-SC-6), and most likely increases susceptibility to Supplier Financial Distress / Insolvency (MT-24).", "compensating_control_1": { "control_id": "TDA-16.1", "name": "Access to Program Source Code", "description": "Mechanisms exist to limit privileges to change software resident within software libraries.", "justification": "Access to Program Source Code (TDA-16.1) provides policy-level governance that compensates for the absence of Software Escrow (TDA-16.4) by establishing documented expectations, accountability structures, and organizational guardrails. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "IAC-30", "name": "Least Privilege", "description": "Mechanisms exist to utilize the concept of least privilege, allowing only authorized access to processes necessary to accomplish assigned tasks in accordance with organizational business functions.", "justification": "Least Privilege (IAC-30) provides access control enforcement that compensates for the absence of Software Escrow (TDA-16.4) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "TDA-17", "risk_if_not_implemented": "Without Security, Compliance & Resilience Testing Throughout Development, applications may be built and deployed with exploitable design and coding weaknesses that adversaries can leverage. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Exposure from Unaddressed Vulnerabilities (R-EX-6), Inability to Demonstrate Due Diligence / Due Care (R-GV-9), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Workforce Shortage / Loss of Critical Skills / Labor Disruption (MT-25).", "compensating_control_1": { "control_id": "CPL-05", "name": "Conformity Monitoring", "description": "Mechanisms exist to validate that Technology Assets, Applications, Services and/or Data (TAASD) conform to the organization's security, compliance and/or resilience policies, standards and other applicable requirements.", "justification": "Conformity Monitoring (CPL-05) provides periodic assessment and assurance that compensates for the absence of Security, Compliance & Resilience Testing Throughout Development (TDA-17) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "IAO-04", "name": "Control Validation Testing (CVT)", "description": "Mechanisms exist to formally assess the security, compliance and resilience controls in Technology Assets, Applications and/or Services (TAAS) through Information Assurance Program (IAP) activities to determine the extent to which the controls are implemented correctly, operating as intended and producing the desired outcome with respect to meeting expected requirements.", "justification": "Control Validation Testing (CVT) (IAO-04) provides periodic assessment and assurance that compensates for the absence of Security, Compliance & Resilience Testing Throughout Development (TDA-17) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "TDA-17.1", "risk_if_not_implemented": "Without Static Code Analysis, applications may be built and deployed with exploitable design and coding weaknesses that adversaries can leverage. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Exposure from Unaddressed Vulnerabilities (R-EX-6), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "CPL-05", "name": "Conformity Monitoring", "description": "Mechanisms exist to validate that Technology Assets, Applications, Services and/or Data (TAASD) conform to the organization's security, compliance and/or resilience policies, standards and other applicable requirements.", "justification": "Conformity Monitoring (CPL-05) provides periodic assessment and assurance that compensates for the absence of Static Code Analysis (TDA-17.1) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "TDA-17", "name": "Security, Compliance & Resilience Testing Throughout Development", "description": "Mechanisms exist to require system developers/integrators consult with security, compliance and/or resilience personnel to: \n(1) Create and implement a Security Testing and Evaluation (ST&E) plan, or similar capability;\n(2) Implement a verifiable flaw remediation process to correct weaknesses and deficiencies identified during the control testing and evaluation process; and\n(3) Document the results.", "justification": "Security, Compliance & Resilience Testing Throughout Development (TDA-17) provides periodic assessment and assurance that compensates for the absence of Static Code Analysis (TDA-17.1) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "TDA-17.2", "risk_if_not_implemented": "Without Dynamic Code Analysis, applications may be built and deployed with exploitable design and coding weaknesses that adversaries can leverage. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Exposure from Unaddressed Vulnerabilities (R-EX-6), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "TDA-17", "name": "Security, Compliance & Resilience Testing Throughout Development", "description": "Mechanisms exist to require system developers/integrators consult with security, compliance and/or resilience personnel to: \n(1) Create and implement a Security Testing and Evaluation (ST&E) plan, or similar capability;\n(2) Implement a verifiable flaw remediation process to correct weaknesses and deficiencies identified during the control testing and evaluation process; and\n(3) Document the results.", "justification": "Security, Compliance & Resilience Testing Throughout Development (TDA-17) provides periodic assessment and assurance that compensates for the absence of Dynamic Code Analysis (TDA-17.2) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CPL-05", "name": "Conformity Monitoring", "description": "Mechanisms exist to validate that Technology Assets, Applications, Services and/or Data (TAASD) conform to the organization's security, compliance and/or resilience policies, standards and other applicable requirements.", "justification": "Conformity Monitoring (CPL-05) provides periodic assessment and assurance that compensates for the absence of Dynamic Code Analysis (TDA-17.2) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "TDA-17.3", "risk_if_not_implemented": "Without Malformed Input Testing, applications may be built and deployed with exploitable design and coding weaknesses that adversaries can leverage. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Exposure from Unaddressed Vulnerabilities (R-EX-6), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "IAO-04", "name": "Control Validation Testing (CVT)", "description": "Mechanisms exist to formally assess the security, compliance and resilience controls in Technology Assets, Applications and/or Services (TAAS) through Information Assurance Program (IAP) activities to determine the extent to which the controls are implemented correctly, operating as intended and producing the desired outcome with respect to meeting expected requirements.", "justification": "Control Validation Testing (CVT) (IAO-04) provides periodic assessment and assurance that compensates for the absence of Malformed Input Testing (TDA-17.3) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CPL-05", "name": "Conformity Monitoring", "description": "Mechanisms exist to validate that Technology Assets, Applications, Services and/or Data (TAASD) conform to the organization's security, compliance and/or resilience policies, standards and other applicable requirements.", "justification": "Conformity Monitoring (CPL-05) provides periodic assessment and assurance that compensates for the absence of Malformed Input Testing (TDA-17.3) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "TDA-17.4", "risk_if_not_implemented": "Without Application Penetration Testing, known and exploitable vulnerabilities may remain unaddressed, giving adversaries readily available entry points. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Exposure from Unaddressed Vulnerabilities (R-EX-6), and most likely increases susceptibility to Human Error (MT-9), Workforce Shortage / Loss of Critical Skills / Labor Disruption (MT-25).", "compensating_control_1": { "control_id": "CPL-05", "name": "Conformity Monitoring", "description": "Mechanisms exist to validate that Technology Assets, Applications, Services and/or Data (TAASD) conform to the organization's security, compliance and/or resilience policies, standards and other applicable requirements.", "justification": "Conformity Monitoring (CPL-05) provides periodic assessment and assurance that compensates for the absence of Application Penetration Testing (TDA-17.4) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "IAO-04", "name": "Control Validation Testing (CVT)", "description": "Mechanisms exist to formally assess the security, compliance and resilience controls in Technology Assets, Applications and/or Services (TAAS) through Information Assurance Program (IAP) activities to determine the extent to which the controls are implemented correctly, operating as intended and producing the desired outcome with respect to meeting expected requirements.", "justification": "Control Validation Testing (CVT) (IAO-04) provides periodic assessment and assurance that compensates for the absence of Application Penetration Testing (TDA-17.4) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "TDA-17.5", "risk_if_not_implemented": "Without Manual Code Review, applications may be built and deployed with exploitable design and coding weaknesses that adversaries can leverage. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Exposure from Unaddressed Vulnerabilities (R-EX-6), and most likely increases susceptibility to Human Error (MT-9), Workforce Shortage / Loss of Critical Skills / Labor Disruption (MT-25).", "compensating_control_1": { "control_id": "IAO-04", "name": "Control Validation Testing (CVT)", "description": "Mechanisms exist to formally assess the security, compliance and resilience controls in Technology Assets, Applications and/or Services (TAAS) through Information Assurance Program (IAP) activities to determine the extent to which the controls are implemented correctly, operating as intended and producing the desired outcome with respect to meeting expected requirements.", "justification": "Control Validation Testing (CVT) (IAO-04) provides periodic assessment and assurance that compensates for the absence of Manual Code Review (TDA-17.5) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "TDA-17", "name": "Security, Compliance & Resilience Testing Throughout Development", "description": "Mechanisms exist to require system developers/integrators consult with security, compliance and/or resilience personnel to: \n(1) Create and implement a Security Testing and Evaluation (ST&E) plan, or similar capability;\n(2) Implement a verifiable flaw remediation process to correct weaknesses and deficiencies identified during the control testing and evaluation process; and\n(3) Document the results.", "justification": "Security, Compliance & Resilience Testing Throughout Development (TDA-17) provides periodic assessment and assurance that compensates for the absence of Manual Code Review (TDA-17.5) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "TDA-18", "risk_if_not_implemented": "Without Use of Live Data, applications may be built and deployed with exploitable design and coding weaknesses that adversaries can leverage. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Access (R-AC-4), Loss of Confidentiality (R-IP-2), Privacy Harm / Unauthorized Processing (R-IP-6), and most likely increases susceptibility to Human Error (MT-9).", "compensating_control_1": { "control_id": "DCH-36", "name": "De-Identification (Anonymization)", "description": "Mechanisms exist to de-identify sensitive and/or regulated data through\n(1) Anonymization;\n(2) De-identification;\n(3) Pseudonymization; and/or\n(4) Redaction.", "justification": "De-Identification (Anonymization) (DCH-36) provides overlapping security capability that compensates for the absence of Use of Live Data (TDA-18) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "DCH-02", "name": "Data Protection", "description": "Mechanisms exist to facilitate the implementation of data protection controls.", "justification": "Data Protection (DCH-02) provides overlapping security capability that compensates for the absence of Use of Live Data (TDA-18) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "TDA-18.1", "risk_if_not_implemented": "Without Test Data Integrity, inaccurate, stale, corrupted or manipulated data may drive flawed decisions and control failures. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Data Loss / Integrity Compromise (R-BC-2), Loss of Data Integrity (R-IP-3), and most likely increases susceptibility to Human Error (MT-9), Technical / Mechanical Failure (MT-10), Data Quality Degradation / Data Poisoning (MT-12).", "compensating_control_1": { "control_id": "DCH-02", "name": "Data Protection", "description": "Mechanisms exist to facilitate the implementation of data protection controls.", "justification": "Data Protection (DCH-02) provides overlapping security capability that compensates for the absence of Test Data Integrity (TDA-18.1) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "DCH-36", "name": "De-Identification (Anonymization)", "description": "Mechanisms exist to de-identify sensitive and/or regulated data through\n(1) Anonymization;\n(2) De-identification;\n(3) Pseudonymization; and/or\n(4) Redaction.", "justification": "De-Identification (Anonymization) (DCH-36) provides overlapping security capability that compensates for the absence of Test Data Integrity (TDA-18.1) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "TDA-19", "risk_if_not_implemented": "Without Developer Screening, applications may be built and deployed with exploitable design and coding weaknesses that adversaries can leverage. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Excessive or Unauthorized Privilege (R-AC-2), Unauthorized Access (R-AC-4), Loss of Critical Knowledge / Capability (R-PE-1), and most likely increases susceptibility to Human Error (MT-9), Workforce Shortage / Loss of Critical Skills / Labor Disruption (MT-25).", "compensating_control_1": { "control_id": "HRS-05", "name": "Personnel Screening", "description": "Mechanisms exist to manage personnel security risk by screening individuals prior to authorizing access.", "justification": "Personnel Screening (HRS-05) provides overlapping security capability that compensates for the absence of Developer Screening (TDA-19) by addressing related risk objectives through an alternative control mechanism aligned with People applicability. Given the people-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "TPM-13", "name": "Third-Party Personnel Security", "description": "Mechanisms exist to control personnel security requirements including security roles and responsibilities for third-party providers.", "justification": "Third-Party Personnel Security (TPM-13) provides third-party oversight that compensates for the absence of Developer Screening (TDA-19) by extending security obligations contractually and monitoring third-party risk in lieu of direct control. Given the people-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "TDA-19.1", "risk_if_not_implemented": "Without Developer Knowledge & Skills Register, essential knowledge and skills may be unavailable when needed, degrading the organization's ability to operate and protect itself. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Inability to Demonstrate Due Diligence / Due Care (R-GV-9), Unreliable Assurance / Decision Information (R-GV-10), and most likely increases susceptibility to Human Error (MT-9), Data Quality Degradation / Data Poisoning (MT-12).", "compensating_control_1": { "control_id": "HRS-16", "name": "Identify Critical Skills & Gaps", "description": "Mechanisms exist to evaluate the critical security, compliance and resilience skills needed to support the organization's mission and identify gaps that exist.", "justification": "Identify Critical Skills & Gaps (HRS-16) provides overlapping security capability that compensates for the absence of Developer Knowledge & Skills Register (TDA-19.1) by addressing related risk objectives through an alternative control mechanism. Given the people-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "SAT-05", "name": "Role-Based Security, Compliance & Resilience Training", "description": "Mechanisms exist to provide role-based security, compliance and resilience-related training: \n(1) Before authorizing access to the system or performing assigned duties; \n(2) When required by system changes; and \n(3) Annually thereafter.", "justification": "Role-Based Security, Compliance & Resilience Training (SAT-05) provides personnel training and awareness that compensates for the absence of Developer Knowledge & Skills Register (TDA-19.1) by equipping personnel with the knowledge and skills needed to recognize and respond to relevant threats. Given the people-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "TDA-19.2", "risk_if_not_implemented": "Without Requisite Developer Training, personnel are more likely to make unsafe decisions, fall victim to social engineering, mishandle data or violate requirements. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Lack of a security-minded workforce (R-SA-2), Loss of Critical Knowledge / Capability (R-PE-1), and most likely increases susceptibility to Human Error (MT-9), Workforce Shortage / Loss of Critical Skills / Labor Disruption (MT-25).", "compensating_control_1": { "control_id": "SAT-05", "name": "Role-Based Security, Compliance & Resilience Training", "description": "Mechanisms exist to provide role-based security, compliance and resilience-related training: \n(1) Before authorizing access to the system or performing assigned duties; \n(2) When required by system changes; and \n(3) Annually thereafter.", "justification": "Role-Based Security, Compliance & Resilience Training (SAT-05) provides personnel training and awareness that compensates for the absence of Developer Training (TDA-19.2) by equipping personnel with the knowledge and skills needed to recognize and respond to relevant threats. Given the people-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "TDA-05", "name": "Secure Software Development Practices (SSDP)", "description": "Mechanisms exist to develop applications based on Secure Software Development Practices (SSDP).", "justification": "Secure Software Development Practices (SSDP) (TDA-05) provides overlapping security capability that compensates for the absence of Developer Training (TDA-19.2) by addressing related risk objectives through an alternative control mechanism. Given the people-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "TDA-20", "risk_if_not_implemented": "Without Developer Configuration Management, Technology Assets, Applications and/or Services (TAAS) may operate with insecure, unauthorized or drifted configurations that expand the attack surface. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Modification / Loss of System Integrity (R-AM-2), and most likely increases susceptibility to Human Error (MT-9).", "compensating_control_1": { "control_id": "CFG-02", "name": "Configuration Management Program", "description": "Mechanisms exist to facilitate the implementation of configuration management controls.", "justification": "Configuration Management Program (CFG-02) provides policy-level governance that compensates for the absence of Developer Configuration Management (TDA-20) by establishing documented expectations, accountability structures, and organizational guardrails. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CHG-03", "name": "Configuration Change Control", "description": "Mechanisms exist to govern the technical configuration change control processes.", "justification": "Configuration Change Control (CHG-03) provides configuration hardening that compensates for the absence of Developer Configuration Management (TDA-20) by eliminating unnecessary services and enforcing secure settings to reduce inherent exposure. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "TDA-20.1", "risk_if_not_implemented": "Without Developer Threat Analysis & Flaw Remediation, the organization's understanding of the threat environment may become stale, leaving defenses misaligned with active adversary tactics. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Exposure from Unaddressed Vulnerabilities (R-EX-6), and most likely increases susceptibility to Human Error (MT-9), Workforce Shortage / Loss of Critical Skills / Labor Disruption (MT-25).", "compensating_control_1": { "control_id": "VPM-06", "name": "Vulnerability Remediation Process", "description": "Mechanisms exist to ensure that vulnerabilities are properly identified, tracked and remediated.", "justification": "Vulnerability Remediation Process (VPM-06) provides vulnerability management that compensates for the absence of Developer Threat Analysis & Flaw Remediation (TDA-20.1) by reducing the exploitable attack surface by addressing known weaknesses before they are leveraged. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "TDA-05", "name": "Secure Software Development Practices (SSDP)", "description": "Mechanisms exist to develop applications based on Secure Software Development Practices (SSDP).", "justification": "Secure Software Development Practices (SSDP) (TDA-05) provides overlapping security capability that compensates for the absence of Developer Threat Analysis & Flaw Remediation (TDA-20.1) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "TDA-20.2", "risk_if_not_implemented": "Without Developer-Provided Training, personnel are more likely to make unsafe decisions, fall victim to social engineering, mishandle data or violate requirements. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Harm from Unauthorized / Unintended Product or Service Use (R-SC-5), and most likely increases susceptibility to Human Error (MT-9), Supplier Financial Distress / Insolvency (MT-24).", "compensating_control_1": { "control_id": "SAT-05", "name": "Role-Based Security, Compliance & Resilience Training", "description": "Mechanisms exist to provide role-based security, compliance and resilience-related training: \n(1) Before authorizing access to the system or performing assigned duties; \n(2) When required by system changes; and \n(3) Annually thereafter.", "justification": "Role-Based Security, Compliance & Resilience Training (SAT-05) provides personnel training and awareness that compensates for the absence of Developer-Provided Training (TDA-20.2) by reducing human-factor risk by equipping personnel to recognize and respond to relevant threats. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "TDA-05", "name": "Secure Software Development Practices (SSDP)", "description": "Mechanisms exist to develop applications based on Secure Software Development Practices (SSDP).", "justification": "Secure Software Development Practices (SSDP) (TDA-05) provides overlapping security capability that compensates for the absence of Developer-Provided Training (TDA-20.2) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "TDA-20.3", "risk_if_not_implemented": "Without Software / Firmware Integrity Verification, embedded and IoT technologies may operate with unknown, insecure or unmonitored configurations, creating exploitable footholds. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Modification / Loss of System Integrity (R-AM-2), Counterfeit / Non-Conforming Component Impact (R-SC-7), Loss of Authenticity / Provenance (R-IP-5), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Counterfeit / Non-Conforming Products (MT-20), Cryptographic Compromise / Cryptanalytic Capability Advancement (MT-31).", "compensating_control_1": { "control_id": "CHG-03", "name": "Configuration Change Control", "description": "Mechanisms exist to govern the technical configuration change control processes.", "justification": "Configuration Change Control (CHG-03) provides configuration hardening that compensates for the absence of Software / Firmware Integrity Verification (TDA-20.3) by eliminating unnecessary services and enforcing secure settings to reduce inherent exposure. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CFG-02", "name": "Configuration Management Program", "description": "Mechanisms exist to facilitate the implementation of configuration management controls.", "justification": "Configuration Management Program (CFG-02) provides policy-level governance that compensates for the absence of Software / Firmware Integrity Verification (TDA-20.3) by establishing documented expectations, accountability structures, and organizational guardrails. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "TDA-20.4", "risk_if_not_implemented": "Without Hardware Integrity Verification, applications may be built and deployed with exploitable design and coding weaknesses that adversaries can leverage. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Modification / Loss of System Integrity (R-AM-2), Counterfeit / Non-Conforming Component Impact (R-SC-7), Loss of Authenticity / Provenance (R-IP-5), and most likely increases susceptibility to Physical Crime (MT-5), Counterfeit / Non-Conforming Products (MT-20).", "compensating_control_1": { "control_id": "CFG-02", "name": "Configuration Management Program", "description": "Mechanisms exist to facilitate the implementation of configuration management controls.", "justification": "Configuration Management Program (CFG-02) provides policy-level governance that compensates for the absence of Hardware Integrity Verification (TDA-20.4) by establishing documented expectations, accountability structures, and organizational guardrails. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "TDA-20", "name": "Developer Configuration Management", "description": "Mechanisms exist to require system developers and integrators to perform configuration management during system design, development, implementation and operation.", "justification": "Developer Configuration Management (TDA-20) provides configuration hardening that compensates for the absence of Hardware Integrity Verification (TDA-20.4) by eliminating unnecessary services and enforcing secure settings to reduce inherent exposure. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "TDA-21", "risk_if_not_implemented": "Without Bills of Material (BOMs), counterfeit, non-conforming or compromised components and services may enter the environment through the supply chain. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to R-EX-6, R-GV-2, R-GV-5, R-SC-3, R-SC-7, R-IP-5, and most likely increases susceptibility to Human Error (MT-9), Data Quality Degradation / Data Poisoning (MT-12), Counterfeit / Non-Conforming Products (MT-20).", "compensating_control_1": { "control_id": "GOV-04", "name": "Publishing Security, Compliance & Resilience Documentation", "description": "Mechanisms exist to establish, maintain and disseminate policies, standards and procedures necessary for secure, compliant and resilient capabilities.", "justification": "Publishing Security, Compliance & Resilience Documentation (GOV-04) provides resilience and recovery capability that compensates for the absence of Software Bill of Materials (SBOM) (TDA-04.2) by ensuring the organization can restore operations and data when the primary control is absent. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "TDA-08.3", "name": "Administrator Documentation", "description": "Mechanisms exist to obtain, protect and distribute administrator documentation for Technology Assets, Applications and/or Services (TAAS) that describe:\n(1) Secure configuration, installation and operation of the TAAS;\n(2) Effective use and maintenance of security features/functions; and\n(3) Known vulnerabilities regarding configuration and use of administrative (e.g., privileged) functions.", "justification": "Administrator Documentation (TDA-08.3) provides policy-level governance that compensates for the absence of Software Bill of Materials (SBOM) (TDA-04.2) by establishing documented expectations, accountability structures, and organizational guardrails. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "TDA-21.1", "risk_if_not_implemented": "Without Cryptographic Bill of Materials (CBOM), counterfeit, non-conforming or compromised components and services may enter the environment through the supply chain. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unaddressed Security / Compliance Exposure (R-GV-2), Uncontrolled Third-Party Security / Privacy Exposure (R-GV-5), Long-Term Confidentiality Loss from Cryptographic Obsolescence (R-IP-1), and most likely increases susceptibility to Human Error (MT-9), Data Quality Degradation / Data Poisoning (MT-12), Harvest Now / Decrypt Later (HNDL) (MT-28), Cryptographic Compromise / Cryptanalytic Capability Advancement (MT-31).", "compensating_control_1": { "control_id": "AST-04", "name": "Asset Inventories", "description": "Mechanisms exist to perform inventories of Technology Assets, Applications, Services and/or Data (TAASD) that:\n(1) Accurately reflects the current TAASD in use; \n(2) Identifies authorized software products, including business justification details;\n(3) Is at the level of granularity deemed necessary for tracking and reporting;\n(4) Includes organization-defined information deemed necessary to achieve effective property accountability; and\n(5) Is available for review and audit by designated organizational personnel.", "justification": "Asset Inventories (AST-04) provides asset and inventory visibility that compensates for the absence of Cryptographic Bill of Materials (CBOM) (TDA-21.1) by providing the foundational asset knowledge needed to manage risks associated with the primary control. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CFG-02", "name": "Configuration Management Program", "description": "Mechanisms exist to facilitate the implementation of configuration management controls.", "justification": "Configuration Management Program (CFG-02) provides policy-level governance that compensates for the absence of Cryptographic Bill of Materials (CBOM) (TDA-21.1) by establishing documented expectations, accountability structures, and organizational guardrails. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "TDA-21.2", "risk_if_not_implemented": "Without Hardware Bill of Materials (HBOM), counterfeit, non-conforming or compromised components and services may enter the environment through the supply chain. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to R-EX-6, R-GV-2, R-GV-5, R-SC-3, R-SC-7, R-IP-5, and most likely increases susceptibility to Human Error (MT-9), Data Quality Degradation / Data Poisoning (MT-12), Counterfeit / Non-Conforming Products (MT-20).", "compensating_control_1": { "control_id": "GOV-04", "name": "Publishing Security, Compliance & Resilience Documentation", "description": "Mechanisms exist to establish, maintain and disseminate policies, standards and procedures necessary for secure, compliant and resilient capabilities.", "justification": "Publishing Security, Compliance & Resilience Documentation (GOV-04) provides resilience and recovery capability that compensates for the absence of Software Bill of Materials (SBOM) (TDA-04.2) by ensuring the organization can restore operations and data when the primary control is absent. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "TDA-08.3", "name": "Administrator Documentation", "description": "Mechanisms exist to obtain, protect and distribute administrator documentation for Technology Assets, Applications and/or Services (TAAS) that describe:\n(1) Secure configuration, installation and operation of the TAAS;\n(2) Effective use and maintenance of security features/functions; and\n(3) Known vulnerabilities regarding configuration and use of administrative (e.g., privileged) functions.", "justification": "Administrator Documentation (TDA-08.3) provides policy-level governance that compensates for the absence of Software Bill of Materials (SBOM) (TDA-04.2) by establishing documented expectations, accountability structures, and organizational guardrails. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "TDA-21.3", "risk_if_not_implemented": "Without Indentured Bill of Materials (IBOM), counterfeit, non-conforming or compromised components and services may enter the environment through the supply chain. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unaddressed Security / Compliance Exposure (R-GV-2), Uncontrolled Third-Party Security / Privacy Exposure (R-GV-5), Sub-Tier / Fourth-Party Supply Chain Exposure (R-SC-3), and most likely increases susceptibility to Human Error (MT-9), Data Quality Degradation / Data Poisoning (MT-12).", "compensating_control_1": { "control_id": "GOV-04", "name": "Publishing Security, Compliance & Resilience Documentation", "description": "Mechanisms exist to establish, maintain and disseminate policies, standards and procedures necessary for secure, compliant and resilient capabilities.", "justification": "Publishing Security, Compliance & Resilience Documentation (GOV-04) provides resilience and recovery capability that compensates for the absence of Software Bill of Materials (SBOM) (TDA-04.2) by ensuring the organization can restore operations and data when the primary control is absent. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "TDA-08.3", "name": "Administrator Documentation", "description": "Mechanisms exist to obtain, protect and distribute administrator documentation for Technology Assets, Applications and/or Services (TAAS) that describe:\n(1) Secure configuration, installation and operation of the TAAS;\n(2) Effective use and maintenance of security features/functions; and\n(3) Known vulnerabilities regarding configuration and use of administrative (e.g., privileged) functions.", "justification": "Administrator Documentation (TDA-08.3) provides policy-level governance that compensates for the absence of Software Bill of Materials (SBOM) (TDA-04.2) by establishing documented expectations, accountability structures, and organizational guardrails. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "TDA-21.4", "risk_if_not_implemented": "Without Software Bill of Materials (SBOM), counterfeit, non-conforming or compromised components and services may enter the environment through the supply chain. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Exposure from Unaddressed Vulnerabilities (R-EX-6), Unaddressed Security / Compliance Exposure (R-GV-2), Uncontrolled Third-Party Security / Privacy Exposure (R-GV-5), Sub-Tier / Fourth-Party Supply Chain Exposure (R-SC-3), Loss of Authenticity / Provenance (R-IP-5), and most likely increases susceptibility to Human Error (MT-9), Data Quality Degradation / Data Poisoning (MT-12).", "compensating_control_1": { "control_id": "GOV-04", "name": "Publishing Security, Compliance & Resilience Documentation", "description": "Mechanisms exist to establish, maintain and disseminate policies, standards and procedures necessary for secure, compliant and resilient capabilities.", "justification": "Publishing Security, Compliance & Resilience Documentation (GOV-04) provides resilience and recovery capability that compensates for the absence of Software Bill of Materials (SBOM) (TDA-21.4) by ensuring the organization can restore operations and data when the primary control is absent. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "TDA-08.3", "name": "Administrator Documentation", "description": "Mechanisms exist to obtain, protect and distribute administrator documentation for Technology Assets, Applications and/or Services (TAAS) that describe:\n(1) Secure configuration, installation and operation of the TAAS;\n(2) Effective use and maintenance of security features/functions; and\n(3) Known vulnerabilities regarding configuration and use of administrative (e.g., privileged) functions.", "justification": "Administrator Documentation (TDA-08.3) provides policy-level governance that compensates for the absence of Software Bill of Materials (SBOM) (TDA-21.4) by establishing documented expectations, accountability structures, and organizational guardrails. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "TPM-03", "risk_if_not_implemented": "Without Acquisition Strategies, Tools & Methods, supplier and External Service Provider (ESP) weaknesses, incidents or failures may propagate into the organization's environment unmanaged. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Uncontrolled Third-Party Security / Privacy Exposure (R-GV-5), Counterfeit / Non-Conforming Component Impact (R-SC-7), and most likely increases susceptibility to man-made threats MT-8, MT-9, MT-11, MT-14, MT-15, MT-19, MT-20.", "compensating_control_1": { "control_id": "TPM-02", "name": "Third-Party Management", "description": "Mechanisms exist to facilitate the implementation of third-party management controls.", "justification": "Third-Party Management (TPM-02) provides third-party oversight that compensates for the absence of Acquisition Strategies, Tools & Methods (TPM-03) by extending security obligations contractually and monitoring third-party risk in lieu of direct control. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "RSK-20", "name": "Supply Chain Risk Management (SCRM) Plan", "description": "Mechanisms exist to develop a plan for Supply Chain Risk Management (SCRM) associated with the development, acquisition, maintenance and disposal of Technology Assets, Applications and/or Services (TAAS), including documenting selected mitigating actions and monitoring performance against those plans.", "justification": "Supply Chain Risk Management (SCRM) Plan (RSK-20) provides risk identification and prioritization that compensates for the absence of Acquisition Strategies, Tools & Methods (TPM-03) by enabling informed decisions about where to focus resources to manage residual exposure. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "TPM-04", "risk_if_not_implemented": "Without Supply Chain Risk Management (SCRM), supplier and External Service Provider (ESP) weaknesses, incidents or failures may propagate into the organization's environment unmanaged. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Uncontrolled Third-Party Security / Privacy Exposure (R-GV-5), Lack of oversight of third-party controls (R-GV-7), Third-Party Cybersecurity Compromise / Exposure (R-SC-1), Sub-Tier / Fourth-Party Supply Chain Exposure (R-SC-3), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9).", "compensating_control_1": { "control_id": "RSK-20", "name": "Supply Chain Risk Management (SCRM) Plan", "description": "Mechanisms exist to develop a plan for Supply Chain Risk Management (SCRM) associated with the development, acquisition, maintenance and disposal of Technology Assets, Applications and/or Services (TAAS), including documenting selected mitigating actions and monitoring performance against those plans.", "justification": "Supply Chain Risk Management (SCRM) Plan (RSK-20) provides risk identification and prioritization that compensates for the absence of Supply Chain Risk Management (SCRM) (TPM-04) by enabling informed decisions about where to focus resources to manage residual exposure. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "TPM-02", "name": "Third-Party Management", "description": "Mechanisms exist to facilitate the implementation of third-party management controls.", "justification": "Third-Party Management (TPM-02) provides third-party oversight that compensates for the absence of Supply Chain Risk Management (SCRM) (TPM-04) by extending security obligations contractually and monitoring third-party risk in lieu of direct control. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "TPM-04.1", "risk_if_not_implemented": "Without Processes To Address Weaknesses or Deficiencies, supplier and External Service Provider (ESP) weaknesses, incidents or failures may propagate into the organization's environment unmanaged. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Uncontrolled Third-Party Security / Privacy Exposure (R-GV-5), Lack of oversight of third-party controls (R-GV-7), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9).", "compensating_control_1": { "control_id": "TPM-04", "name": "Supply Chain Risk Management (SCRM)", "description": "Mechanisms exist to:\n(1) Evaluate security risks and threats associated with Technology Assets, Applications and/or Services (TAAS) supply chains; and\n(2) Take appropriate remediation actions to minimize the organization's exposure to those risks and threats, as necessary.", "justification": "Supply Chain Risk Management (SCRM) (TPM-04) provides risk identification and prioritization that compensates for the absence of Processes To Address Weaknesses or Deficiencies (TPM-04.1) by enabling informed decisions about where to focus resources to manage residual exposure. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "TPM-02", "name": "Third-Party Management", "description": "Mechanisms exist to facilitate the implementation of third-party management controls.", "justification": "Third-Party Management (TPM-02) provides third-party oversight that compensates for the absence of Processes To Address Weaknesses or Deficiencies (TPM-04.1) by extending security obligations contractually and monitoring third-party risk in lieu of direct control. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "TPM-04.2", "risk_if_not_implemented": "Without Limit Potential Harm, supplier and External Service Provider (ESP) weaknesses, incidents or failures may propagate into the organization's environment unmanaged. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Uncontrolled Third-Party Security / Privacy Exposure (R-GV-5), Third-Party Cybersecurity Compromise / Exposure (R-SC-1), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Counterfeit / Non-Conforming Products (MT-20).", "compensating_control_1": { "control_id": "RSK-20", "name": "Supply Chain Risk Management (SCRM) Plan", "description": "Mechanisms exist to develop a plan for Supply Chain Risk Management (SCRM) associated with the development, acquisition, maintenance and disposal of Technology Assets, Applications and/or Services (TAAS), including documenting selected mitigating actions and monitoring performance against those plans.", "justification": "Supply Chain Risk Management (SCRM) Plan (RSK-20) provides risk identification and prioritization that compensates for the absence of Limit Potential Harm (TPM-04.2) by enabling informed decisions about where to focus resources to manage residual exposure. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "TPM-04", "name": "Supply Chain Risk Management (SCRM)", "description": "Mechanisms exist to:\n(1) Evaluate security risks and threats associated with Technology Assets, Applications and/or Services (TAAS) supply chains; and\n(2) Take appropriate remediation actions to minimize the organization's exposure to those risks and threats, as necessary.", "justification": "Supply Chain Risk Management (SCRM) (TPM-04) provides risk identification and prioritization that compensates for the absence of Limit Potential Harm (TPM-04.2) by enabling informed decisions about where to focus resources to manage residual exposure. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "TPM-05", "risk_if_not_implemented": "Without Security, Compliance & Resilience Outsourcing Limitations, supplier and External Service Provider (ESP) weaknesses, incidents or failures may propagate into the organization's environment unmanaged. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Uncontrolled Third-Party Security / Privacy Exposure (R-GV-5), Lack of oversight of third-party controls (R-GV-7), Unreliable Assurance / Decision Information (R-GV-10), Third-Party Legal / Compliance Exposure (R-SC-4), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11).", "compensating_control_1": { "control_id": "TPM-12", "name": "Third-Party Services", "description": "Mechanisms exist to mitigate the risks associated with third-party access to the organization's Technology Assets, Applications, Services and/or Data (TAASD).", "justification": "Third-Party Services (TPM-12) provides third-party oversight and contractual controls that compensates for the absence of Security, Compliance & Resilience Outsourcing Limitations (TPM-05) by extending security obligations and monitoring third-party risk in lieu of direct primary control implementation. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CPL-15", "name": "Control Inheritance", "description": "Mechanisms exist to define instances of control inheritance within assessment boundaries.", "justification": "Control Inheritance (CPL-15) provides overlapping security capability that compensates for the absence of Security, Compliance & Resilience Outsourcing Limitations (TPM-05) by addressing related risk objectives through an alternative control mechanism. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "TPM-05.1", "risk_if_not_implemented": "Without Outsourcing Non-Essential Functions or Services, supplier and External Service Provider (ESP) weaknesses, incidents or failures may propagate into the organization's environment unmanaged. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Uncontrolled Third-Party Security / Privacy Exposure (R-GV-5), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9).", "compensating_control_1": { "control_id": "SEA-04", "name": "Alignment With Enterprise Architecture", "description": "Mechanisms exist to develop an enterprise architecture, aligned with industry-recognized leading practices, with consideration for security, compliance and resilience principles that addresses risk to organizational operations, assets, individuals and other organizations.", "justification": "Alignment With Enterprise Architecture (SEA-04) provides overlapping security capability that compensates for the absence of Outsourcing Non-Essential Functions or Services (TPM-05.1) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "NET-06", "name": "Network Segmentation (macrosegmentation)", "description": "Mechanisms exist to implement network segmentation within network architectures to isolate Technology Assets, Applications and/or Services (TAAS) from other network resources.", "justification": "Network Segmentation (macrosegmentation) (NET-06) provides network-level access restriction that compensates for the absence of Outsourcing Non-Essential Functions or Services (TPM-05.1) by limiting attacker reach and lateral movement opportunities across the environment. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "TPM-06", "risk_if_not_implemented": "Without Supplier Diversity, supplier and External Service Provider (ESP) weaknesses, incidents or failures may propagate into the organization's environment unmanaged. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Concentration / Single-Point Dependency Failure (R-OR-2), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Manufacturing Capacity / Supply Disruption (MT-22).", "compensating_control_1": { "control_id": "VPM-02", "name": "Vulnerability & Patch Management Program (VPMP)", "description": "Mechanisms exist to facilitate the implementation and monitoring of risk-based vulnerability management capabilities.", "justification": "Vulnerability & Patch Management Program (VPMP) (VPM-02) provides policy-level governance that compensates for the absence of Supplier Diversity (TPM-06) by establishing documented expectations, accountability structures, and organizational guardrails. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CPL-02", "name": "Statutory, Regulatory & Contractual Compliance", "description": "Mechanisms exist to facilitate the identification and implementation of relevant statutory, regulatory and contractual controls.", "justification": "Statutory, Regulatory & Contractual Compliance (CPL-02) provides overlapping security capability that compensates for the absence of Supplier Diversity (TPM-06) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "TPM-07", "risk_if_not_implemented": "Without Adequate Supply, failure of a single supplier, technology, facility or region may cause disproportionate disruption because adequate alternatives do not exist. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Recovery Failure / Unacceptable Recovery Delay (R-OR-1), and most likely increases susceptibility to Human Error (MT-9), Manufacturing Capacity / Supply Disruption (MT-22), Transportation / Logistics Disruption (MT-26).", "compensating_control_1": { "control_id": "TPM-02", "name": "Third-Party Management", "description": "Mechanisms exist to facilitate the implementation of third-party management controls.", "justification": "Third-Party Management (TPM-02) provides third-party oversight that compensates for the absence of Adequate Supply (TPM-07) by extending security obligations contractually and monitoring third-party risk in lieu of direct control. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "TPM-04", "name": "Supply Chain Risk Management (SCRM)", "description": "Mechanisms exist to:\n(1) Evaluate security risks and threats associated with Technology Assets, Applications and/or Services (TAAS) supply chains; and\n(2) Take appropriate remediation actions to minimize the organization's exposure to those risks and threats, as necessary.", "justification": "Supply Chain Risk Management (SCRM) (TPM-04) provides risk identification and prioritization that compensates for the absence of Adequate Supply (TPM-07) by enabling informed decisions about where to focus resources to manage residual exposure. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "TPM-08", "risk_if_not_implemented": "Without Third-Party Inventories, supplier and External Service Provider (ESP) weaknesses, incidents or failures may propagate into the organization's environment unmanaged. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unaddressed Security / Compliance Exposure (R-GV-2), Uncontrolled Third-Party Security / Privacy Exposure (R-GV-5), Lack of oversight of third-party controls (R-GV-7), Inability to Demonstrate Due Diligence / Due Care (R-GV-9), and most likely increases susceptibility to Human Error (MT-9), Data Quality Degradation / Data Poisoning (MT-12).", "compensating_control_1": { "control_id": "TPM-14", "name": "Third-Party Contract Requirements", "description": "Mechanisms exist to require contractual requirements for applicable security, compliance and resilience requirements with third-parties, reflecting the organization's needs to protect its Technology Assets, Applications, Services and/or Data (TAASD).", "justification": "Third-Party Contract Requirements (TPM-14) provides third-party oversight that compensates for the absence of Third-Party Inventories (TPM-08) by extending security obligations contractually and monitoring third-party risk in lieu of direct control. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "RSK-20", "name": "Supply Chain Risk Management (SCRM) Plan", "description": "Mechanisms exist to develop a plan for Supply Chain Risk Management (SCRM) associated with the development, acquisition, maintenance and disposal of Technology Assets, Applications and/or Services (TAAS), including documenting selected mitigating actions and monitoring performance against those plans.", "justification": "Supply Chain Risk Management (SCRM) Plan (RSK-20) provides risk identification and prioritization that compensates for the absence of Third-Party Inventories (TPM-08) by enabling informed decisions about where to focus resources to manage residual exposure. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "TPM-09", "risk_if_not_implemented": "Without Third-Party Criticality Assessments, supplier and External Service Provider (ESP) weaknesses, incidents or failures may propagate into the organization's environment unmanaged. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Uncontrolled Third-Party Security / Privacy Exposure (R-GV-5), Lack of oversight of third-party controls (R-GV-7), Inability to Demonstrate Due Diligence / Due Care (R-GV-9), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9).", "compensating_control_1": { "control_id": "RSK-13", "name": "Risk Assessment", "description": "Mechanisms exist to conduct recurring assessments of risk that includes the likelihood and magnitude of harm, from unauthorized access, use, disclosure, disruption, modification or destruction of the organization's Technology Assets, Applications, Services and/or Data (TAASD).", "justification": "Risk Assessment (RSK-13) provides periodic assessment and assurance that compensates for the absence of Third-Party Criticality Assessments (TPM-09) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "TPM-14", "name": "Third-Party Contract Requirements", "description": "Mechanisms exist to require contractual requirements for applicable security, compliance and resilience requirements with third-parties, reflecting the organization's needs to protect its Technology Assets, Applications, Services and/or Data (TAASD).", "justification": "Third-Party Contract Requirements (TPM-14) provides third-party oversight that compensates for the absence of Third-Party Criticality Assessments (TPM-09) by extending security obligations contractually and monitoring third-party risk in lieu of direct control. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "TPM-10", "risk_if_not_implemented": "Without Third-Party Risk Assessments & Approvals, supplier and External Service Provider (ESP) weaknesses, incidents or failures may propagate into the organization's environment unmanaged. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Uncontrolled Third-Party Security / Privacy Exposure (R-GV-5), Lack of oversight of third-party controls (R-GV-7), Inability to Demonstrate Due Diligence / Due Care (R-GV-9), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9).", "compensating_control_1": { "control_id": "CPL-02", "name": "Statutory, Regulatory & Contractual Compliance", "description": "Mechanisms exist to facilitate the identification and implementation of relevant statutory, regulatory and contractual controls.", "justification": "Statutory, Regulatory & Contractual Compliance (CPL-02) provides overlapping security capability that compensates for the absence of Third-Party Risk Assessments & Approvals (TPM-10) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "TPM-12", "name": "Third-Party Services", "description": "Mechanisms exist to mitigate the risks associated with third-party access to the organization's Technology Assets, Applications, Services and/or Data (TAASD).", "justification": "Third-Party Services (TPM-12) provides third-party oversight that compensates for the absence of Third-Party Risk Assessments & Approvals (TPM-10) by extending security obligations contractually and monitoring third-party risk in lieu of direct control. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "TPM-11", "risk_if_not_implemented": "Without Responsible, Accountable, Supportive, Consulted & Informed (RASCI) Matrix, unauthorized individuals, devices or services may gain access to Technology Assets, Applications, Services, Data and/or Facilities (TAASDF). Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unperformed / Unowned Control Responsibilities (R-GV-3), Lack of oversight of third-party controls (R-GV-7), Inability to Demonstrate Due Diligence / Due Care (R-GV-9), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9).", "compensating_control_1": { "control_id": "TPM-12", "name": "Third-Party Services", "description": "Mechanisms exist to mitigate the risks associated with third-party access to the organization's Technology Assets, Applications, Services and/or Data (TAASD).", "justification": "Third-Party Services (TPM-12) provides third-party oversight that compensates for the absence of Responsible, Accountable, Supportive, Consulted & Informed (RASCI) Matrix (TPM-11) by extending security obligations contractually and monitoring third-party risk in lieu of direct control. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "TPM-14", "name": "Third-Party Contract Requirements", "description": "Mechanisms exist to require contractual requirements for applicable security, compliance and resilience requirements with third-parties, reflecting the organization's needs to protect its Technology Assets, Applications, Services and/or Data (TAASD).", "justification": "Third-Party Contract Requirements (TPM-14) provides third-party oversight that compensates for the absence of Responsible, Accountable, Supportive, Consulted & Informed (RASCI) Matrix (TPM-11) by extending security obligations contractually and monitoring third-party risk in lieu of direct control. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "TPM-12.1", "risk_if_not_implemented": "Without Conflict of Interests, trusted insiders may misuse access or act on conflicts of interest without detection or deterrence. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Uncontrolled Third-Party Security / Privacy Exposure (R-GV-5), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Conflict of Interest (COI) / Undue Influence / Insider Misconduct (MT-15), Foreign Ownership, Control, or Influence (FOCI) (MT-17).", "compensating_control_1": { "control_id": "TPM-14", "name": "Third-Party Contract Requirements", "description": "Mechanisms exist to require contractual requirements for applicable security, compliance and resilience requirements with third-parties, reflecting the organization's needs to protect its Technology Assets, Applications, Services and/or Data (TAASD).", "justification": "Third-Party Contract Requirements (TPM-14) provides third-party oversight that compensates for the absence of Conflict of Interests (TPM-12.1) by extending security obligations contractually and monitoring third-party risk in lieu of direct control. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "TPM-12", "name": "Third-Party Services", "description": "Mechanisms exist to mitigate the risks associated with third-party access to the organization's Technology Assets, Applications, Services and/or Data (TAASD).", "justification": "Third-Party Services (TPM-12) provides third-party oversight that compensates for the absence of Conflict of Interests (TPM-12.1) by extending security obligations contractually and monitoring third-party risk in lieu of direct control. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "TPM-12.3", "risk_if_not_implemented": "Without Third-Party Authentication Practices, supplier and External Service Provider (ESP) weaknesses, incidents or failures may propagate into the organization's environment unmanaged. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Access (R-AC-4), Identity Compromise / Impersonation (R-AC-5), Third-Party Cybersecurity Compromise / Exposure (R-SC-1), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9).", "compensating_control_1": { "control_id": "TPM-14", "name": "Third-Party Contract Requirements", "description": "Mechanisms exist to require contractual requirements for applicable security, compliance and resilience requirements with third-parties, reflecting the organization's needs to protect its Technology Assets, Applications, Services and/or Data (TAASD).", "justification": "Third-Party Contract Requirements (TPM-14) provides third-party oversight that compensates for the absence of Third-Party Authentication Practices (TPM-12.3) by extending security obligations contractually and monitoring third-party risk in lieu of direct control. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "TPM-12", "name": "Third-Party Services", "description": "Mechanisms exist to mitigate the risks associated with third-party access to the organization's Technology Assets, Applications, Services and/or Data (TAASD).", "justification": "Third-Party Services (TPM-12) provides third-party oversight that compensates for the absence of Third-Party Authentication Practices (TPM-12.3) by extending security obligations contractually and monitoring third-party risk in lieu of direct control. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "TPM-12.4", "risk_if_not_implemented": "Without External Connectivity Requirements - Identification of Ports, Protocols & Services, supplier and External Service Provider (ESP) weaknesses, incidents or failures may propagate into the organization's environment unmanaged. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unaddressed Security / Compliance Exposure (R-GV-2), Uncontrolled Third-Party Security / Privacy Exposure (R-GV-5), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9).", "compensating_control_1": { "control_id": "TPM-12", "name": "Third-Party Services", "description": "Mechanisms exist to mitigate the risks associated with third-party access to the organization's Technology Assets, Applications, Services and/or Data (TAASD).", "justification": "Third-Party Services (TPM-12) provides third-party oversight that compensates for the absence of External Connectivity Requirements - Identification of Ports, Protocols & Services (TPM-12.4) by extending security obligations contractually and monitoring third-party risk in lieu of direct control. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CPL-02", "name": "Statutory, Regulatory & Contractual Compliance", "description": "Mechanisms exist to facilitate the identification and implementation of relevant statutory, regulatory and contractual controls.", "justification": "Statutory, Regulatory & Contractual Compliance (CPL-02) provides overlapping security capability that compensates for the absence of External Connectivity Requirements - Identification of Ports, Protocols & Services (TPM-12.4) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "TPM-13", "risk_if_not_implemented": "Without Third-Party Personnel Security, supplier and External Service Provider (ESP) weaknesses, incidents or failures may propagate into the organization's environment unmanaged. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unperformed / Unowned Control Responsibilities (R-GV-3), Uncontrolled Third-Party Security / Privacy Exposure (R-GV-5), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9).", "compensating_control_1": { "control_id": "HRS-05", "name": "Personnel Screening", "description": "Mechanisms exist to manage personnel security risk by screening individuals prior to authorizing access.", "justification": "Personnel Screening (HRS-05) provides overlapping security capability that compensates for the absence of Third-Party Personnel Security (TPM-13) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "TPM-02", "name": "Third-Party Management", "description": "Mechanisms exist to facilitate the implementation of third-party management controls.", "justification": "Third-Party Management (TPM-02) provides third-party oversight that compensates for the absence of Third-Party Personnel Security (TPM-13) by extending security obligations contractually and monitoring third-party risk in lieu of direct control. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "TPM-14.1", "risk_if_not_implemented": "Without Contract Flow-Down Requirements, supplier and External Service Provider (ESP) weaknesses, incidents or failures may propagate into the organization's environment unmanaged. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Uncontrolled Third-Party Security / Privacy Exposure (R-GV-5), Sub-Tier / Fourth-Party Supply Chain Exposure (R-SC-3), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11).", "compensating_control_1": { "control_id": "CPL-02", "name": "Statutory, Regulatory & Contractual Compliance", "description": "Mechanisms exist to facilitate the identification and implementation of relevant statutory, regulatory and contractual controls.", "justification": "Statutory, Regulatory & Contractual Compliance (CPL-02) provides overlapping security capability that compensates for the absence of Contract Flow-Down Requirements (TPM-14.1) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "TPM-14", "name": "Third-Party Contract Requirements", "description": "Mechanisms exist to require contractual requirements for applicable security, compliance and resilience requirements with third-parties, reflecting the organization's needs to protect its Technology Assets, Applications, Services and/or Data (TAASD).", "justification": "Third-Party Contract Requirements (TPM-14) provides third-party oversight that compensates for the absence of Contract Flow-Down Requirements (TPM-14.1) by extending security obligations contractually and monitoring third-party risk in lieu of direct control. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "TPM-14.2", "risk_if_not_implemented": "Without Provider Contingency Plan, critical business processes and services may not withstand or recover from disruption, causing extended outages and data loss. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Recovery Failure / Unacceptable Recovery Delay (R-OR-1), Third-Party Dependency Failure (R-SC-6), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9).", "compensating_control_1": { "control_id": "NET-13", "name": "Domain Name Service (DNS) Resolution", "description": "Mechanisms exist to ensure Domain Name Service (DNS) resolution is designed, implemented and managed to protect the security of name / address resolution.", "justification": "Domain Name Service (DNS) Resolution (NET-13) provides overlapping security capability that compensates for the absence of Provider Contingency Plan (TPM-14.2) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "NET-07", "name": "Out-of-Band Channels", "description": "Mechanisms exist to utilize out-of-band channels for the electronic transmission of information and/or the physical shipment of system components or devices to authorized individuals.", "justification": "Out-of-Band Channels (NET-07) provides overlapping security capability that compensates for the absence of Provider Contingency Plan (TPM-14.2) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "TPM-15", "risk_if_not_implemented": "Without Review of Third-Party Services, supplier and External Service Provider (ESP) weaknesses, incidents or failures may propagate into the organization's environment unmanaged. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Uncontrolled Third-Party Security / Privacy Exposure (R-GV-5), Lack of oversight of third-party controls (R-GV-7), Inability to Demonstrate Due Diligence / Due Care (R-GV-9), Unreliable Assurance / Decision Information (R-GV-10), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Data Quality Degradation / Data Poisoning (MT-12), Conflict of Interest (COI) / Undue Influence / Insider Misconduct (MT-15), Workforce Shortage / Loss of Critical Skills / Labor Disruption (MT-25).", "compensating_control_1": { "control_id": "CPL-05", "name": "Conformity Monitoring", "description": "Mechanisms exist to validate that Technology Assets, Applications, Services and/or Data (TAASD) conform to the organization's security, compliance and/or resilience policies, standards and other applicable requirements.", "justification": "Conformity Monitoring (CPL-05) provides periodic assessment and assurance that compensates for the absence of Review of Third-Party Services (TPM-15) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "TPM-02", "name": "Third-Party Management", "description": "Mechanisms exist to facilitate the implementation of third-party management controls.", "justification": "Third-Party Management (TPM-02) provides third-party oversight that compensates for the absence of Review of Third-Party Services (TPM-15) by extending security obligations contractually and monitoring third-party risk in lieu of direct control. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "TPM-17", "risk_if_not_implemented": "Without Managing Changes To Third-Party Services, supplier and External Service Provider (ESP) weaknesses, incidents or failures may propagate into the organization's environment unmanaged. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Modification / Loss of System Integrity (R-AM-2), Uncontrolled Third-Party Security / Privacy Exposure (R-GV-5), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9).", "compensating_control_1": { "control_id": "CHG-02", "name": "Change Management Program", "description": "Mechanisms exist to facilitate the implementation of a change management program.", "justification": "Change Management Program (CHG-02) provides policy-level governance that compensates for the absence of Managing Changes To Third-Party Services (TPM-17) by establishing documented expectations, accountability structures, and organizational guardrails. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "TPM-15", "name": "Review of Third-Party Services", "description": "Mechanisms exist to monitor, regularly review and assess External Service Providers (ESPs) for compliance with established contractual requirements for security, compliance and resilience controls.", "justification": "Review of Third-Party Services (TPM-15) provides periodic assessment and assurance that compensates for the absence of Managing Changes To Third-Party Services (TPM-17) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "TPM-18", "risk_if_not_implemented": "Without Third-Party Deficiency Remediation, supplier and External Service Provider (ESP) weaknesses, incidents or failures may propagate into the organization's environment unmanaged. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Uncontrolled Third-Party Security / Privacy Exposure (R-GV-5), Lack of oversight of third-party controls (R-GV-7), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Conflict of Interest (COI) / Undue Influence / Insider Misconduct (MT-15), Workforce Shortage / Loss of Critical Skills / Labor Disruption (MT-25).", "compensating_control_1": { "control_id": "RSK-17", "name": "Risk Remediation", "description": "Mechanisms exist to remediate risks to an acceptable level.", "justification": "Risk Remediation (RSK-17) provides vulnerability management that compensates for the absence of Third-Party Deficiency Remediation (TPM-18) by reducing the exploitable attack surface by addressing known weaknesses before they are leveraged. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "TPM-14", "name": "Third-Party Contract Requirements", "description": "Mechanisms exist to require contractual requirements for applicable security, compliance and resilience requirements with third-parties, reflecting the organization's needs to protect its Technology Assets, Applications, Services and/or Data (TAASD).", "justification": "Third-Party Contract Requirements (TPM-14) provides third-party oversight that compensates for the absence of Third-Party Deficiency Remediation (TPM-18) by extending security obligations contractually and monitoring third-party risk in lieu of direct control. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "TPM-19", "risk_if_not_implemented": "Without Break Clauses, supplier and External Service Provider (ESP) weaknesses, incidents or failures may propagate into the organization's environment unmanaged. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Uncontrolled Third-Party Security / Privacy Exposure (R-GV-5), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11).", "compensating_control_1": { "control_id": "TPM-14", "name": "Third-Party Contract Requirements", "description": "Mechanisms exist to require contractual requirements for applicable security, compliance and resilience requirements with third-parties, reflecting the organization's needs to protect its Technology Assets, Applications, Services and/or Data (TAASD).", "justification": "Third-Party Contract Requirements (TPM-14) provides third-party oversight that compensates for the absence of Break Clauses (TPM-19) by extending security obligations contractually and monitoring third-party risk in lieu of direct control. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CPL-02", "name": "Statutory, Regulatory & Contractual Compliance", "description": "Mechanisms exist to facilitate the identification and implementation of relevant statutory, regulatory and contractual controls.", "justification": "Statutory, Regulatory & Contractual Compliance (CPL-02) provides overlapping security capability that compensates for the absence of Break Clauses (TPM-19) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "TPM-20", "risk_if_not_implemented": "Without Foreign Ownership, Control or Influence (FOCI), foreign ownership, control or influence may be used to shape decisions, compel access or obtain sensitive information. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Uncontrolled Third-Party Security / Privacy Exposure (R-GV-5), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Conflict of Interest (COI) / Undue Influence / Insider Misconduct (MT-15), Foreign Ownership, Control, or Influence (FOCI) (MT-17).", "compensating_control_1": { "control_id": "CPL-02", "name": "Statutory, Regulatory & Contractual Compliance", "description": "Mechanisms exist to facilitate the identification and implementation of relevant statutory, regulatory and contractual controls.", "justification": "Statutory, Regulatory & Contractual Compliance (CPL-02) provides overlapping security capability that compensates for the absence of Foreign Ownership, Control or Influence (FOCI) (TPM-20) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "TPM-02", "name": "Third-Party Management", "description": "Mechanisms exist to facilitate the implementation of third-party management controls.", "justification": "Third-Party Management (TPM-02) provides third-party oversight that compensates for the absence of Foreign Ownership, Control or Influence (FOCI) (TPM-20) by extending security obligations contractually and monitoring third-party risk in lieu of direct control. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "TPM-20.1", "risk_if_not_implemented": "Without Ownership Change Monitoring, malicious, anomalous or unauthorized activity may go undetected or be detected too late to prevent or limit harm. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Uncontrolled Third-Party Security / Privacy Exposure (R-GV-5), Lack of oversight of third-party controls (R-GV-7), and most likely increases susceptibility to man-made threats MT-8, MT-9, MT-12, MT-15, MT-17, MT-25.", "compensating_control_1": { "control_id": "TPM-02", "name": "Third-Party Management", "description": "Mechanisms exist to facilitate the implementation of third-party management controls.", "justification": "Third-Party Management (TPM-02) provides third-party oversight that compensates for the absence of Ownership Change Monitoring (TPM-20.1) by extending security obligations contractually and monitoring third-party risk in lieu of direct control. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CPL-02", "name": "Statutory, Regulatory & Contractual Compliance", "description": "Mechanisms exist to facilitate the identification and implementation of relevant statutory, regulatory and contractual controls.", "justification": "Statutory, Regulatory & Contractual Compliance (CPL-02) provides overlapping security capability that compensates for the absence of Ownership Change Monitoring (TPM-20.1) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "TPM-20.2", "risk_if_not_implemented": "Without Ownership Change Provisions, supplier and External Service Provider (ESP) weaknesses, incidents or failures may propagate into the organization's environment unmanaged. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Access (R-AC-4), Uncontrolled Third-Party Security / Privacy Exposure (R-GV-5), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11), Foreign Ownership, Control, or Influence (FOCI) (MT-17).", "compensating_control_1": { "control_id": "CPL-02", "name": "Statutory, Regulatory & Contractual Compliance", "description": "Mechanisms exist to facilitate the identification and implementation of relevant statutory, regulatory and contractual controls.", "justification": "Statutory, Regulatory & Contractual Compliance (CPL-02) provides overlapping security capability that compensates for the absence of Ownership Change Provisions (TPM-20.2) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "TPM-20", "name": "Foreign Ownership, Control or Influence (FOCI)", "description": "Mechanisms exist to minimize risk associated with Foreign Ownership, Control or Influence (FOCI) through Supply Chain Risk Management (SCRM) practices.", "justification": "Foreign Ownership, Control or Influence (FOCI) (TPM-20) provides overlapping security capability that compensates for the absence of Ownership Change Provisions (TPM-20.2) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "TPM-21", "risk_if_not_implemented": "Without Third-Party Incident Response & Recovery Capabilities, supplier and External Service Provider (ESP) weaknesses, incidents or failures may propagate into the organization's environment unmanaged. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Uncontrolled Third-Party Security / Privacy Exposure (R-GV-5), Delayed Containment / Increased Incident Impact (R-IR-2), Recovery Failure / Unacceptable Recovery Delay (R-OR-1), Third-Party Dependency Failure (R-SC-6), and most likely increases susceptibility to Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11).", "compensating_control_1": { "control_id": "IRO-08", "name": "Incident Response Plan (IRP)", "description": "Mechanisms exist to maintain and make available a current and viable Incident Response Plan (IRP) to all stakeholders.", "justification": "Incident Response Plan (IRP) (IRO-08) provides incident response capability that compensates for the absence of Third-Party Incident Response & Recovery Capabilities (TPM-21) by enabling timely detection, containment, and recovery from security events in the absence of the primary control. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "BCD-02", "name": "Business Continuity Management System (BCMS)", "description": "Mechanisms exist to operate a Business Continuity Management System (BCMS) to achieve resilient Technology Assets, Applications, Services and/or Data (TAASD) during:\n(1) Routine operations; and\n(2) Adverse conditions.", "justification": "Business Continuity Management System (BCMS) (BCD-02) provides resilience and recovery capability that compensates for the absence of Third-Party Incident Response & Recovery Capabilities (TPM-21) by ensuring the organization can restore operations and data when the primary control is absent. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "TPM-21.1", "risk_if_not_implemented": "Without Security Compromise Notification Agreements, supplier and External Service Provider (ESP) weaknesses, incidents or failures may propagate into the organization's environment unmanaged. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Uncontrolled Third-Party Security / Privacy Exposure (R-GV-5), Delayed Containment / Increased Incident Impact (R-IR-2), Undetected / Delayed Detection of Adverse Activity (R-SA-1), Third-Party Cybersecurity Compromise / Exposure (R-SC-1), and most likely increases susceptibility to Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11), Fraud, Corruption and/or Intentional Criminal Conduct (MT-14).", "compensating_control_1": { "control_id": "TPM-12", "name": "Third-Party Services", "description": "Mechanisms exist to mitigate the risks associated with third-party access to the organization's Technology Assets, Applications, Services and/or Data (TAASD).", "justification": "Third-Party Services (TPM-12) provides third-party oversight that compensates for the absence of Security Compromise Notification Agreements (TPM-21.1) by extending security obligations contractually and monitoring third-party risk in lieu of direct control. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CPL-02", "name": "Statutory, Regulatory & Contractual Compliance", "description": "Mechanisms exist to facilitate the identification and implementation of relevant statutory, regulatory and contractual controls.", "justification": "Statutory, Regulatory & Contractual Compliance (CPL-02) provides overlapping security capability that compensates for the absence of Security Compromise Notification Agreements (TPM-21.1) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "TPM-22", "risk_if_not_implemented": "Without First-Party Declaration (1PD), supplier and External Service Provider (ESP) weaknesses, incidents or failures may propagate into the organization's environment unmanaged. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Contractual Default / Termination (R-EX-2), Uncontrolled Third-Party Security / Privacy Exposure (R-GV-5), Lack of oversight of third-party controls (R-GV-7), Inability to Demonstrate Due Diligence / Due Care (R-GV-9), Unreliable Assurance / Decision Information (R-GV-10), and most likely increases susceptibility to Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11), Data Quality Degradation / Data Poisoning (MT-12), Fraud, Corruption and/or Intentional Criminal Conduct (MT-14).", "compensating_control_1": { "control_id": "TPM-12", "name": "Third-Party Services", "description": "Mechanisms exist to mitigate the risks associated with third-party access to the organization's Technology Assets, Applications, Services and/or Data (TAASD).", "justification": "Third-Party Services (TPM-12) provides third-party oversight that compensates for the absence of First-Party Declaration (1PD) (TPM-22) by extending security obligations contractually and monitoring third-party risk in lieu of direct control. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CPL-02", "name": "Statutory, Regulatory & Contractual Compliance", "description": "Mechanisms exist to facilitate the identification and implementation of relevant statutory, regulatory and contractual controls.", "justification": "Statutory, Regulatory & Contractual Compliance (CPL-02) provides overlapping security capability that compensates for the absence of First-Party Declaration (1PD) (TPM-22) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "TPM-23", "risk_if_not_implemented": "Without Third-Party Attestation (3PA), supplier and External Service Provider (ESP) weaknesses, incidents or failures may propagate into the organization's environment unmanaged. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Contractual Default / Termination (R-EX-2), Uncontrolled Third-Party Security / Privacy Exposure (R-GV-5), Lack of oversight of third-party controls (R-GV-7), Inability to Demonstrate Due Diligence / Due Care (R-GV-9), Unreliable Assurance / Decision Information (R-GV-10), and most likely increases susceptibility to Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11).", "compensating_control_1": { "control_id": "CPL-02", "name": "Statutory, Regulatory & Contractual Compliance", "description": "Mechanisms exist to facilitate the identification and implementation of relevant statutory, regulatory and contractual controls.", "justification": "Statutory, Regulatory & Contractual Compliance (CPL-02) provides overlapping security capability that compensates for the absence of Third-Party Attestation (3PA) (TPM-23) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "TPM-14", "name": "Third-Party Contract Requirements", "description": "Mechanisms exist to require contractual requirements for applicable security, compliance and resilience requirements with third-parties, reflecting the organization's needs to protect its Technology Assets, Applications, Services and/or Data (TAASD).", "justification": "Third-Party Contract Requirements (TPM-14) provides third-party oversight that compensates for the absence of Third-Party Attestation (3PA) (TPM-23) by extending security obligations contractually and monitoring third-party risk in lieu of direct control. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "TPM-24", "risk_if_not_implemented": "Without Terminating Third-Party Relationships, the organization may be unable to disengage from a third party in an orderly way, leaving it dependent on a provider that is failing, insolvent, non-compliant or no longer needed. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Uncontrolled Third-Party Security / Privacy Exposure (R-GV-5), Concentration / Single-Point Dependency Failure (R-OR-2), Third-Party Dependency Failure (R-SC-6), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11), Supplier Financial Distress / Insolvency (MT-24).", "compensating_control_1": { "control_id": "TPM-19", "name": "Break Clauses", "description": "Mechanisms exist to include \"break clauses\" within contracts for failure to meet contract criteria for security, compliance and/or resilience controls.", "justification": "Break Clauses (TPM-19) compensates for the absence of Terminating Third-Party Relationships (TPM-24) by embedding contractual break clauses that preserve the organization's right to exit under defined conditions, which supplies the legal basis an exit strategy would otherwise formalize. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "TPM-06", "name": "Supplier Diversity", "description": "Mechanisms exist to obtain security, compliance and resilience technologies from different suppliers to minimize supply chain risk.", "justification": "Supplier Diversity (TPM-06) compensates for the absence of Terminating Third-Party Relationships (TPM-24) by maintaining alternative suppliers for security, compliance and resilience technologies, which reduces the concentration risk and dependency failure that make an unplanned exit damaging. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "TPM-24.1", "risk_if_not_implemented": "Without Third-Party Transition Planning, transition activities, responsibilities and timelines are undefined at the point of cessation, so hand-off tasks are missed, ownership is disputed and service continuity suffers. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unperformed / Unowned Control Responsibilities (R-GV-3), Uncontrolled Third-Party Security / Privacy Exposure (R-GV-5), Third-Party Dependency Failure (R-SC-6), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Supplier Financial Distress / Insolvency (MT-24).", "compensating_control_1": { "control_id": "TPM-11", "name": "Responsible, Accountable, Supportive, Consulted & Informed (RASCI) Matrix", "description": "Mechanisms exist to document and maintain a Responsible, Accountable, Supportive, Consulted & Informed (RASCI) matrix, or similar documentation, to delineate assignment for security, compliance and resilience controls between internal stakeholders and External Service Providers (ESPs).", "justification": "Responsible, Accountable, Supportive, Consulted & Informed (RASCI) Matrix (TPM-11) compensates for the absence of Third-Party Transition Planning (TPM-24.1) by documenting a Responsible, Accountable, Supportive, Consulted & Informed (RASCI) matrix for third-party controls, which establishes the ownership that a transition plan would otherwise assign. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "BCD-04", "name": "Business Continuity & Disaster Recovery (BC/DR) Plans", "description": "Mechanisms exist for process owners to establish and maintain formal Business Continuity & Disaster Recovery (BC/DR) plans to ensure information is detailed enough, accurate and representative of current operations in order to sustain and/or restore operations under adverse conditions.", "justification": "Business Continuity & Disaster Recovery (BC/DR) Plans (BCD-04) compensates for the absence of Third-Party Transition Planning (TPM-24.1) by maintaining Business Continuity & Disaster Recovery (BC/DR) plans that already describe how critical services are sustained during disruption, which can be invoked to structure an otherwise unplanned provider transition. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "TPM-24.2", "risk_if_not_implemented": "Without Technology Assets, Applications, Services and Data (TAASD) Portability, Technology Assets, Applications, Services and Data (TAASD) may be trapped with the outgoing provider, or transferred in a way that breaches confidentiality, corrupts integrity or interrupts availability. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Uncontrolled Third-Party Security / Privacy Exposure (R-GV-5), Third-Party Dependency Failure (R-SC-6), Loss of Confidentiality (R-IP-2), Loss of Data Integrity (R-IP-3), Loss of Data / Service Availability (R-IP-4), and most likely increases susceptibility to Human Error (MT-9), Supplier Financial Distress / Insolvency (MT-24).", "compensating_control_1": { "control_id": "DCH-32", "name": "External Transfer of Sensitive / Regulated Data", "description": "Mechanisms exist to restrict and govern the transfer of sensitive and/or regulated data:\n(1) Cross-border; and/or\n(2) Interorganizational.", "justification": "External Transfer of Sensitive / Regulated Data (DCH-32) compensates for the absence of Technology Assets, Applications, Services and Data (TAASD) Portability (TPM-24.2) by governing how sensitive and/or regulated data is transferred to external parties, which protects confidentiality and integrity during any migration that does occur. Given the data-handling nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "BCD-24", "name": "Data Backups", "description": "Mechanisms exist to create recurring backups of data, software and/or system images, as well as verify the integrity of these backups, to ensure the availability of the data to satisfy Recovery Time Objectives (RTOs) and Recovery Point Objectives (RPOs).", "justification": "Data Backups (BCD-24) compensates for the absence of Technology Assets, Applications, Services and Data (TAASD) Portability (TPM-24.2) by maintaining organization-controlled backups of data, software and system images, which ensures the organization retains an independent, restorable copy regardless of the provider's cooperation. Given the data-handling nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "TPM-24.3", "risk_if_not_implemented": "Without Technology Assets, Applications, Services and Data (TAASD) Disposition, organizational data and assets may be retained, reused or improperly destroyed by the outgoing provider after the relationship ends. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Retention / Inability to Dispose of Data (R-AM-3), Uncontrolled Third-Party Security / Privacy Exposure (R-GV-5), Loss of Confidentiality (R-IP-2), and most likely increases susceptibility to Human Error (MT-9), Supplier Financial Distress / Insolvency (MT-24).", "compensating_control_1": { "control_id": "DCH-17", "name": "Digital & Non-Digital Media Disposal", "description": "Mechanisms exist to securely dispose of, destroy and/or erase digital and non-digital media when it is no longer required, using organization-defined procedures.", "justification": "Digital & Non-Digital Media Disposal (DCH-17) compensates for the absence of Technology Assets, Applications, Services and Data (TAASD) Disposition (TPM-24.3) by defining the organization's standard for secure disposal, destruction and erasure of media, which sets the requirement the third party is expected to meet at cessation. Given the data-handling nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "TPM-14", "name": "Third-Party Contract Requirements", "description": "Mechanisms exist to require contractual requirements for applicable security, compliance and resilience requirements with third-parties, reflecting the organization's needs to protect its Technology Assets, Applications, Services and/or Data (TAASD).", "justification": "Third-Party Contract Requirements (TPM-14) compensates for the absence of Technology Assets, Applications, Services and Data (TAASD) Disposition (TPM-24.3) by specifying return, retention and destruction obligations in third-party contracts, which is the only mechanism that binds the provider's handling of organizational Technology Assets, Applications, Services and Data (TAASD) after service ends. Given the data-handling nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "TPM-24.4", "risk_if_not_implemented": "Without Third-Party Access Revocation, former third-party personnel and systems may retain physical and logical access after the relationship ends, creating unauthorized access paths that are easy to overlook. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Excessive or Unauthorized Privilege (R-AC-2), Unauthorized Access (R-AC-4), Uncontrolled Third-Party Security / Privacy Exposure (R-GV-5), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9).", "compensating_control_1": { "control_id": "IAC-29", "name": "Revocation of Access Authorizations", "description": "Mechanisms exist to revoke logical and physical access authorizations.", "justification": "Revocation of Access Authorizations (IAC-29) compensates for the absence of Third-Party Access Revocation (TPM-24.4) by revoking access authorizations when the conditions that justified them no longer exist, which removes third-party access through the organization's standard revocation process. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "IAC-12", "name": "Periodic Review of Individual & Service Account Privileges", "description": "Mechanisms exist to periodically-review the privileges assigned to individuals and service accounts to validate the need for such privileges and reassign or remove unnecessary privileges, as necessary.", "justification": "Periodic Review of Individual & Service Account Privileges (IAC-12) compensates for the absence of Third-Party Access Revocation (TPM-24.4) by periodically reviewing individual and service account privileges, which detects and removes third-party access that was not revoked at cessation. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "TPM-24.5", "risk_if_not_implemented": "Without Third-Party Knowledge & Operational Transfer, knowledge, documentation, configurations, credentials and operational responsibilities may leave with the provider, degrading the organization's ability to operate and secure the affected services. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unperformed / Unowned Control Responsibilities (R-GV-3), Uncontrolled Third-Party Security / Privacy Exposure (R-GV-5), Loss of Critical Knowledge / Capability (R-PE-1), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Supplier Financial Distress / Insolvency (MT-24), Workforce Shortage / Loss of Critical Skills / Labor Disruption (MT-25).", "compensating_control_1": { "control_id": "PRM-11", "name": "Manage Organizational Knowledge", "description": "Mechanisms exist to manage the organizational knowledge of the security, compliance and resilience staff.", "justification": "Manage Organizational Knowledge (PRM-11) compensates for the absence of Third-Party Knowledge & Operational Transfer (TPM-24.5) by capturing and retaining organizational knowledge as a managed asset, which preserves the operational understanding that would otherwise be lost when a provider departs. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "TPM-11", "name": "Responsible, Accountable, Supportive, Consulted & Informed (RASCI) Matrix", "description": "Mechanisms exist to document and maintain a Responsible, Accountable, Supportive, Consulted & Informed (RASCI) matrix, or similar documentation, to delineate assignment for security, compliance and resilience controls between internal stakeholders and External Service Providers (ESPs).", "justification": "Responsible, Accountable, Supportive, Consulted & Informed (RASCI) Matrix (TPM-11) compensates for the absence of Third-Party Knowledge & Operational Transfer (TPM-24.5) by documenting a Responsible, Accountable, Supportive, Consulted & Informed (RASCI) matrix for third-party controls, which identifies the responsibilities that must be reassigned internally before cessation. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "TPM-24.6", "risk_if_not_implemented": "Without Third-Party Exit Obligations Management, legal, regulatory, contractual, licensing and records-retention obligations tied to the relationship may lapse or be breached at cessation, creating liability the organization did not anticipate. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Contractual Default / Termination (R-EX-2), Regulatory / Legal / Contractual Financial Liability (R-EX-5), Uncontrolled Third-Party Security / Privacy Exposure (R-GV-5), Inability to Demonstrate Due Diligence / Due Care (R-GV-9), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Statutory / Regulatory / Contractual Change (MT-11), Supplier Financial Distress / Insolvency (MT-24).", "compensating_control_1": { "control_id": "TPM-14", "name": "Third-Party Contract Requirements", "description": "Mechanisms exist to require contractual requirements for applicable security, compliance and resilience requirements with third-parties, reflecting the organization's needs to protect its Technology Assets, Applications, Services and/or Data (TAASD).", "justification": "Third-Party Contract Requirements (TPM-14) compensates for the absence of Third-Party Exit Obligations Management (TPM-24.6) by specifying exit obligations in third-party contracts, which documents the commitments both parties must honor at termination. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CPL-02", "name": "Statutory, Regulatory & Contractual Compliance", "description": "Mechanisms exist to facilitate the identification and implementation of relevant statutory, regulatory and contractual controls.", "justification": "Statutory, Regulatory & Contractual Compliance (CPL-02) compensates for the absence of Third-Party Exit Obligations Management (TPM-24.6) by identifying and implementing applicable statutory, regulatory and contractual controls, which captures the compliance obligations that survive or are triggered by a third-party exit. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "TPM-24.7", "risk_if_not_implemented": "Without Third-Party Exit Contingencies, termination of a third-party relationship may interrupt operations with no fallback, leaving security, compliance and continuity dependent on a provider that is no longer engaged. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Business / Service Interruption (R-BC-1), Uncontrolled Third-Party Security / Privacy Exposure (R-GV-5), Recovery Failure / Unacceptable Recovery Delay (R-OR-1), Concentration / Single-Point Dependency Failure (R-OR-2), Third-Party Dependency Failure (R-SC-6), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Supplier Financial Distress / Insolvency (MT-24).", "compensating_control_1": { "control_id": "BCD-04", "name": "Business Continuity & Disaster Recovery (BC/DR) Plans", "description": "Mechanisms exist for process owners to establish and maintain formal Business Continuity & Disaster Recovery (BC/DR) plans to ensure information is detailed enough, accurate and representative of current operations in order to sustain and/or restore operations under adverse conditions.", "justification": "Business Continuity & Disaster Recovery (BC/DR) Plans (BCD-04) compensates for the absence of Third-Party Exit Contingencies (TPM-24.7) by maintaining Business Continuity & Disaster Recovery (BC/DR) plans that define how critical services are sustained through disruption, which provides the operational fallback an exit contingency would specify. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "TPM-06", "name": "Supplier Diversity", "description": "Mechanisms exist to obtain security, compliance and resilience technologies from different suppliers to minimize supply chain risk.", "justification": "Supplier Diversity (TPM-06) compensates for the absence of Third-Party Exit Contingencies (TPM-24.7) by maintaining alternative suppliers for security, compliance and resilience technologies, which reduces the single-point dependency that makes an unplanned exit disruptive. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "THR-02", "risk_if_not_implemented": "Without Threat Intelligence Program, the organization's understanding of the threat environment may become stale, leaving defenses misaligned with active adversary tactics. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Undetected / Delayed Detection of Adverse Activity (R-SA-1). No threat is rated Likely for this control; threats rated Possible include Malicious Cyber Activity (MT-2), Utility Service Disruption (MT-7), Dysfunctional Management Practices (MT-8).", "compensating_control_1": { "control_id": "MON-02", "name": "Continuous Monitoring", "description": "Mechanisms exist to facilitate the implementation of enterprise-wide monitoring controls.", "justification": "Continuous Monitoring (MON-02) provides detective monitoring capability that compensates for the absence of Threat Intelligence Program (THR-02) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "RSK-02", "name": "Risk Management Program", "description": "Mechanisms exist to facilitate the implementation of strategic, operational and tactical risk management controls that are aligned with:\n(1) The organization's Enterprise Risk Management (ERM); and\n(2) Industry-recognized cybersecurity risk management practices.", "justification": "Risk Management Program (RSK-02) provides policy-level governance that compensates for the absence of Threat Intelligence Program (THR-02) by establishing documented expectations, accountability structures, and organizational guardrails. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "THR-03", "risk_if_not_implemented": "Without Dynamic Threat Awareness, personnel are more likely to make unsafe decisions, fall victim to social engineering, mishandle data or violate requirements. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Undetected / Delayed Detection of Adverse Activity (R-SA-1), and most likely increases susceptibility to Human Error (MT-9).", "compensating_control_1": { "control_id": "THR-02", "name": "Threat Intelligence Program", "description": "Mechanisms exist to implement a threat intelligence program that includes a cross-organization information-sharing capability that can influence the development of the system and security architectures, selection of security solutions, monitoring, threat hunting, response and recovery activities.", "justification": "Threat Intelligence Program (THR-02) provides policy-level governance that compensates for the absence of Dynamic Threat Awareness (THR-03) by establishing documented expectations, accountability structures, and organizational guardrails. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "MON-02", "name": "Continuous Monitoring", "description": "Mechanisms exist to facilitate the implementation of enterprise-wide monitoring controls.", "justification": "Continuous Monitoring (MON-02) provides detective monitoring capability that compensates for the absence of Dynamic Threat Awareness (THR-03) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "THR-04", "risk_if_not_implemented": "Without Threat Intelligence Feeds, the organization's understanding of the threat environment may become stale, leaving defenses misaligned with active adversary tactics. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Exposure from Unaddressed Vulnerabilities (R-EX-6), Undetected / Delayed Detection of Adverse Activity (R-SA-1), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Data Quality Degradation / Data Poisoning (MT-12).", "compensating_control_1": { "control_id": "THR-02", "name": "Threat Intelligence Program", "description": "Mechanisms exist to implement a threat intelligence program that includes a cross-organization information-sharing capability that can influence the development of the system and security architectures, selection of security solutions, monitoring, threat hunting, response and recovery activities.", "justification": "Threat Intelligence Program (THR-02) provides policy-level governance that compensates for the absence of Threat Intelligence Feeds (THR-04) by establishing documented expectations, accountability structures, and organizational guardrails. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "MON-02", "name": "Continuous Monitoring", "description": "Mechanisms exist to facilitate the implementation of enterprise-wide monitoring controls.", "justification": "Continuous Monitoring (MON-02) provides detective monitoring capability that compensates for the absence of Threat Intelligence Feeds (THR-04) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "THR-05", "risk_if_not_implemented": "Without Threat Intelligence Reporting, the organization's understanding of the threat environment may become stale, leaving defenses misaligned with active adversary tactics. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Undetected / Delayed Detection of Adverse Activity (R-SA-1), and most likely increases susceptibility to Data Quality Degradation / Data Poisoning (MT-12).", "compensating_control_1": { "control_id": "MON-02", "name": "Continuous Monitoring", "description": "Mechanisms exist to facilitate the implementation of enterprise-wide monitoring controls.", "justification": "Continuous Monitoring (MON-02) provides detective monitoring capability that compensates for the absence of Threat Intelligence Reporting (THR-05) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "THR-04", "name": "Threat Intelligence Feeds", "description": "Mechanisms exist to maintain situational awareness of vulnerabilities and evolving threats by leveraging the knowledge of attacker tactics, techniques and procedures to facilitate the implementation of preventative and compensating controls.", "justification": "Threat Intelligence Feeds (THR-04) provides overlapping security capability that compensates for the absence of Threat Intelligence Reporting (THR-05) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "THR-06", "risk_if_not_implemented": "Without Threat Catalog, the organization's understanding of the threat environment may become stale, leaving defenses misaligned with active adversary tactics. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unaddressed Security / Compliance Exposure (R-GV-2), and most likely increases susceptibility to Human Error (MT-9).", "compensating_control_1": { "control_id": "THR-02", "name": "Threat Intelligence Program", "description": "Mechanisms exist to implement a threat intelligence program that includes a cross-organization information-sharing capability that can influence the development of the system and security architectures, selection of security solutions, monitoring, threat hunting, response and recovery activities.", "justification": "Threat Intelligence Program (THR-02) provides policy-level governance that compensates for the absence of Threat Catalog (THR-06) by establishing documented expectations, accountability structures, and organizational guardrails. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "RSK-13", "name": "Risk Assessment", "description": "Mechanisms exist to conduct recurring assessments of risk that includes the likelihood and magnitude of harm, from unauthorized access, use, disclosure, disruption, modification or destruction of the organization's Technology Assets, Applications, Services and/or Data (TAASD).", "justification": "Risk Assessment (RSK-13) provides periodic assessment and assurance that compensates for the absence of Threat Catalog (THR-06) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "THR-07", "risk_if_not_implemented": "Without Material Threats, the organization's understanding of the threat environment may become stale, leaving defenses misaligned with active adversary tactics. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unreliable Assurance / Decision Information (R-GV-10), and most likely increases susceptibility to Human Error (MT-9).", "compensating_control_1": { "control_id": "RSK-22", "name": "Risk Monitoring", "description": "Mechanisms exist to monitor risk as an integral part of the continuous monitoring strategy, including: \n(1) The effectiveness of security, compliance and resilience controls; \n(2) Changes to the organization's risk profile; and \n(3) Changes to Technology Assets, Applications and/or Services (TAAS) that affect risk.", "justification": "Risk Monitoring (RSK-22) provides detective monitoring capability that compensates for the absence of Material Threats (THR-07) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CPL-07", "name": "Executive Leadership Oversight of Security, Compliance & Resilience Controls", "description": "Mechanisms exist to provide a security, compliance and resilience controls oversight function that reports to the organization's executive leadership.", "justification": "Executive Leadership Oversight of Security, Compliance & Resilience Controls (CPL-07) provides resilience and recovery capability that compensates for the absence of Material Threats (THR-07) by ensuring the organization can restore operations and data when the primary control is absent. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "THR-08", "risk_if_not_implemented": "Without Threat Analysis, the organization's understanding of the threat environment may become stale, leaving defenses misaligned with active adversary tactics. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unreliable Assurance / Decision Information (R-GV-10), and most likely increases susceptibility to Human Error (MT-9).", "compensating_control_1": { "control_id": "RSK-13", "name": "Risk Assessment", "description": "Mechanisms exist to conduct recurring assessments of risk that includes the likelihood and magnitude of harm, from unauthorized access, use, disclosure, disruption, modification or destruction of the organization's Technology Assets, Applications, Services and/or Data (TAASD).", "justification": "Risk Assessment (RSK-13) provides periodic assessment and assurance that compensates for the absence of Threat Analysis (THR-08) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "THR-02", "name": "Threat Intelligence Program", "description": "Mechanisms exist to implement a threat intelligence program that includes a cross-organization information-sharing capability that can influence the development of the system and security architectures, selection of security solutions, monitoring, threat hunting, response and recovery activities.", "justification": "Threat Intelligence Program (THR-02) provides policy-level governance that compensates for the absence of Threat Analysis (THR-08) by establishing documented expectations, accountability structures, and organizational guardrails. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "THR-09", "risk_if_not_implemented": "Without Behavioral Baselining, malicious, anomalous or unauthorized activity may go undetected or be detected too late to prevent or limit harm. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Undetected / Delayed Detection of Adverse Activity (R-SA-1), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Technical / Mechanical Failure (MT-10), Data Quality Degradation / Data Poisoning (MT-12).", "compensating_control_1": { "control_id": "MON-16", "name": "Anomalous Behavior", "description": "Mechanisms exist to utilize User & Entity Behavior Analytics (UEBA) and/or User Activity Monitoring (UAM) solutions to detect and respond to anomalous behavior that could indicate account compromise or other malicious activities.", "justification": "Anomalous Behavior (MON-16) provides detective monitoring capability that compensates for the absence of Behavioral Baselining (THR-09) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "MON-02", "name": "Continuous Monitoring", "description": "Mechanisms exist to facilitate the implementation of enterprise-wide monitoring controls.", "justification": "Continuous Monitoring (MON-02) provides detective monitoring capability that compensates for the absence of Behavioral Baselining (THR-09) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "THR-10", "risk_if_not_implemented": "Without Predictive Cyber Analytics, the organization's understanding of the threat environment may become stale, leaving defenses misaligned with active adversary tactics. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Undetected / Delayed Detection of Adverse Activity (R-SA-1), and most likely increases susceptibility to Technical / Mechanical Failure (MT-10), Data Quality Degradation / Data Poisoning (MT-12).", "compensating_control_1": { "control_id": "THR-13", "name": "Threat Hunting", "description": "Mechanisms exist to perform cyber threat hunting that uses Indicators of Compromise (IoC) to detect, track and disrupt threats that evade existing security controls.", "justification": "Threat Hunting (THR-13) provides overlapping security capability that compensates for the absence of Predictive Cyber Analytics (THR-10) by addressing related risk objectives through an alternative control mechanism. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "MON-16", "name": "Anomalous Behavior", "description": "Mechanisms exist to utilize User & Entity Behavior Analytics (UEBA) and/or User Activity Monitoring (UAM) solutions to detect and respond to anomalous behavior that could indicate account compromise or other malicious activities.", "justification": "Anomalous Behavior (MON-16) provides detective monitoring capability that compensates for the absence of Predictive Cyber Analytics (THR-10) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "THR-11", "risk_if_not_implemented": "Without Indicators of Exposure (IOE), malicious, anomalous or unauthorized activity may go undetected or be detected too late to prevent or limit harm. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Exposure from Unaddressed Vulnerabilities (R-EX-6), and most likely increases susceptibility to Human Error (MT-9).", "compensating_control_1": { "control_id": "VPM-12", "name": "Vulnerability Scanning", "description": "Mechanisms exist to detect vulnerabilities and configuration errors by routine vulnerability scanning of systems and applications.", "justification": "Vulnerability Scanning (VPM-12) provides vulnerability management that compensates for the absence of Indicators of Exposure (IOE) (THR-11) by reducing the exploitable attack surface by addressing known weaknesses before they are leveraged. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "THR-02", "name": "Threat Intelligence Program", "description": "Mechanisms exist to implement a threat intelligence program that includes a cross-organization information-sharing capability that can influence the development of the system and security architectures, selection of security solutions, monitoring, threat hunting, response and recovery activities.", "justification": "Threat Intelligence Program (THR-11) provides policy-level governance that compensates for the absence of Indicators of Exposure (IOE) (THR-11) by establishing documented expectations, accountability structures, and organizational guardrails. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "THR-12", "risk_if_not_implemented": "Without Vulnerability Disclosure Program (VDP), known and exploitable vulnerabilities may remain unaddressed, giving adversaries readily available entry points. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Exposure from Unaddressed Vulnerabilities (R-EX-6), and most likely increases susceptibility to Human Error (MT-9).", "compensating_control_1": { "control_id": "VPM-06", "name": "Vulnerability Remediation Process", "description": "Mechanisms exist to ensure that vulnerabilities are properly identified, tracked and remediated.", "justification": "Vulnerability Remediation Process (VPM-06) provides vulnerability management that compensates for the absence of Vulnerability Disclosure Program (VDP) (THR-12) by reducing the exploitable attack surface by addressing known weaknesses before they are leveraged. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "VPM-12", "name": "Vulnerability Scanning", "description": "Mechanisms exist to detect vulnerabilities and configuration errors by routine vulnerability scanning of systems and applications.", "justification": "Vulnerability Scanning (VPM-12) provides vulnerability management that compensates for the absence of Vulnerability Disclosure Program (VDP) (THR-12) by reducing the exploitable attack surface by addressing known weaknesses before they are leveraged. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "THR-12.1", "risk_if_not_implemented": "Without Security Disclosure Contact Information, the organization's understanding of the threat environment may become stale, leaving defenses misaligned with active adversary tactics. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Exposure from Unaddressed Vulnerabilities (R-EX-6), and most likely increases susceptibility to Human Error (MT-9).", "compensating_control_1": { "control_id": "VPM-12", "name": "Vulnerability Scanning", "description": "Mechanisms exist to detect vulnerabilities and configuration errors by routine vulnerability scanning of systems and applications.", "justification": "Vulnerability Scanning (VPM-12) provides vulnerability management that compensates for the absence of Security Disclosure Contact Information (THR-12.1) by reducing the exploitable attack surface by addressing known weaknesses before they are leveraged. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "VPM-06", "name": "Vulnerability Remediation Process", "description": "Mechanisms exist to ensure that vulnerabilities are properly identified, tracked and remediated.", "justification": "Vulnerability Remediation Process (VPM-06) provides vulnerability management that compensates for the absence of Security Disclosure Contact Information (THR-12.1) by reducing the exploitable attack surface by addressing known weaknesses before they are leveraged. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "THR-13", "risk_if_not_implemented": "Without Threat Hunting, the organization's understanding of the threat environment may become stale, leaving defenses misaligned with active adversary tactics. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Undetected / Delayed Detection of Adverse Activity (R-SA-1), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9), Workforce Shortage / Loss of Critical Skills / Labor Disruption (MT-25).", "compensating_control_1": { "control_id": "MON-02", "name": "Continuous Monitoring", "description": "Mechanisms exist to facilitate the implementation of enterprise-wide monitoring controls.", "justification": "Continuous Monitoring (MON-02) provides detective monitoring capability that compensates for the absence of Threat Hunting (THR-13) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "THR-02", "name": "Threat Intelligence Program", "description": "Mechanisms exist to implement a threat intelligence program that includes a cross-organization information-sharing capability that can influence the development of the system and security architectures, selection of security solutions, monitoring, threat hunting, response and recovery activities.", "justification": "Threat Intelligence Program (THR-02) provides policy-level governance that compensates for the absence of Threat Hunting (THR-13) by establishing documented expectations, accountability structures, and organizational guardrails. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "THR-14", "risk_if_not_implemented": "Without Tainting, the organization's understanding of the threat environment may become stale, leaving defenses misaligned with active adversary tactics. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss of Accountability / Attribution (R-AC-1), Undetected / Delayed Detection of Adverse Activity (R-SA-1), and most likely increases susceptibility to Human Error (MT-9).", "compensating_control_1": { "control_id": "MON-34", "name": "Non-Repudiation", "description": "Mechanisms exist to utilize a non-repudiation capability to protect against an individual falsely denying having performed a particular action.", "justification": "Non-Repudiation (MON-34) provides overlapping security capability that compensates for the absence of Tainting (THR-14) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "MON-18.1", "name": "Session Audit", "description": "Mechanisms exist to provide session audit capabilities that can: \n(1) Capture and log all content related to a user session; and\n(2) Remotely view all content related to an established user session in real time.", "justification": "Session Audit (MON-18.1) provides detective monitoring capability that compensates for the absence of Tainting (THR-14) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "THR-15", "risk_if_not_implemented": "Without Insider Threat Program, trusted insiders may misuse access or act on conflicts of interest without detection or deterrence. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to System / Data Compromise (Non-Technical Vector) (R-BC-5), Unperformed / Unowned Control Responsibilities (R-GV-3), Uncontrolled Internal Security / Privacy Exposure (R-GV-4), Delayed Containment / Increased Incident Impact (R-IR-2), and most likely increases susceptibility to Human Error (MT-9), Fraud, Corruption and/or Intentional Criminal Conduct (MT-14), Conflict of Interest (COI) / Undue Influence / Insider Misconduct (MT-15).", "compensating_control_1": { "control_id": "HRS-18", "name": "Reporting Suspicious Activities", "description": "Mechanisms exist to enable personnel to report suspicious activities and/or behavior without fear of reprisal or other negative consequences (e.g., whistleblower protections).", "justification": "Reporting Suspicious Activities (HRS-18) provides overlapping security capability that compensates for the absence of Insider Threat Program (THR-04) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "MON-16", "name": "Anomalous Behavior", "description": "Mechanisms exist to utilize User & Entity Behavior Analytics (UEBA) and/or User Activity Monitoring (UAM) solutions to detect and respond to anomalous behavior that could indicate account compromise or other malicious activities.", "justification": "Anomalous Behavior (MON-16) provides detective monitoring capability that compensates for the absence of Insider Threat Program (THR-04) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "THR-16", "risk_if_not_implemented": "Without Insider Threat Awareness, trusted insiders may misuse access or act on conflicts of interest without detection or deterrence. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Lack of a security-minded workforce (R-SA-2), and most likely increases susceptibility to Human Error (MT-9).", "compensating_control_1": { "control_id": "SAT-04", "name": "Security, Compliance & Resilience Awareness Training", "description": "Mechanisms exist to provide all employees and contractors appropriate security, compliance and resilience awareness education and training that is relevant for their job function.", "justification": "Security, Compliance & Resilience Awareness Training (SAT-04) provides personnel training and awareness that compensates for the absence of Insider Threat Awareness (THR-16) by reducing human-factor risk by equipping personnel to recognize and respond to relevant threats. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "HRS-18", "name": "Reporting Suspicious Activities", "description": "Mechanisms exist to enable personnel to report suspicious activities and/or behavior without fear of reprisal or other negative consequences (e.g., whistleblower protections).", "justification": "Reporting Suspicious Activities (HRS-18) provides overlapping security capability that compensates for the absence of Insider Threat Awareness (THR-16) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "VPM-02", "risk_if_not_implemented": "Without Vulnerability & Patch Management Program (VPMP), known and exploitable vulnerabilities may remain unaddressed, giving adversaries readily available entry points. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Exposure from Unaddressed Vulnerabilities (R-EX-6), Uncontrolled Internal Security / Privacy Exposure (R-GV-4), and most likely increases susceptibility to Human Error (MT-9).", "compensating_control_1": { "control_id": "CFG-04", "name": "Secure Baseline Configurations", "description": "Mechanisms exist to develop, document and maintain secure baseline configurations for Technology Assets, Applications and/or Services (TAAS) that are consistent with industry-accepted hardening standards.", "justification": "Secure Baseline Configurations (CFG-04) provides configuration hardening that compensates for the absence of Vulnerability & Patch Management Program (VPMP) (VPM-02) by eliminating unnecessary services and enforcing secure settings to reduce inherent exposure. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "NET-03", "name": "Boundary Protection", "description": "Mechanisms exist to monitor and control communications at the external network boundary and at key internal boundaries within the network.", "justification": "Boundary Protection (NET-03) provides network-level access restriction that compensates for the absence of Vulnerability & Patch Management Program (VPMP) (VPM-02) by limiting attacker reach and lateral movement opportunities across the environment. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "VPM-03", "risk_if_not_implemented": "Without Attack Surface Scope, known and exploitable vulnerabilities may remain unaddressed, giving adversaries readily available entry points. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Exposure from Unaddressed Vulnerabilities (R-EX-6), Unaddressed Security / Compliance Exposure (R-GV-2), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9).", "compensating_control_1": { "control_id": "VPM-12", "name": "Vulnerability Scanning", "description": "Mechanisms exist to detect vulnerabilities and configuration errors by routine vulnerability scanning of systems and applications.", "justification": "Vulnerability Scanning (VPM-12) provides vulnerability management that compensates for the absence of Attack Surface Scope (VPM-03) by reducing the exploitable attack surface by addressing known weaknesses before they are leveraged. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "VPM-06", "name": "Vulnerability Remediation Process", "description": "Mechanisms exist to ensure that vulnerabilities are properly identified, tracked and remediated.", "justification": "Vulnerability Remediation Process (VPM-06) provides vulnerability management that compensates for the absence of Attack Surface Scope (VPM-03) by reducing the exploitable attack surface by addressing known weaknesses before they are leveraged. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "VPM-04", "risk_if_not_implemented": "Without Vulnerability Exploitation Analysis, known and exploitable vulnerabilities may remain unaddressed, giving adversaries readily available entry points. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Exposure from Unaddressed Vulnerabilities (R-EX-6), Unreliable Assurance / Decision Information (R-GV-10), and most likely increases susceptibility to Human Error (MT-9), Data Quality Degradation / Data Poisoning (MT-12).", "compensating_control_1": { "control_id": "VPM-06", "name": "Vulnerability Remediation Process", "description": "Mechanisms exist to ensure that vulnerabilities are properly identified, tracked and remediated.", "justification": "Vulnerability Remediation Process (VPM-06) provides vulnerability management that compensates for the absence of Vulnerability Exploitation Analysis (VPM-04) by reducing the exploitable attack surface by addressing known weaknesses before they are leveraged. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "RSK-15", "name": "Risk Ranking", "description": "Mechanisms exist to identify and assign a risk ranking to newly discovered security vulnerabilities that is based on industry-recognized practices.", "justification": "Risk Ranking (RSK-15) provides risk identification and prioritization that compensates for the absence of Vulnerability Exploitation Analysis (VPM-04) by enabling informed decisions about where to focus resources to manage residual exposure. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "VPM-05", "risk_if_not_implemented": "Without Vulnerability Ranking, known and exploitable vulnerabilities may remain unaddressed, giving adversaries readily available entry points. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Exposure from Unaddressed Vulnerabilities (R-EX-6), Unreliable Assurance / Decision Information (R-GV-10), and most likely increases susceptibility to Human Error (MT-9), Data Quality Degradation / Data Poisoning (MT-12).", "compensating_control_1": { "control_id": "RSK-15", "name": "Risk Ranking", "description": "Mechanisms exist to identify and assign a risk ranking to newly discovered security vulnerabilities that is based on industry-recognized practices.", "justification": "Risk Ranking (RSK-15) provides risk identification and prioritization that compensates for the absence of Vulnerability Ranking (VPM-05) by enabling informed decisions about where to focus resources to manage residual exposure. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "VPM-06", "name": "Vulnerability Remediation Process", "description": "Mechanisms exist to ensure that vulnerabilities are properly identified, tracked and remediated.", "justification": "Vulnerability Remediation Process (VPM-06) provides vulnerability management that compensates for the absence of Vulnerability Ranking (VPM-05) by reducing the exploitable attack surface by addressing known weaknesses before they are leveraged. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "VPM-06.1", "risk_if_not_implemented": "Without Centralized Management of Flaw Remediation Processes, sensitive and/or regulated data may be disclosed, altered or lost through inadequate classification, handling or protection. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to System / Data Compromise (Technical Vector) (R-BC-4), Exposure from Unaddressed Vulnerabilities (R-EX-6), System / Service Compromise (R-EX-7), Lack of oversight of internal controls (R-GV-6), Incident Persistence / Recurrence (R-IR-3), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "CFG-08.2", "name": "Integrity Assurance & Enforcement (IAE)", "description": "Automated mechanisms exist to:\n(1) Identify unauthorized deviations from an approved secure baseline configuration; and\n(2) Implement automated resiliency actions to remediate the unauthorized change.", "justification": "Integrity Assurance & Enforcement (IAE) (CFG-08.2) provides configuration hardening that compensates for the absence of Centralized Management of Flaw Remediation Processes (VPM-06.1) by eliminating unnecessary services and enforcing secure settings to reduce inherent exposure. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "VPM-08", "name": "Software & Firmware Patching", "description": "Mechanisms exist to conduct software patching for all deployed Technology Assets, Applications and/or Services (TAAS), including firmware.", "justification": "Software & Firmware Patching (VPM-08) provides vulnerability management that compensates for the absence of Centralized Management of Flaw Remediation Processes (VPM-06.1) by reducing the exploitable attack surface by addressing known weaknesses before they are leveraged. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "VPM-06.2", "risk_if_not_implemented": "Without Continuous Vulnerability Remediation Activities, known and exploitable vulnerabilities may remain unaddressed, giving adversaries readily available entry points. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to System / Data Compromise (Technical Vector) (R-BC-4), Exposure from Unaddressed Vulnerabilities (R-EX-6), System / Service Compromise (R-EX-7), Incident Persistence / Recurrence (R-IR-3), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "VPM-08", "name": "Software & Firmware Patching", "description": "Mechanisms exist to conduct software patching for all deployed Technology Assets, Applications and/or Services (TAAS), including firmware.", "justification": "Software & Firmware Patching (VPM-08) provides vulnerability management that compensates for the absence of Continuous Vulnerability Remediation Activities (VPM-06.2) by reducing the exploitable attack surface by addressing known weaknesses before they are leveraged. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "MON-02", "name": "Continuous Monitoring", "description": "Mechanisms exist to facilitate the implementation of enterprise-wide monitoring controls.", "justification": "Continuous Monitoring (MON-02) provides detective monitoring capability that compensates for the absence of Continuous Vulnerability Remediation Activities (VPM-06.2) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "VPM-06.3", "risk_if_not_implemented": "Without Known Exploited Vulnerabilities (KEV) Mitigations, known and exploitable vulnerabilities may remain unaddressed, giving adversaries readily available entry points. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to System / Data Compromise (Technical Vector) (R-BC-4), Exposure from Unaddressed Vulnerabilities (R-EX-6), System / Service Compromise (R-EX-7), Incident Persistence / Recurrence (R-IR-3), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "VPM-06", "name": "Vulnerability Remediation Process", "description": "Mechanisms exist to ensure that vulnerabilities are properly identified, tracked and remediated.", "justification": "Vulnerability Remediation Process (VPM-06) provides vulnerability management that compensates for the absence of Known Exploited Vulnerabilities (KEV) Mitigations (VPM-06.3) by reducing the exploitable attack surface by addressing known weaknesses and prioritizing critical remediations. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "NET-03", "name": "Boundary Protection", "description": "Mechanisms exist to monitor and control communications at the external network boundary and at key internal boundaries within the network.", "justification": "Boundary Protection (NET-03) provides network-level access restriction that compensates for the absence of Known Exploited Vulnerabilities (KEV) Mitigations (VPM-06.3) by limiting attacker reach and lateral movement opportunities across the environment. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "VPM-07", "risk_if_not_implemented": "Without Time To Remediate / Benchmarks For Corrective Action, sensitive and/or regulated data may be disclosed, altered or lost through inadequate classification, handling or protection. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Lack of oversight of internal controls (R-GV-6), Inability to Demonstrate Due Diligence / Due Care (R-GV-9), Unreliable Assurance / Decision Information (R-GV-10), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Data Quality Degradation / Data Poisoning (MT-12).", "compensating_control_1": { "control_id": "VPM-08", "name": "Software & Firmware Patching", "description": "Mechanisms exist to conduct software patching for all deployed Technology Assets, Applications and/or Services (TAAS), including firmware.", "justification": "Software & Firmware Patching (VPM-08) provides vulnerability management that compensates for the absence of Time To Remediate / Benchmarks For Corrective Action (VPM-07) by reducing the exploitable attack surface by addressing known weaknesses before they are leveraged. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "VPM-12", "name": "Vulnerability Scanning", "description": "Mechanisms exist to detect vulnerabilities and configuration errors by routine vulnerability scanning of systems and applications.", "justification": "Vulnerability Scanning (VPM-12) provides vulnerability management that compensates for the absence of Time To Remediate / Benchmarks For Corrective Action (VPM-07) by reducing the exploitable attack surface by addressing known weaknesses before they are leveraged. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "VPM-08.1", "risk_if_not_implemented": "Without Automated Software & Firmware Updates, embedded and IoT technologies may operate with unknown, insecure or unmonitored configurations, creating exploitable footholds. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to System / Data Compromise (Technical Vector) (R-BC-4), Exposure from Unaddressed Vulnerabilities (R-EX-6), System / Service Compromise (R-EX-7), Incident Persistence / Recurrence (R-IR-3), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Technical / Mechanical Failure (MT-10), Geopolitical Conflict / Government Intervention (MT-18).", "compensating_control_1": { "control_id": "VPM-12", "name": "Vulnerability Scanning", "description": "Mechanisms exist to detect vulnerabilities and configuration errors by routine vulnerability scanning of systems and applications.", "justification": "Vulnerability Scanning (VPM-12) provides vulnerability management that compensates for the absence of Automated Software & Firmware Updates (VPM-08.1) by reducing the exploitable attack surface by addressing known weaknesses before they are leveraged. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "VPM-08", "name": "Software & Firmware Patching", "description": "Mechanisms exist to conduct software patching for all deployed Technology Assets, Applications and/or Services (TAAS), including firmware.", "justification": "Software & Firmware Patching (VPM-08) provides vulnerability management that compensates for the absence of Automated Software & Firmware Updates (VPM-08.1) by reducing the exploitable attack surface by addressing known weaknesses before they are leveraged. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "VPM-08.2", "risk_if_not_implemented": "Without Software Patch Integrity, known and exploitable vulnerabilities may remain unaddressed, giving adversaries readily available entry points. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to R-AM-2, R-BC-4, R-EX-7, R-SC-1, R-SC-7, R-IP-5, and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9), Technical / Mechanical Failure (MT-10), Geopolitical Conflict / Government Intervention (MT-18), Counterfeit / Non-Conforming Products (MT-20).", "compensating_control_1": { "control_id": "CFG-04", "name": "Secure Baseline Configurations", "description": "Mechanisms exist to develop, document and maintain secure baseline configurations for Technology Assets, Applications and/or Services (TAAS) that are consistent with industry-accepted hardening standards.", "justification": "Secure Baseline Configurations (CFG-04) provides configuration hardening that compensates for the absence of Software Patch Integrity (VPM-08.2) by eliminating unnecessary services and enforcing secure settings to reduce inherent exposure. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "VPM-08", "name": "Software & Firmware Patching", "description": "Mechanisms exist to conduct software patching for all deployed Technology Assets, Applications and/or Services (TAAS), including firmware.", "justification": "Software & Firmware Patching (VPM-08) provides vulnerability management that compensates for the absence of Software Patch Integrity (VPM-08.2) by reducing the exploitable attack surface by addressing known weaknesses before they are leveraged. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "VPM-08.3", "risk_if_not_implemented": "Without Automated Remediation Status, sensitive and/or regulated data may be disclosed, altered or lost through inadequate classification, handling or protection. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Exposure from Unaddressed Vulnerabilities (R-EX-6), Lack of oversight of internal controls (R-GV-6), Unreliable Assurance / Decision Information (R-GV-10), and most likely increases susceptibility to Technical / Mechanical Failure (MT-10), Data Quality Degradation / Data Poisoning (MT-12).", "compensating_control_1": { "control_id": "CFG-04", "name": "Secure Baseline Configurations", "description": "Mechanisms exist to develop, document and maintain secure baseline configurations for Technology Assets, Applications and/or Services (TAAS) that are consistent with industry-accepted hardening standards.", "justification": "Secure Baseline Configurations (CFG-04) provides configuration hardening that compensates for the absence of Automated Remediation Status (VPM-08.3) by eliminating unnecessary services and enforcing secure settings to reduce inherent exposure. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "VPM-08", "name": "Software & Firmware Patching", "description": "Mechanisms exist to conduct software patching for all deployed Technology Assets, Applications and/or Services (TAAS), including firmware.", "justification": "Software & Firmware Patching (VPM-08) provides vulnerability management that compensates for the absence of Automated Remediation Status (VPM-08.3) by reducing the exploitable attack surface by addressing known weaknesses before they are leveraged. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "VPM-09", "risk_if_not_implemented": "Without Deferred Patching Decisions, known and exploitable vulnerabilities may remain unaddressed, giving adversaries readily available entry points. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Exposure from Unaddressed Vulnerabilities (R-EX-6), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9).", "compensating_control_1": { "control_id": "VPM-08", "name": "Software & Firmware Patching", "description": "Mechanisms exist to conduct software patching for all deployed Technology Assets, Applications and/or Services (TAAS), including firmware.", "justification": "Software & Firmware Patching (VPM-08) provides vulnerability management that compensates for the absence of Deferred Patching Decisions (VPM-09) by reducing the exploitable attack surface by addressing known weaknesses before they are leveraged. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "VPM-06.2", "name": "Continuous Vulnerability Remediation Activities", "description": "Mechanisms exist to address new threats and vulnerabilities on an ongoing basis and ensure assets are protected against known attacks.", "justification": "Continuous Vulnerability Remediation Activities (VPM-06.2) provides vulnerability management that compensates for the absence of Deferred Patching Decisions (VPM-09) by reducing the exploitable attack surface by addressing known weaknesses before they are leveraged. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "VPM-10", "risk_if_not_implemented": "Without Pre-Deployment Patch Testing, known and exploitable vulnerabilities may remain unaddressed, giving adversaries readily available entry points. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Modification / Loss of System Integrity (R-AM-2), Business / Service Interruption (R-BC-1), Inability to Demonstrate Due Diligence / Due Care (R-GV-9), and most likely increases susceptibility to Human Error (MT-9), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "VPM-12", "name": "Vulnerability Scanning", "description": "Mechanisms exist to detect vulnerabilities and configuration errors by routine vulnerability scanning of systems and applications.", "justification": "Vulnerability Scanning (VPM-12) provides vulnerability management that compensates for the absence of Pre-Deployment Patch Testing (VPM-10) by reducing the exploitable attack surface by addressing known weaknesses before they are leveraged. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CFG-04", "name": "Secure Baseline Configurations", "description": "Mechanisms exist to develop, document and maintain secure baseline configurations for Technology Assets, Applications and/or Services (TAAS) that are consistent with industry-accepted hardening standards.", "justification": "Secure Baseline Configurations (CFG-04) provides configuration hardening that compensates for the absence of Pre-Deployment Patch Testing (VPM-10) by eliminating unnecessary services and enforcing secure settings to reduce inherent exposure. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "VPM-11", "risk_if_not_implemented": "Without Out-of-Cycle Patching, known and exploitable vulnerabilities may remain unaddressed, giving adversaries readily available entry points. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Exposure from Unaddressed Vulnerabilities (R-EX-6), Delayed Containment / Increased Incident Impact (R-IR-2), and most likely increases susceptibility to Human Error (MT-9), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "VPM-08", "name": "Software & Firmware Patching", "description": "Mechanisms exist to conduct software patching for all deployed Technology Assets, Applications and/or Services (TAAS), including firmware.", "justification": "Software & Firmware Patching (VPM-08) provides vulnerability management that compensates for the absence of Out-of-Cycle Patching (VPM-11) by reducing the exploitable attack surface by addressing known weaknesses before they are leveraged. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CFG-04", "name": "Secure Baseline Configurations", "description": "Mechanisms exist to develop, document and maintain secure baseline configurations for Technology Assets, Applications and/or Services (TAAS) that are consistent with industry-accepted hardening standards.", "justification": "Secure Baseline Configurations (CFG-04) provides configuration hardening that compensates for the absence of Out-of-Cycle Patching (VPM-11) by eliminating unnecessary services and enforcing secure settings to reduce inherent exposure. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "VPM-12", "risk_if_not_implemented": "Without Vulnerability Scanning, known and exploitable vulnerabilities may remain unaddressed, giving adversaries readily available entry points. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Exposure from Unaddressed Vulnerabilities (R-EX-6), and most likely increases susceptibility to Human Error (MT-9), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "VPM-06", "name": "Vulnerability Remediation Process", "description": "Mechanisms exist to ensure that vulnerabilities are properly identified, tracked and remediated.", "justification": "Vulnerability Remediation Process (VPM-12) provides vulnerability management that compensates for the absence of Vulnerability Scanning (VPM-12) by reducing the exploitable attack surface by addressing known weaknesses before they are leveraged. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "MON-02", "name": "Continuous Monitoring", "description": "Mechanisms exist to facilitate the implementation of enterprise-wide monitoring controls.", "justification": "Continuous Monitoring (MON-02) provides detective monitoring capability that compensates for the absence of Vulnerability Scanning (VPM-12) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "VPM-12.1", "risk_if_not_implemented": "Without Update Vulnerability Scanning Tools, known and exploitable vulnerabilities may remain unaddressed, giving adversaries readily available entry points. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Exposure from Unaddressed Vulnerabilities (R-EX-6), and most likely increases susceptibility to Human Error (MT-9), Technical / Mechanical Failure (MT-10), Data Quality Degradation / Data Poisoning (MT-12).", "compensating_control_1": { "control_id": "MON-02", "name": "Continuous Monitoring", "description": "Mechanisms exist to facilitate the implementation of enterprise-wide monitoring controls.", "justification": "Continuous Monitoring (MON-02) provides detective monitoring capability that compensates for the absence of Update Tool Capability (VPM-12.1) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "VPM-06", "name": "Vulnerability Remediation Process", "description": "Mechanisms exist to ensure that vulnerabilities are properly identified, tracked and remediated.", "justification": "Vulnerability Remediation Process (VPM-06) provides vulnerability management that compensates for the absence of Update Tool Capability (VPM-12.1) by reducing the exploitable attack surface by addressing known weaknesses before they are leveraged. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "VPM-12.2", "risk_if_not_implemented": "Without Breadth / Depth of Coverage For Vulnerability Scanning, known and exploitable vulnerabilities may remain unaddressed, giving adversaries readily available entry points. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Exposure from Unaddressed Vulnerabilities (R-EX-6), Unaddressed Security / Compliance Exposure (R-GV-2), and most likely increases susceptibility to Human Error (MT-9).", "compensating_control_1": { "control_id": "VPM-06", "name": "Vulnerability Remediation Process", "description": "Mechanisms exist to ensure that vulnerabilities are properly identified, tracked and remediated.", "justification": "Vulnerability Remediation Process (VPM-06) provides vulnerability management that compensates for the absence of Breadth / Depth of Coverage (VPM-12.2) by reducing the exploitable attack surface by addressing known weaknesses before they are leveraged. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "VPM-12", "name": "Vulnerability Scanning", "description": "Mechanisms exist to detect vulnerabilities and configuration errors by routine vulnerability scanning of systems and applications.", "justification": "Vulnerability Scanning (VPM-12) provides vulnerability management that compensates for the absence of Breadth / Depth of Coverage (VPM-12.2) by reducing the exploitable attack surface by addressing known weaknesses before they are leveraged. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "VPM-12.3", "risk_if_not_implemented": "Without Privileged Access For Vulnerability Scanning Tools, users, services and processes may obtain or retain access beyond authorized need, enabling misuse or escalation. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Excessive or Unauthorized Privilege (R-AC-2), Unauthorized Access (R-AC-4), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9).", "compensating_control_1": { "control_id": "VPM-12", "name": "Vulnerability Scanning", "description": "Mechanisms exist to detect vulnerabilities and configuration errors by routine vulnerability scanning of systems and applications.", "justification": "Vulnerability Scanning (VPM-12) provides vulnerability management that compensates for the absence of Privileged Access (VPM-12.3) by reducing the exploitable attack surface by addressing known weaknesses before they are leveraged. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "VPM-06", "name": "Vulnerability Remediation Process", "description": "Mechanisms exist to ensure that vulnerabilities are properly identified, tracked and remediated.", "justification": "Vulnerability Remediation Process (VPM-06) provides vulnerability management that compensates for the absence of Privileged Access (VPM-12.3) by reducing the exploitable attack surface by addressing known weaknesses before they are leveraged. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "VPM-12.4", "risk_if_not_implemented": "Without Reviewing Vulnerability Scanner Usage, known and exploitable vulnerabilities may remain unaddressed, giving adversaries readily available entry points. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Undetected / Delayed Detection of Adverse Activity (R-SA-1), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "IAC-30", "name": "Least Privilege", "description": "Mechanisms exist to utilize the concept of least privilege, allowing only authorized access to processes necessary to accomplish assigned tasks in accordance with organizational business functions.", "justification": "Least Privilege (IAC-30) provides access control enforcement that compensates for the absence of Reviewing Vulnerability Scanner Usage (VPM-12.4) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CPL-05", "name": "Conformity Monitoring", "description": "Mechanisms exist to validate that Technology Assets, Applications, Services and/or Data (TAASD) conform to the organization's security, compliance and/or resilience policies, standards and other applicable requirements.", "justification": "Conformity Monitoring (CPL-05) provides periodic assessment and assurance that compensates for the absence of Reviewing Vulnerability Scanner Usage (VPM-12.4) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "VPM-13", "risk_if_not_implemented": "Without Vulnerability Trend Analysis, known and exploitable vulnerabilities may remain unaddressed, giving adversaries readily available entry points. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unreliable Assurance / Decision Information (R-GV-10), and most likely increases susceptibility to Technical / Mechanical Failure (MT-10), Data Quality Degradation / Data Poisoning (MT-12).", "compensating_control_1": { "control_id": "MON-02", "name": "Continuous Monitoring", "description": "Mechanisms exist to facilitate the implementation of enterprise-wide monitoring controls.", "justification": "Continuous Monitoring (MON-02) provides detective monitoring capability that compensates for the absence of Trend Analysis (VPM-13) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "VPM-12", "name": "Vulnerability Scanning", "description": "Mechanisms exist to detect vulnerabilities and configuration errors by routine vulnerability scanning of systems and applications.", "justification": "Vulnerability Scanning (VPM-12) provides vulnerability management that compensates for the absence of Trend Analysis (VPM-13) by reducing the exploitable attack surface by addressing known weaknesses before they are leveraged. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "VPM-13.1", "risk_if_not_implemented": "Without Review Historical Event logs, malicious, anomalous or unauthorized activity may go undetected or be detected too late to prevent or limit harm. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss of Investigative / Evidentiary Capability (R-IR-1), Undetected / Delayed Detection of Adverse Activity (R-SA-1), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9).", "compensating_control_1": { "control_id": "VPM-12", "name": "Vulnerability Scanning", "description": "Mechanisms exist to detect vulnerabilities and configuration errors by routine vulnerability scanning of systems and applications.", "justification": "Vulnerability Scanning (VPM-12) provides vulnerability management that compensates for the absence of Review Historical Event logs (VPM-13.1) by reducing the exploitable attack surface by addressing known weaknesses before they are leveraged. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "MON-02", "name": "Continuous Monitoring", "description": "Mechanisms exist to facilitate the implementation of enterprise-wide monitoring controls.", "justification": "Continuous Monitoring (MON-02) provides detective monitoring capability that compensates for the absence of Review Historical Event logs (VPM-13.1) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "VPM-14", "risk_if_not_implemented": "Without External Vulnerability Assessment, known and exploitable vulnerabilities may remain unaddressed, giving adversaries readily available entry points. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Exposure from Unaddressed Vulnerabilities (R-EX-6), and most likely increases susceptibility to Human Error (MT-9), Technical / Mechanical Failure (MT-10), Supplier Financial Distress / Insolvency (MT-24).", "compensating_control_1": { "control_id": "VPM-06", "name": "Vulnerability Remediation Process", "description": "Mechanisms exist to ensure that vulnerabilities are properly identified, tracked and remediated.", "justification": "Vulnerability Remediation Process (VPM-06) provides vulnerability management that compensates for the absence of External Vulnerability Assessment Scans (VPM-14) by reducing the exploitable attack surface by addressing known weaknesses before they are leveraged. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "VPM-12", "name": "Vulnerability Scanning", "description": "Mechanisms exist to detect vulnerabilities and configuration errors by routine vulnerability scanning of systems and applications.", "justification": "Vulnerability Scanning (VPM-12) provides vulnerability management that compensates for the absence of External Vulnerability Assessment Scans (VPM-14) by reducing the exploitable attack surface by addressing known weaknesses before they are leveraged. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "VPM-15", "risk_if_not_implemented": "Without Internal Vulnerability Assessment, known and exploitable vulnerabilities may remain unaddressed, giving adversaries readily available entry points. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Exposure from Unaddressed Vulnerabilities (R-EX-6), and most likely increases susceptibility to Human Error (MT-9), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "VPM-12", "name": "Vulnerability Scanning", "description": "Mechanisms exist to detect vulnerabilities and configuration errors by routine vulnerability scanning of systems and applications.", "justification": "Vulnerability Scanning (VPM-12) provides vulnerability management that compensates for the absence of Internal Vulnerability Assessment Scans (VPM-15) by reducing the exploitable attack surface by addressing known weaknesses before they are leveraged. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "VPM-06", "name": "Vulnerability Remediation Process", "description": "Mechanisms exist to ensure that vulnerabilities are properly identified, tracked and remediated.", "justification": "Vulnerability Remediation Process (VPM-06) provides vulnerability management that compensates for the absence of Internal Vulnerability Assessment Scans (VPM-15) by reducing the exploitable attack surface by addressing known weaknesses before they are leveraged. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "VPM-16", "risk_if_not_implemented": "Without Acceptable Discoverable Information, known and exploitable vulnerabilities may remain unaddressed, giving adversaries readily available entry points. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Loss of Confidentiality (R-IP-2), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9).", "compensating_control_1": { "control_id": "MON-02", "name": "Continuous Monitoring", "description": "Mechanisms exist to facilitate the implementation of enterprise-wide monitoring controls.", "justification": "Continuous Monitoring (MON-02) provides detective monitoring capability that compensates for the absence of Acceptable Discoverable Information (VPM-16) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "VPM-12", "name": "Vulnerability Scanning", "description": "Mechanisms exist to detect vulnerabilities and configuration errors by routine vulnerability scanning of systems and applications.", "justification": "Vulnerability Scanning (VPM-12) provides vulnerability management that compensates for the absence of Acceptable Discoverable Information (VPM-16) by reducing the exploitable attack surface by addressing known weaknesses before they are leveraged. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "VPM-17", "risk_if_not_implemented": "Without Correlate Scanning Information, known and exploitable vulnerabilities may remain unaddressed, giving adversaries readily available entry points. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Exposure from Unaddressed Vulnerabilities (R-EX-6), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Technical / Mechanical Failure (MT-10), Data Quality Degradation / Data Poisoning (MT-12).", "compensating_control_1": { "control_id": "VPM-12", "name": "Vulnerability Scanning", "description": "Mechanisms exist to detect vulnerabilities and configuration errors by routine vulnerability scanning of systems and applications.", "justification": "Vulnerability Scanning (VPM-12) provides vulnerability management that compensates for the absence of Correlate Scanning Information (VPM-17) by reducing the exploitable attack surface by addressing known weaknesses before they are leveraged. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "MON-02", "name": "Continuous Monitoring", "description": "Mechanisms exist to facilitate the implementation of enterprise-wide monitoring controls.", "justification": "Continuous Monitoring (MON-02) provides detective monitoring capability that compensates for the absence of Correlate Scanning Information (VPM-17) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "VPM-18", "risk_if_not_implemented": "Without Penetration Testing, known and exploitable vulnerabilities may remain unaddressed, giving adversaries readily available entry points. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Exposure from Unaddressed Vulnerabilities (R-EX-6), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9), Workforce Shortage / Loss of Critical Skills / Labor Disruption (MT-25).", "compensating_control_1": { "control_id": "VPM-12", "name": "Vulnerability Scanning", "description": "Mechanisms exist to detect vulnerabilities and configuration errors by routine vulnerability scanning of systems and applications.", "justification": "Vulnerability Scanning (VPM-12) provides vulnerability management that compensates for the absence of Penetration Testing (VPM-18) by reducing the exploitable attack surface by addressing known weaknesses before they are leveraged. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CPL-05", "name": "Conformity Monitoring", "description": "Mechanisms exist to validate that Technology Assets, Applications, Services and/or Data (TAASD) conform to the organization's security, compliance and/or resilience policies, standards and other applicable requirements.", "justification": "Conformity Monitoring (CPL-05) provides periodic assessment and assurance that compensates for the absence of Penetration Testing (VPM-18) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "VPM-19", "risk_if_not_implemented": "Without Independent Penetration Agent or Team, AI and autonomous systems may produce unreliable, biased or unsafe outputs, act outside authorized scope, or expose sensitive data. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unreliable Assurance / Decision Information (R-GV-10), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9), Conflict of Interest (COI) / Undue Influence / Insider Misconduct (MT-15), Workforce Shortage / Loss of Critical Skills / Labor Disruption (MT-25).", "compensating_control_1": { "control_id": "CPL-05", "name": "Conformity Monitoring", "description": "Mechanisms exist to validate that Technology Assets, Applications, Services and/or Data (TAASD) conform to the organization's security, compliance and/or resilience policies, standards and other applicable requirements.", "justification": "Conformity Monitoring (CPL-05) provides periodic assessment and assurance that compensates for the absence of Independent Penetration Agent or Team (VPM-19) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "VPM-18", "name": "Penetration Testing", "description": "Mechanisms exist to conduct penetration testing on Technology Assets, Applications and/or Services (TAAS).", "justification": "Penetration Testing (VPM-18) provides periodic assessment and assurance that compensates for the absence of Independent Penetration Agent or Team (VPM-19) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "VPM-20", "risk_if_not_implemented": "Without Technical Surveillance Countermeasures Security, unauthorized individuals may gain physical access to facilities and equipment, enabling theft, tampering, damage or safety incidents. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Intellectual Property / Trade Secret Loss (R-EX-9), Undetected / Delayed Detection of Adverse Activity (R-SA-1), Loss of Confidentiality (R-IP-2), and most likely increases susceptibility to Human Error (MT-9), Workforce Shortage / Loss of Critical Skills / Labor Disruption (MT-25).", "compensating_control_1": { "control_id": "MON-02", "name": "Continuous Monitoring", "description": "Mechanisms exist to facilitate the implementation of enterprise-wide monitoring controls.", "justification": "Continuous Monitoring (MON-02) provides detective monitoring capability that compensates for the absence of Technical Surveillance Countermeasures Security (VPM-20) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "VPM-18", "name": "Penetration Testing", "description": "Mechanisms exist to conduct penetration testing on Technology Assets, Applications and/or Services (TAAS).", "justification": "Penetration Testing (VPM-18) provides periodic assessment and assurance that compensates for the absence of Technical Surveillance Countermeasures Security (VPM-20) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "VPM-21", "risk_if_not_implemented": "Without Red Team Exercises, personnel are more likely to make unsafe decisions, fall victim to social engineering, mishandle data or violate requirements. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Exposure from Unaddressed Vulnerabilities (R-EX-6), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9), Workforce Shortage / Loss of Critical Skills / Labor Disruption (MT-25).", "compensating_control_1": { "control_id": "VPM-18", "name": "Penetration Testing", "description": "Mechanisms exist to conduct penetration testing on Technology Assets, Applications and/or Services (TAAS).", "justification": "Penetration Testing (VPM-18) provides periodic assessment and assurance that compensates for the absence of Red Team Exercises (VPM-21) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CPL-05", "name": "Conformity Monitoring", "description": "Mechanisms exist to validate that Technology Assets, Applications, Services and/or Data (TAASD) conform to the organization's security, compliance and/or resilience policies, standards and other applicable requirements.", "justification": "Conformity Monitoring (CPL-05) provides periodic assessment and assurance that compensates for the absence of Red Team Exercises (VPM-21) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "WEB-02", "risk_if_not_implemented": "Without Web Security, applications may be built and deployed with exploitable design and coding weaknesses that adversaries can leverage. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unperformed / Unowned Control Responsibilities (R-GV-3), Uncontrolled Internal Security / Privacy Exposure (R-GV-4), and most likely increases susceptibility to Dysfunctional Management Practices (MT-8), Human Error (MT-9).", "compensating_control_1": { "control_id": "NET-03", "name": "Boundary Protection", "description": "Mechanisms exist to monitor and control communications at the external network boundary and at key internal boundaries within the network.", "justification": "Boundary Protection (NET-03) provides network-level access restriction that compensates for the absence of Web Security (WEB-02) by limiting attacker reach and lateral movement opportunities across the environment. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "MON-02", "name": "Continuous Monitoring", "description": "Mechanisms exist to facilitate the implementation of enterprise-wide monitoring controls.", "justification": "Continuous Monitoring (MON-02) provides detective monitoring capability that compensates for the absence of Web Security (WEB-02) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "WEB-03", "risk_if_not_implemented": "Without Web Security Standard, applications may be built and deployed with exploitable design and coding weaknesses that adversaries can leverage. Based on the risk and threat mapping for this control, no risk is rated Likely; risks rated Possible include Unauthorized Access (R-AC-4), Identity Compromise / Impersonation (R-AC-5), System / Data Compromise (Technical Vector) (R-BC-4), and most likely increases susceptibility to Human Error (MT-9).", "compensating_control_1": { "control_id": "CFG-04", "name": "Secure Baseline Configurations", "description": "Mechanisms exist to develop, document and maintain secure baseline configurations for Technology Assets, Applications and/or Services (TAAS) that are consistent with industry-accepted hardening standards.", "justification": "Secure Baseline Configurations (CFG-04) provides configuration hardening that compensates for the absence of Web Security Standard (WEB-03) by eliminating unnecessary services and enforcing secure settings to reduce inherent exposure. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "TDA-05", "name": "Secure Software Development Practices (SSDP)", "description": "Mechanisms exist to develop applications based on Secure Software Development Practices (SSDP).", "justification": "Secure Software Development Practices (SSDP) (TDA-05) provides overlapping security capability that compensates for the absence of Web Security Standard (WEB-03) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "WEB-04", "risk_if_not_implemented": "Without Web Application Framework, applications may be built and deployed with exploitable design and coding weaknesses that adversaries can leverage. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to System / Service Compromise (R-EX-7), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Technical / Mechanical Failure (MT-10), Product Defect / Design Failure (MT-23).", "compensating_control_1": { "control_id": "TDA-05", "name": "Secure Software Development Practices (SSDP)", "description": "Mechanisms exist to develop applications based on Secure Software Development Practices (SSDP).", "justification": "Secure Software Development Practices (SSDP) (TDA-05) provides overlapping security capability that compensates for the absence of Web Application Framework (WEB-04) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CFG-04", "name": "Secure Baseline Configurations", "description": "Mechanisms exist to develop, document and maintain secure baseline configurations for Technology Assets, Applications and/or Services (TAAS) that are consistent with industry-accepted hardening standards.", "justification": "Secure Baseline Configurations (CFG-04) provides configuration hardening that compensates for the absence of Web Application Framework (WEB-04) by eliminating unnecessary services and enforcing secure settings to reduce inherent exposure. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "WEB-05", "risk_if_not_implemented": "Without Unauthorized Code On Web Pages, applications may be built and deployed with exploitable design and coding weaknesses that adversaries can leverage. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Modification / Loss of System Integrity (R-AM-2), System / Service Compromise (R-EX-7), Loss of Confidentiality (R-IP-2), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Human Error (MT-9), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "MON-02", "name": "Continuous Monitoring", "description": "Mechanisms exist to facilitate the implementation of enterprise-wide monitoring controls.", "justification": "Continuous Monitoring (MON-02) provides detective monitoring capability that compensates for the absence of Unauthorized Code (WEB-05) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "NET-03", "name": "Boundary Protection", "description": "Mechanisms exist to monitor and control communications at the external network boundary and at key internal boundaries within the network.", "justification": "Boundary Protection (NET-03) provides network-level access restriction that compensates for the absence of Unauthorized Code (WEB-05) by limiting attacker reach and lateral movement opportunities across the environment. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "WEB-07", "risk_if_not_implemented": "Without Strong Customer Authentication (SCA), credentials may be phished, replayed, guessed or stolen, allowing unauthorized actors to authenticate as trusted identities. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Access (R-AC-4), Identity Compromise / Impersonation (R-AC-5), System / Data Compromise (Technical Vector) (R-BC-4), System / Service Compromise (R-EX-7), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "IAC-37", "name": "Multi-Factor Authentication (MFA)", "description": "Automated mechanisms exist to enforce Multi-Factor Authentication (MFA) for:\n(1) Remote network access; \n(2) Third-party Technology Assets, Applications and/or Services (TAAS); and/ or\n(3) Non-console access to critical TAAS that store, transmit and/or process sensitive and/or regulated data.", "justification": "Multi-Factor Authentication (MFA) (IAC-37) provides access control enforcement that compensates for the absence of Strong Customer Authentication (SCA) (WEB-07) by restricting system and data access to authorized users through alternative identity and access mechanisms. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "IAC-38", "name": "Cryptographic Module Authentication", "description": "Automated mechanisms exist to enable Technology Assets, Applications and/or Services (TAAS) to authenticate to a cryptographic module.", "justification": "Cryptographic Module Authentication (IAC-38) provides cryptographic protection that compensates for the absence of Strong Customer Authentication (SCA) (WEB-07) by ensuring data confidentiality and integrity through alternative technical means. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "WEB-08", "risk_if_not_implemented": "Without Web Application Input Validation & Sanitization, sensitive and/or regulated data may be retained beyond authorized periods or recovered from improperly disposed media and equipment. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to System / Data Compromise (Technical Vector) (R-BC-4), System / Service Compromise (R-EX-7), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "TDA-12", "name": "Input Data Validation", "description": "Mechanisms exist to check the validity of information inputs.", "justification": "Input Data Validation (TDA-12) provides overlapping security capability that compensates for the absence of Validation & Sanitization (WEB-08) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "TDA-05", "name": "Secure Software Development Practices (SSDP)", "description": "Mechanisms exist to develop applications based on Secure Software Development Practices (SSDP).", "justification": "Secure Software Development Practices (SSDP) (TDA-05) provides overlapping security capability that compensates for the absence of Validation & Sanitization (WEB-08) by addressing related risk objectives through an alternative control mechanism aligned with Process applicability. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "WEB-09", "risk_if_not_implemented": "Without Secure Web Traffic, applications may be built and deployed with exploitable design and coding weaknesses that adversaries can leverage. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to System / Data Compromise (Technical Vector) (R-BC-4), System / Service Compromise (R-EX-7), Long-Term Confidentiality Loss from Cryptographic Obsolescence (R-IP-1), Loss of Confidentiality (R-IP-2), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Technical / Mechanical Failure (MT-10), Harvest Now / Decrypt Later (HNDL) (MT-28), Cryptographic Compromise / Cryptanalytic Capability Advancement (MT-31).", "compensating_control_1": { "control_id": "CRY-05", "name": "Encrypting Data In Transit", "description": "Cryptographic mechanisms exist to prevent the unauthorized disclosure of data in transit.", "justification": "Encrypting Data In Transit (CRY-05) provides cryptographic protection that compensates for the absence of Secure Web Traffic (WEB-09) by ensuring data confidentiality and integrity through alternative technical means. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "NET-03", "name": "Boundary Protection", "description": "Mechanisms exist to monitor and control communications at the external network boundary and at key internal boundaries within the network.", "justification": "Boundary Protection (NET-03) provides network-level access restriction that compensates for the absence of Secure Web Traffic (WEB-09) by limiting attacker reach and lateral movement opportunities across the environment. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "WEB-10", "risk_if_not_implemented": "Without Web Application Output Encoding, applications may be built and deployed with exploitable design and coding weaknesses that adversaries can leverage. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to System / Data Compromise (Technical Vector) (R-BC-4), System / Service Compromise (R-EX-7), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "TDA-05", "name": "Secure Software Development Practices (SSDP)", "description": "Mechanisms exist to develop applications based on Secure Software Development Practices (SSDP).", "justification": "Secure Software Development Practices (SSDP) (TDA-05) provides overlapping security capability that compensates for the absence of Output Encoding (WEB-10) by addressing related risk objectives through an alternative control mechanism aligned with Technology applicability. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "TDA-12", "name": "Input Data Validation", "description": "Mechanisms exist to check the validity of information inputs.", "justification": "Input Data Validation (TDA-12) provides overlapping security capability that compensates for the absence of Output Encoding (WEB-10) by addressing related risk objectives through an alternative control mechanism aligned with Technology applicability. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "WEB-11", "risk_if_not_implemented": "Without Web Browser Security, applications may be built and deployed with exploitable design and coding weaknesses that adversaries can leverage. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to System / Data Compromise (Technical Vector) (R-BC-4), System / Service Compromise (R-EX-7), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "CFG-04", "name": "Secure Baseline Configurations", "description": "Mechanisms exist to develop, document and maintain secure baseline configurations for Technology Assets, Applications and/or Services (TAAS) that are consistent with industry-accepted hardening standards.", "justification": "Secure Baseline Configurations (CFG-04) provides configuration hardening that compensates for the absence of Web Browser Security (WEB-11) by eliminating unnecessary services and enforcing secure settings to reduce inherent exposure. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "END-03", "name": "Endpoint Protection Mechanisms", "description": "Mechanisms exist to protect the confidentiality, integrity, availability and safety of endpoint devices.", "justification": "Endpoint Protection Mechanisms (END-03) provides overlapping security capability that compensates for the absence of Web Browser Security (WEB-11) by addressing related risk objectives through an alternative control mechanism aligned with Technology applicability. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "WEB-12", "risk_if_not_implemented": "Without Website Change Detection, malicious, anomalous or unauthorized activity may go undetected or be detected too late to prevent or limit harm. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Delayed Containment / Increased Incident Impact (R-IR-2), Undetected / Delayed Detection of Adverse Activity (R-SA-1), and most likely increases susceptibility to Malicious Cyber Activity (MT-2), Technical / Mechanical Failure (MT-10).", "compensating_control_1": { "control_id": "MON-28", "name": "File Activity Monitoring (FAM)", "description": "Automated mechanisms exist to monitor sensitive and/or regulated data in Technology Assets, Applications and/or Services (TAAS) and data repositories.", "justification": "File Activity Monitoring (FAM) (MON-28) provides detective monitoring capability that compensates for the absence of Website Change Detection (WEB-12) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "MON-02", "name": "Continuous Monitoring", "description": "Mechanisms exist to facilitate the implementation of enterprise-wide monitoring controls.", "justification": "Continuous Monitoring (MON-02) provides detective monitoring capability that compensates for the absence of Website Change Detection (WEB-12) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the technology-focused nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } }, { "control_id": "WEB-13", "risk_if_not_implemented": "Without Publicly Accessible Content Reviews, sensitive and/or regulated data may be disclosed, altered or lost through inadequate classification, handling or protection. Based on the risk and threat mapping for this control, this deficiency most likely exposes the organization to Unauthorized Retention / Inability to Dispose of Data (R-AM-3), Loss of Confidentiality (R-IP-2), and most likely increases susceptibility to Human Error (MT-9).", "compensating_control_1": { "control_id": "MON-02", "name": "Continuous Monitoring", "description": "Mechanisms exist to facilitate the implementation of enterprise-wide monitoring controls.", "justification": "Continuous Monitoring (MON-02) provides detective monitoring capability that compensates for the absence of Publicly Accessible Content Reviews (WEB-13) by identifying unauthorized, anomalous, or non-compliant activity that the primary control would have prevented. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." }, "compensating_control_2": { "control_id": "CPL-05", "name": "Conformity Monitoring", "description": "Mechanisms exist to validate that Technology Assets, Applications, Services and/or Data (TAASD) conform to the organization's security, compliance and/or resilience policies, standards and other applicable requirements.", "justification": "Conformity Monitoring (CPL-05) provides periodic assessment and assurance that compensates for the absence of Publicly Accessible Content Reviews (WEB-13) by providing structured evaluation of the environment to surface gaps and verify residual control effectiveness. Given the process-oriented nature of this control, this compensating control targets the same underlying risk objective through an alternative approach, helping to maintain an acceptable level of residual risk until the primary control can be implemented." } } ] }