Objectives

ID	Security objective	Description	Related domain name
SO1	Information security policy	Establish and maintain an appropriate information security policy	D1: GOVERNANCE AND RISK MANAGEMENT
SO2	Governance and risk management	Establish and maintain an appropriate governance and risk management framework, to identify and address risks for the communications networks and services	D1: GOVERNANCE AND RISK MANAGEMENT
SO3	Security roles and responsibilities	Establish and maintain an appropriate structure of security roles and responsibilities	D1: GOVERNANCE AND RISK MANAGEMENT
SO4	Security of third party dependencies	Establish and maintain a policy, with security requirements for contracts with third parties, to ensure that dependencies on third parties do not negatively affect security of networks and/or services	D1: GOVERNANCE AND RISK MANAGEMENT
SO5	Background checks	Perform appropriate background checks on personnel if required for their duties and responsibilities	D2: HUMAN RESOURCES SECURITY
SO6	Security knowledge and training	Ensure that personnel have sufficient security knowledge and that they are provided with regular security training	D2: HUMAN RESOURCES SECURITY
SO7	Personnel changes	Establish and maintain an appropriate process for managing changes in personnel or changes in their roles and responsibilities	D2: HUMAN RESOURCES SECURITY
SO8	Handling violations	Establish and maintain a disciplinary process for personnel who violate security policies and have a broader process that covers security incidents caused violations personnel	D2: HUMAN RESOURCES SECURITY
SO9	Physical and environmental security	Establish and maintain the appropriate physical and environmental security of network and information systems and facilities	D3: SECURITY OF SYSTEMS AND FACILITIES
SO10	Security of supplies	Establish and maintain appropriate security of critical supplies (for example electric power, fuel, cooling etc.)	D3: SECURITY OF SYSTEMS AND FACILITIES
SO11	Access control to network and information systems	Establish and maintain appropriate (logical) access controls for access to network and information systems	D3: SECURITY OF SYSTEMS AND FACILITIES
SO12	Integrity of network and information systems	Establish and maintain integrity of network and information systems and protect from viruses, code injections, and other malware that can alter the functionality of systems	D3: SECURITY OF SYSTEMS AND FACILITIES
SO13	Use of encryption	Ensure adequate use of encryption to prevent and/or minimise the impact of security incidents on users and on other networks and services	D3: SECURITY OF SYSTEMS AND FACILITIES
SO14	Protection of security critical data	Ensure that cryptographic key material and secret authentication information are adequately protected	D3: SECURITY OF SYSTEMS AND FACILITIES
SO15	Operational procedures	Establish and maintain operational procedures for the operation of critical network and information systems personnel	D4: OPERATIONS MANAGEMENT
SO16	Change management	Establish change management procedures for critical network and information systems in order to minimise the likelihood of incidents resulting from changes	D4: OPERATIONS MANAGEMENT
SO17	Asset management	Establish and maintain asset management procedures and configuration controls in order to manage availability of critical assets and configurations of critical network and information systems	D4: OPERATIONS MANAGEMENT
SO18	Incident management procedures	Establish and maintain procedures for managing incidents, and forwarding them to the appropriate personnel (triage)	D5: INCIDENT MANAGEMENT
SO19	Incident detection capability	Establish and maintain an incident detection capability that detects incidents. Measures to detect incidents should be understood in a broader sense as to be able to also detect serious events that may lead to incidents	D5: INCIDENT MANAGEMENT
SO20	Incident reporting and communication	Establish and maintain appropriate incident reporting and communication procedures, taking into account national legislation on incident reporting to government authorities	D5: INCIDENT MANAGEMENT
SO21	Service continuity strategy and contingency plans	Establish and maintain contingency plans and a strategy for ensuring continuity of networks and communication services provided	D6: BUSINESS CONTINUITY MANAGEMENT
SO22	Disaster recovery capabilities	Establish and maintain an appropriate disaster recovery capability for restoring network and communication services in case of natural and/or major disasters	D6: BUSINESS CONTINUITY MANAGEMENT
SO23	Monitoring and logging policies	Establish and maintain systems and functions for monitoring and logging of relevant security events in critical network and communication systems	D7: MONITORING, AUDITING AND TESTING
SO24	Exercise contingency plans	Establish and maintain policies for testing and exercising backup and contingency plans, where needed in collaboration with third parties	D7: MONITORING, AUDITING AND TESTING
SO25	Network and information systems testing	Establish and maintain policies for testing network and information systems, particularly when connecting to new networks or systems. Testing refers primarily to testing of security related functionality, rather than to general ICT functionality testing	D7: MONITORING, AUDITING AND TESTING
SO26	Security assessments	Establish and maintain an appropriate policy for performing security assessments of network and information systems	D7: MONITORING, AUDITING AND TESTING
SO27	Compliance monitoring	Establish and maintain a policy for monitoring compliance to standards and legal requirements	D7: MONITORING, AUDITING AND TESTING
SO28	Threat intelligence	Establish and maintain appropriate mechanisms for monitoring and collecting information about relevant threats to the security of networks and services	D8: THREAT AWARENESS
SO29	Informing users about threats	Inform users of particular and significant security threats to network or service that may affect the end-user and of the measures they can take to protect the security of their communications	D8: THREAT AWARENESS