{"catalog":{"uuid":"74c8ba1e-5cd4-4ad1-bbfd-d888e2f6c724","metadata":{"title":"Sample Security Catalog *for Demonstration* and Testing","remarks":"The following is a short excerpt from [ISO/IEC 27002:2013](https://www.iso.org/standard/54533.html), *Information technology — Security techniques — Code of practice for information security controls*. This work is provided here under copyright \"fair use\" for non-profit, educational purposes only. Copyrights for this work are held by the publisher, the International Organization for Standardization (ISO).","version":"1.1","published":"2023-10-12T00:00:00.000000-04:00","document-ids":[{"scheme":"http://oscal.io/oscal/identifier/content-uuid","identifier":"cb5f2950-a4db-4a6e-a7ac-7740aad609ac"}],"last-modified":"2024-02-01T13:57:28.355446-04:00","oscal-version":"1.1.2"},"groups":[{"id":"s1","props":[{"name":"label","value":"1"}],"title":"Organization of Information Security","groups":[{"id":"s1.1","title":"Internal Organization","controls":[{"id":"s1.1.1","parts":[{"id":"s1.1_smt","name":"overview","prose":"To establish a management framework to initiate and control the implementation and operation of information security within the organization."},{"id":"s1.1.1_stm","name":"statement","prose":"All information security responsibilities should be defined and allocated.\n\nA value has been assigned to {{ insert: param, s1.1.1-prm1 }}.\n\nA cross link has been established with a choppy syntax: [(choppy)](#s1.2)."},{"id":"s1.1.1_gdn","name":"guidance","parts":[{"id":"s1.1.1_gdn.1","name":"objective","prose":"Allocation of information security responsibilities should be done in accordance with the information security policies. Responsibilities for the protection of individual assets and for carrying out specific information security processes should be identified. Responsibilities for information security risk management activities and in particular for acceptance of residual risks should be defined. These responsibilities should be supplemented, where necessary, with more detailed guidance for specific sites and information processing facilities. Local responsibilities for the protection of assets and for carrying out specific security processes should be defined."},{"id":"s1.1.1_gdn.2","name":"objective","prose":"Individuals with allocated information security responsibilities may delegate security tasks to others. Nevertheless they remain accountable and should determine that any delegated tasks have been correctly performed."},{"id":"s1.1.1_gdn.3","name":"objective","prose":"Areas for which individuals are responsible should be stated. In particular the following should take place:\n\n1. the assets and information security processes should be identified and defined;\n1. the entity responsible for each asset or information security process should be assigned and the details of this responsibility should be documented;\n1. authorization levels should be defined and documented;\n1. to be able to fulfil responsibilities in the information security area the appointed individuals should be competent in the area and be given opportunities to keep up to date with developments;\n1. coordination and oversight of information security aspects of supplier relationships should be identified and documented.\n"}]},{"id":"s1.1.1_inf","name":"overview","props":[{"name":"label","value":"Other information"}],"prose":"Many organizations appoint an information security manager to take overall responsibility for the development and implementation of information security and to support the identification of controls.\n\nHowever, responsibility for resourcing and implementing the controls will often remain with individual managers. One common practice is to appoint an owner for each asset who then becomes responsible for its day-to-day protection."}],"props":[{"name":"label","value":"1.1.1"}],"title":"Information security roles and responsibilities","params":[{"id":"s1.1.1-prm1","label":"a choice from a selection","select":{"choice":["initiating a device lock after {{ insert: param, s1.1.1-prm_2 }} of inactivity","requiring the user to initiate a device lock before leaving the system unattended"],"how-many":"one-or-more"}},{"id":"s1.1.1-prm_2","label":"a duration"}]},{"id":"s1.1.2","parts":[{"id":"s1.1.2_stm","name":"statement","prose":"Conflicting duties and areas of responsibility should be segregated to reduce opportunities for unauthorized or unintentional modification or misuse of the organization’s assets."},{"id":"s1.1.2_gdn","name":"guidance","parts":[{"id":"s1.1.2_gdn.1","name":"objective","prose":"Care should be taken that no single person can access, modify or use assets without authorization or detection. The initiation of an event should be separated from its authorization. The possibility of collusion should be considered in designing the controls."},{"id":"s1.1.2_gdn.2","name":"objective","prose":"Small organizations may find segregation of duties difficult to achieve, but the principle should be applied as far as is possible and practicable. Whenever it is difficult to segregate, other controls such as monitoring of activities, audit trails and management supervision should be considered."}]},{"id":"s1.1.2_inf","name":"overview","prose":"Segregation of duties is a method for reducing the risk of accidental or deliberate misuse of an organization’s assets."}],"props":[{"name":"label","value":"1.1.2"}],"title":"Segregation of duties"}]}]},{"id":"s2","props":[{"name":"label","value":"2"}],"title":"Access control","groups":[{"id":"s2.1","parts":[{"id":"s2.1_smt","name":"overview","prose":"To limit access to information and information processing facilities."}],"props":[{"name":"label","value":"2.1"}],"title":"Business requirements of access control","controls":[{"id":"s2.1.1","parts":[{"id":"s2.1.1_stm","name":"statement","prose":"An access control policy should be established, documented and reviewed based on business and information security requirements."},{"id":"s2.1.1_gdn","name":"guidance","parts":[{"id":"s2.1.1_gdn.1","name":"objective","prose":"Asset owners should determine appropriate access control rules, access rights and restrictions for specific user roles towards their assets, with the amount of detail and the strictness of the controls reflecting the associated information security risks."},{"id":"s2.1.1_gdn.2","name":"objective","prose":"Access controls are both logical and physical and these should be considered together."},{"id":"s2.1.1_gdn.3","name":"objective","prose":"Users and service providers should be given a clear statement of the business requirements to be met by access controls."},{"id":"s2.1.1_gdn.4","name":"objective","prose":"The policy should take account of the following:\n\n1. security requirements of business applications;\n1. policies for information dissemination and authorization, e.g. the need-to-know principle and information security levels and classification of information;\n1. consistency between the access rights and information classification policies of systems and networks;\n1. relevant legislation and any contractual obligations regarding limitation of access to data or services;\n1. management of access rights in a distributed and networked environment which recognizes all types of connections available;\n1. segregation of access control roles, e.g. access request, access authorization, access administration;\n1. requirements for formal authorization of access requests;\n1. requirements for periodic review of access rights;\n1. removal of access rights;\n1. archiving of records of all significant events concerning the use and management of user identities and secret authentication information;,\n1. roles with privileged access.\n"}]},{"id":"s2.1.1_info","name":"overview","parts":[{"id":"s2.1.1_info.1","name":"objective","prose":"Care should be taken when specifying access control rules to consider:\n\n1. establishing rules based on the premise “Everything is generally forbidden unless expressly permitted” rather than the weaker rule “Everything is generally permitted unless expressly forbidden”;\n1. changes in information labels that are initiated automatically by information processing facilities and those initiated at the discretion of a user;\n1. changes in user permissions that are initiated automatically by the information system and those initiated by an administrator;\n1. rules which require specific approval before enactment and those which do not.\n"},{"id":"s2.1.1_info.2","name":"objective","prose":"Access control rules should be supported by formal procedures and defined responsibilities."},{"id":"s2.1.1_stm.3","name":"objective","prose":"Role based access control is an approach used successfully by many organizations to link access rights with business roles."},{"id":"s2.1.1_stm.4","name":"objective","prose":"Two of the frequent principles directing the access control policy are:\n\n1. Need-to-know: you are only granted access to the information you need to perform your tasks (different tasks/roles mean different need-to-know and hence different access profile);\n1. Need-to-use: you are only granted access to the information processing facilities (IT equipment, applications, procedures, rooms) you need to perform your task/job/role.\n"}]}],"props":[{"name":"label","value":"2.1.1"}],"title":"Access control policy"},{"id":"s2.1.2","parts":[{"id":"s2.1.2_stm","name":"statement","prose":"Users should only be provided with access to the network and network services that they have been specifically authorized to use."},{"id":"s2.1.2_gdn","name":"guidance","parts":[{"id":"s2.1.2_gdn.1","name":"objective","prose":"A policy should be formulated concerning the use of networks and network services. This policy should cover:\n\n1. the networks and network services which are allowed to be accessed;\n1. authorization procedures for determining who is allowed to access which networks and networked services;\n1. management controls and procedures to protect access to network connections and network services;\n1. the means used to access networks and network services (e.g. use of VPN or wireless network);\n1. user authentication requirements for accessing various network services;\n1. monitoring of the use of network service\n"},{"id":"s2.1.2_gdn.2","name":"objective","prose":"The policy on the use of network services should be consistent with the organization’s access control policy"}]}],"props":[{"name":"label","value":"2.1.2"}],"title":"Access to networks and network services"}]}]}]}}