IDSOSO-levelMeasure
M1SO1SO1-1a) Set a high level security policy addressing the security of networks and services
M2SO1SO1-1b) Make key personnel aware of the security policy
M3SO1SO1-2c) Set detailed information security policies for critical assets and business processes
M4SO1SO1-2d) Make all personnel aware of the security policy and what it implies for their work
M5SO1SO1-2e) Review the security policy following incidents
M6SO1SO1-3f) Review the information security policies periodically, and take into account violations, exceptions, past incidents, past tests/exercises, and incidents affecting other (similar) providers in the sector
M7SO2SO2-1a) Make a list of the main risks for security of networks and services, taking into account main threats for the critical assets
M8SO2SO2-1b) Make key personnel aware of the main risks and how they are mitigated
M9SO2SO2-2c) Set up a risk management methodology and/or tools based on industry standards
M10SO2SO2-2d) Ensure that key personnel use the risk management methodology and tools
M11SO2SO2-2e) Review the risk assessments following changes or incidents
M12SO2SO2-2f) Ensure residual risks are accepted management
M13SO2SO2-3g) Review the risk management methodology and/or tools, periodically, taking into account changes and past incidents
M14SO3SO3-1a) Assign security roles and responsibilities to personnel
M15SO3SO3-1b) Make sure the security roles are reachable in case of security incidents
M16SO3SO3-2c) Personnel is formally appointed in security roles
M17SO3SO3-2d) Make personnel aware of the security roles in your organisation and when they should be contacted
M18SO3SO3-3e) Structure of security roles and responsibilities is regularly reviewed and revised, based on changes and/or past incidents
M19SO4SO4-1a) Include security requirements in contracts with third-parties, including confidentiality and secure transfer of information
M20SO4SO4-2b) Set a security policy for contracts with third-parties
M21SO4SO4-2c) Ensure that all procurement of services/products from third-parties follows the policy
M22SO4SO4-2d) Review security policy for third parties, following incidents or changes
M23SO4SO4-2e) Demand specific security standards in third-party supplier’s processes during procurement
M24SO4SO4-2f) Mitigate residual risks that are not addressed the third party
M25SO4SO4-3g) Keep track of security incidents related to or caused third-parties
M26SO4SO4-3h) Periodically review and update security policy for third parties at regular intervals, taking into account past incidents, changes, etc.
M27SO5SO5-1a) Check professional references of key personnel (system administrators, security officers, guards, etc.)
M28SO5SO5-2b) Perform background checks/screening for key personnel, when needed and legally permitted
M29SO5SO5-2c) Set up a policy and procedure for background checks
M30SO5SO5-3d) Review and update policy/procedures for background checks and reference checks at regular intervals, taking into account changes and past incidents
M31SO6SO6-1a) Provide key personnel with relevant training and material on security issues
M32SO6SO6-2b) Implement a program for training, making sure that key personnel have sufficient and up-to-date security knowledge
M33SO6SO6-2c) Organise trainings and awareness sessions for personnel on security topics important for your organisation
M34SO6SO6-3d) Review and update the training program periodically, taking into account changes and past incidents
M35SO6SO6-3e) Test the security knowledge of personnel
M36SO7SO7-1a) Following changes in personnel revoke access rights, badges, equipment, etc., if no longer necessary or permitted
M37SO7SO7-1b) Brief and educate new personnel on the policies and procedures in place
M38SO7SO7-2c) Implement policy/procedures for personnel changes, taking into account timely revocation of access rights, badges and equipment
M39SO7SO7-2d) Implement policy/procedures for education and training for personnel in new roles
M40SO7SO7-3e) Periodically check that the policy/procedures are effective
M41SO7SO7-3f) Review and evaluate policy/procedures for personnel changes, taking into account changes or past incidents
M42SO8SO8-1a) Hold personnel accountable for security incidents caused violations of policies, for example via the employment contract
M43SO8SO8-2b) Set up procedures for violations of policies personnel
M44SO8SO8-3c) Periodically review and update the disciplinary process, based on changes and past incidents
M45SO9SO9-1a) Prevent unauthorized physical access to facilities and infrastructure and set up adequate environmental controls, to protect provider assets (including third party assets, where applicable) against unauthorized access, burglary, fire, flooding, etc. Security controls should be selected based on the risk assessment, which should also take in consideration current and forecasted environmental security risks – e.g. related to climate change
M46SO9SO9-2b) Implement a policy for physical security measures and environmental controls
M47SO9SO9-2c) Industry standard implementation of physical and environmental controls
M48SO9SO9-2d) Apply reinforced controls for physical access to critical assets. For example, physical access to such assets should only be granted to a limited number of security-vetted, trained and qualified personnel. Access third-parties, contractors, and employees of suppliers/vendors, integrators, should be limited and monitored
M49SO9SO9-3e) Evaluate the effectiveness of physical and environmental controls periodically
M50SO9SO9-3f) Review and update the policy for physical security measures and environmental controls taking into account changes and past incidents
M51SO10SO10-1a) Ensure security of critical supplies
M52SO10SO10-2b) Implement a policy for security of critical supplies
M53SO10SO10-2c) Implement industry standard security measures to protect critical supplies and supporting facilities (e.g. passive cooling, automatic restart after power interruption, battery backup power, diesel generators, backup fuel, etc.)
M54SO10SO10-3d) Implement state of the art security measures to protect critical supplies (such as active cooling, UP, hot stand power generators, SLAs with fuel delivery companies, redundant cooling and power backup systems)
M55SO10SO10-3e) Review and update policy and procedures to secure critical supplies regularly, taking into account changes and past incidents
M56SO11SO11-1a) Users and systems have unique ID’s and are authenticated before accessing services or systems
M57SO11SO11-1b) Implement logical access control mechanism for network and information systems to allow only authorized use
M58SO11SO11-2c) Implement policy for protecting access to network and information systems, addressing for example roles, rights, responsibilities and procedures for assigning and revoking access rights
M59SO11SO11-2d) Choose appropriate authentication mechanisms, depending on the type of access
M60SO11SO11-2e) Monitor access to network and information systems, have a process for approving exceptions and registering access violations
M61SO11SO11-2f) Reinforce controls for remote access to critical assets of network and information systems third parties
M62SO11SO11-3g) Evaluate the effectiveness of access control policies and procedures and implement cross checks on access control mechanisms
M63SO11SO11-3h) Access control policy and access control mechanisms are reviewed and when needed revised
M64SO12SO12-1a) Make sure software of network and information systems is not tampered with or altered, for instance using input controls and firewalls
M65SO12SO12-1b) Check for malware on (internal) network and information systems
M66SO12SO12-2c) Implement industry standard security measures, providing defence-in-depth against tampering and altering of systems
M67SO12SO12-2d) Apply reinforced software integrity, update and patch management controls for critical assets in virtualised networks
M68SO12SO12-3e) Set up state of the art controls to protect integrity of systems
M69SO12SO12-3f) Evaluate and review the effectiveness of measures to protect integrity of systems
M70SO13SO13-1a) Where appropriate to prevent and/or minimise the impact of security incidents on users and on other networks and services, encrypt data during its storage in and/or transmission via networks. The type and scope of data to be encrypted should be determined based on the risk assessment performed and will typically include communication data, customer critical data (e.g. unique identifiers), relevant management and signalling traffic and any other data or metadata, the disclosure or tampering of which may cause security incidents
M71SO13SO13-2b) Implement encryption policy
M72SO13SO13-2c) Use industry standard encryption algorithms and the corresponding recommended lengths of encryption keys
M73SO13SO13-3d) Review and update encryption policy
M74SO13SO13-3e) Use state of the art encryption algorithms
M75SO14SO14-1a) Make sure that cryptographic key material and secret authentication information (including cryptographic key material used for authentication) are not disclosed or tampered with
M76SO14SO14-2c) Implement policy for management of cryptographic keys
M77SO14SO14-2d) Implement policy for management of user passwords
M78SO14SO14-3e) Review and update of key management policy
M79SO14SO14-3f) Review and update of user password management policy
M80SO15SO15-1a) Set up operational procedures and assign responsibilities for operation of critical systems
M81SO15SO15-2b) Implement a policy for operation of systems to make sure all critical systems are operated and managed in line with predefined procedures
M82SO15SO15-3c) Review and update the policy/procedures for operation of critical systems, taking into account incidents and/or changes
M83SO16SO16-1a) Follow predefined methods or procedures when making changes to critical systems
M84SO16SO16-2b) Implement policy/procedures for change management, to make sure that changes of critical systems are always done following a predefined way
M85SO16SO16-2c) Document change management procedures, and record for each change the steps of the followed procedure
M86SO16SO16-3d) Review and update change management procedures regularly, taking into account changes and past incidents
M87SO17SO17-1a) Identify critical assets and configurations of critical systems
M88SO17SO17-2b) Implement policy/procedures for asset management and configuration control
M89SO17SO17-3c) Review and update the asset management policy regularly, based on changes and past incidents
M90SO18SO18-1a) Make sure personnel is available and prepared to manage and handle incidents
M91SO18SO18-1b) Keep a record of all major incidents
M92SO18SO18-2c) Implement policy/procedures for managing incidents
M93SO18SO18-3d) Investigate major incidents and draft final incident reports, including actions taken and recommendations to mitigate future occurrence of this type of incident
M94SO18SO18-3e) Evaluate incident management policy/procedures based on past incidents
M95SO19SO19-1a) Set up processes or systems for incident detection
M96SO19SO19-2b) Implement industry standard systems and procedures for incident detection
M97SO19SO19-2c) Implement systems and procedures for registering and forwarding incidents timely to the appropriate people
M98SO19SO19-3d) Review systems and processes for incident detection regularly and update them taking into account changes and past incidents
M99SO19SO19-3e) Implement state of the art systems and procedures for incident detection
M100SO20SO20-1a) Communicate and report about on-going or past incidents to third parties, customers, and/or government authorities, when necessary
M101SO20SO20-2b) Implement policy and procedures for communicating and reporting about incidents
M102SO20SO20-3c) Evaluate past communications and reporting about incidents
M103SO20SO20-3d) Review and update the reporting and communication plans, based on changes or past incidents
M104SO21SO21-1a) Implement a service continuity strategy for the communications networks and/or services provided
M105SO21SO21-2b) Implement contingency plans for critical systems
M106SO21SO21-2c) Monitor activation and execution of contingency plans, registering successful and failed recovery times
M107SO21SO21-2d) Implement contingency plans for dependent and inter-dependent critical sectors and services. When determining dependent critical sectors and services, providers may take into account those services that are dependent on the continuity of the network and service operation which are essential for the maintenance of critical societal and/or economic activities and for which an incident would have significant disruptive effects on the provision of that service. One possible way for identifying such dependent services may be to pass the obligation to service consumers to inform the providers if their service is considered critical
M108SO21SO21-3e) Review and revise service continuity strategy periodically
M109SO21SO21-3f) Review and revise contingency plans, based on past incidents and changes
M110SO22SO22-1a) Prepare for recovery and restoration of services following disasters
M111SO22SO22-2b) Implement policy/procedures for deploying disaster recovery capabilities
M112SO22SO22-2c) Implement industry standard disaster recovery capabilities, or be assured they are available from third parties (such as national emergency networks)
M113SO22SO22-3d) Set up state of the art disaster recovery capabilities to mitigate natural and/major disasters
M114SO22SO22-3e) Review and update disaster recovery capabilities regularly, taking into account changes, past incidents, and results of tests and exercises
M115SO23SO23-1a) Implement monitoring and logging of critical systems
M116SO23SO23-2b) Implement policy for logging and monitoring of critical systems
M117SO23SO23-2c) Set up tools for monitoring critical systems
M118SO23SO23-2d) Set up tools to collect and store logs of critical systems
M119SO23SO23-3e) Set up tools for automated collection and analysis of monitoring data and logs
M120SO23SO23-3f) Review and update logging and monitoring policy/procedures, taking into account changes and past incidents
M121SO24SO24-1a) Exercise and test backup and contingency plans to make sure systems and processes work and personnel is prepared for large failures and contingencies
M122SO24SO24-2b) Implement a program for exercising backup and contingency plans regularly, using realistic scenarios covering a range of different scenarios over time
M123SO24SO24-2c) Make sure that the issues and lessons learnt from exercises are addressed the responsible people and that the relevant processes and systems are updated accordingly
M124SO24SO24-3d) Review and update the exercise plans, taking into account changes, past incidents and contingencies which were not covered the exercise program
M125SO24SO24-3e) Involve suppliers and other third parties in exercises, for example business partners and customers
M126SO25SO25-1a) Test networks and information systems before using them or connecting them to existing systems
M127SO25SO25-2b) Implement policy/procedures for testing network and information systems
M128SO25SO25-2c) Implement tools for automated testing
M129SO25SO25-3d) Review and update the policy/procedures for testing, taking into account changes and past incidents
M130SO26SO26-1a) Ensure critical systems undergo security scans and security testing regularly, particularly when new systems are introduced and following changes
M131SO26SO26-2b) Implement policy/procedures for security assessments and security testing
M132SO26SO26-3c) Evaluate the effectiveness of policy/procedures for security assessments and security testing
M133SO26SO26-3d) Review and update policy/procedures for security assessments and security testing, taking into account changes and past incidents
M134SO27SO27-1a) Monitor compliance to standards and legal requirements
M135SO27SO27-2b) Implement policy/procedures for compliance monitoring and auditing
M136SO27SO27-3c) Evaluate the policy/procedures for compliance and auditing
M137SO27SO27-3d) Review and update the policy/procedures for compliance and auditing, taking into account changes and past incidents
M138SO28SO28-1a) Perform regular threat monitoring
M139SO28SO28-2b) Implement threat intelligence program
M140SO28SO28-3c) Review and update the threat intelligence program
M141SO28SO28-3d) Threat intelligence program makes use of state of the art threat intelligence systems
M142SO29SO29-1a) Inform end-users of communication networks and services about particular and significant security threats to network or service that may affect them
M143SO29SO29-2b) Implement policy/procedures for regular update of end-users about security threats to network or service that may affect them
M144SO29SO29-3c) Review and update the policy/procedures for regular update of end-users about security threats to network or service that may affect them
Measures