{"text_format":"1","workbook":"xlsx","n_sheets":6,"sheets":["Instructions","Executive Summary","SoK Security Program Assessment","How to Score","Tool Mapping","Lookups"],"not_rendered":{"charts":0,"images":1,"macros":0,"external_links":0,"defined_names":1,"comments":0,"pivot_tables":0},"unopened":[],"bounds":{"document_bytes":16777216,"sheet_cells":100000,"rows_first":2000,"rows_last":500,"rows_between":2000,"halvings":0,"cell_chars":16384,"cell_head_chars":4096},"cells_cut":0,"cells_raw":0,"read":"whole","date_system":"1900"}

{"sheet":"Instructions","index":0,"n_rows":10,"n_cols":4,"rows_kept":10,"cut":false,"hidden":false,"merged":[[9,0,27,15],[0,3,8,15]]}
[null,null,null,"State of Kansas Information Security Self Assessment"]
[]
[]
[]
[]
[]
[]
[]
[]
["This self assessment template has been built to assist the organization in performing a self assessment of its information security program.  This assessment is based on both  State statutes and information security policies.  This assessment uses a simple Yes or No model to assist in measuring the security program and its maturity level.  Through a list of requirements pulled from both the Kansas Cybersecurity Act of 2018 and ITEC 7230A, a score is determined based on assessor's feels a requirement is met or not.  Questions can be answered \"Yes,\"  \"No,\" or \"Not Applicable,\"  which translates to a 0 - 1 numerical value.  Once each section is completed, scores will be averaged to develop an \"average section score\".  Finally, all sections will be averaged to develop an overall perceived maturity level.\n\nUtilizing this tool over the course of several assessments can help develop a picture or trend of the progress of the organization's information security program.\n\nIf there are any questions questions, please do not hesitate to ask and contact the KISO office.\nkiso@ks.gov\n\nThis self assessment when filled, and supporting docments are deemed CONFIDENTIAL under K.S.A 75-7240"]

{"sheet":"Executive Summary","index":1,"n_rows":23,"n_cols":4,"rows_kept":23,"cut":false,"hidden":false,"merged":[[1,0,3,4],[5,2,5,4],[17,2,17,4],[18,2,18,4],[6,2,6,4],[7,2,7,4],[8,2,8,4],[9,2,9,4],[10,2,10,4],[11,2,11,4],[12,2,12,4],[13,2,13,4],[14,2,14,4],[15,2,15,4],[16,2,16,4]]}
["Executive Summary"]
["This scorecard gives you a general ovarall picture of compliance and maturity of compliance with the Kansas Cybersercurity Act and the 2019 version of ITEC 7230a.  It is important to  understand that compliance doesn't equate to complete security.  Security is an ongoing and evolving process.  Your organization should be taking additional steps that might not be fully addressed or recognized by either the KCA or ITEC 7230a.  "]
[]
[]
[]
["***KCA Executive Branch Agency Head Responsibilities","***KCA ->",{"$f":"'SoK Security Program Assessment'!F5","v":0}]
["6.0  RISK MANAGEMENT STANDARD","Total Score for Section 6.0 ->",{"$f":"'SoK Security Program Assessment'!F26","v":0}]
["7.0 ASSESSMENT AND SECURITY PLANNING STANDARD","Total Score for Section 7.0->",{"$f":"'SoK Security Program Assessment'!F47","v":0}]
["8.0 AWARENESS AND TRAINING STANDARD","Total Score for Section 8.0 ->",{"$f":"'SoK Security Program Assessment'!F55","v":0}]
["9.0 ACCESS CONTROL STANDARD","Total Score for Section 9.0->",{"$f":"'SoK Security Program Assessment'!F74","v":0}]
["10.0 SYSTEMS CONFIGURATION STANDARD","Total Score for Section 10.0->",{"$f":"'SoK Security Program Assessment'!F133","v":0}]
["11.0 DATA PROTECTION STANDARD","Total Score for Section 11.0->",{"$f":"'SoK Security Program Assessment'!F156","v":0}]
["12.0 APPLICATION PROCESSING STANDARD","Total Score for Section 12.0->",{"$f":"'SoK Security Program Assessment'!F167","v":0}]
["13.0 SYSTEMS OPERATIONS STANDARD","Total Score for Section 13.0->",{"$f":"'SoK Security Program Assessment'!F170","v":0}]
["14.0 SYSTEM AUDIT STANDARD","Total Score for Section 14.0->",{"$f":"'SoK Security Program Assessment'!F193","v":0}]
["15.0 INCIDENT RESPONSE STANDARD","Total Score for Seciton 15.0->",{"$f":"'SoK Security Program Assessment'!F207","v":0}]
["16.0 PHYSICAL SECUIRTY STANDARD","Total Score for Section 16.0->",{"$f":"'SoK Security Program Assessment'!F225","v":0}]
["17.0 PERSONNEL SECURITY STANDARDS","Total Score for Section 17.0->",{"$f":"'SoK Security Program Assessment'!F236","v":0}]
["18.0 SECURE PURCHASING/ACQUISITION STANDARD","Total Score for Section 18.0->",{"$f":"'SoK Security Program Assessment'!F248","v":0}]
["THE END -- overall average ------>",null,null,{"$f":"AVERAGE(C6:C19)","v":0}]
[]
[]
["*** KCA is the Kansas Cybersecurity Act of 2018"]

{"sheet":"SoK Security Program Assessment","index":2,"n_rows":251,"n_cols":8,"rows_kept":251,"cut":false,"hidden":false,"merged":[[210,4,216,4],[210,5,216,5],[108,4,111,4],[108,5,111,5],[117,7,117,9],[118,7,118,9],[122,7,122,9],[123,7,123,9],[124,7,124,9],[112,7,112,9],[113,7,113,9],[114,7,114,9],[115,7,115,9],[116,7,116,9],[132,7,132,9],[133,7,133,9],[134,7,134,9],[135,7,135,9],[136,7,136,9],[126,7,126,9],[127,7,127,9],[129,7,129,9],[131,7,131,9],[142,7,142,9],[172,3,174,3],[143,3,148,3],[169,5,169,6],[170,5,170,6],[181,5,181,6],[186,5,186,6],[192,5,192,6],[206,5,206,6],[166,5,166,6],[162,5,162,6],[155,5,155,6],[172,4,174,4],[172,5,174,5],[149,5,149,6],[194,4,199,4],[194,5,199,5],[31,3,38,3],[39,3,40,3],[28,3,30,3],[60,3,72,3],[88,3,98,3],[99,3,107,3],[108,3,111,3],[112,3,115,3],[60,4,72,4],[99,4,107,4],[60,5,72,5],[88,4,98,4],[88,5,98,5],[99,5,107,5],[112,4,115,4],[112,5,115,5],[143,4,148,4],[143,5,148,5],[0,1,1,1],[25,5,25,6],[46,5,46,6],[54,5,54,6],[73,5,73,6],[74,5,74,6],[116,5,116,6],[132,5,132,6],[133,5,133,6],[139,5,139,6],[0,4,0,9],[1,4,1,9],[2,4,2,9],[25,7,25,9],[26,7,26,9],[27,7,27,9],[28,7,28,9],[29,7,29,9],[30,7,30,9],[31,7,31,9],[250,5,250,6],[241,5,241,6],[247,5,247,6],[47,5,47,6],[51,5,51,6],[55,5,55,6],[123,5,123,6],[224,5,224,6],[225,5,225,6],[235,5,235,6],[236,5,236,6],[42,7,42,9],[43,7,43,9],[44,7,44,9],[41,7,41,9],[37,7,37,9],[38,7,38,9],[39,7,39,9],[40,7,40,9],[32,7,32,9],[33,7,33,9],[34,7,34,9],[35,7,35,9],[36,7,36,9],[49,7,49,9],[50,7,50,9],[51,7,51,9],[52,7,52,9],[53,7,53,9],[45,7,45,9],[46,7,46,9],[47,7,47,9],[48,7,48,9],[59,7,59,9],[60,7,60,9],[61,7,61,9],[62,7,62,9],[63,7,63,9],[54,7,54,9],[55,7,55,9],[56,7,56,9],[57,7,57,9],[58,7,58,9],[69,7,69,9],[70,7,70,9],[71,7,71,9],[72,7,72,9],[73,7,73,9],[64,7,64,9],[65,7,65,9],[66,7,66,9],[67,7,67,9],[68,7,68,9],[87,7,87,9],[108,7,108,9],[109,7,109,9],[110,7,110,9],[111,7,111,9],[85,7,85,9],[86,7,86,9],[74,7,74,9],[75,7,75,9],[76,7,76,9],[77,7,77,9],[143,7,143,9],[144,7,144,9],[145,7,145,9],[146,7,146,9],[137,7,137,9],[138,7,138,9],[139,7,139,9],[140,7,140,9],[141,7,141,9],[152,7,152,9],[153,7,153,9],[154,7,154,9],[155,7,155,9],[156,7,156,9],[147,7,147,9],[148,7,148,9],[162,7,162,9],[150,7,150,9],[151,7,151,9],[149,7,149,9],[167,7,167,9],[168,7,168,9],[169,7,169,9],[170,7,170,9],[171,7,171,9],[157,7,157,9],[158,7,158,9],[160,7,160,9],[161,7,161,9],[166,7,166,9],[163,7,163,9],[182,7,182,9],[183,7,183,9],[184,7,184,9],[185,7,185,9],[186,7,186,9],[175,7,175,9],[177,7,177,9],[178,7,178,9],[180,7,180,9],[181,7,181,9],[193,7,193,9],[194,7,194,9],[195,7,195,9],[196,7,196,9],[197,7,197,9],[187,7,187,9],[188,7,188,9],[189,7,189,9],[190,7,190,9],[192,7,192,9],[206,7,206,9],[207,7,207,9],[208,7,208,9],[198,7,198,9],[200,7,200,9],[201,7,201,9],[203,7,203,9],[205,7,205,9],[211,7,211,9],[209,7,209,9],[210,7,210,9],[224,7,224,9],[249,7,249,9],[241,7,241,9],[242,7,242,9],[243,7,243,9],[244,7,244,9],[245,7,245,9],[236,7,236,9],[237,7,237,9],[238,7,238,9],[239,7,239,9],[240,7,240,9],[25,10,25,12],[26,10,26,12],[27,10,27,12],[28,10,28,12],[29,10,29,12],[246,7,246,9],[247,7,247,9],[248,7,248,9],[235,7,235,9],[230,7,230,9],[231,7,231,9],[232,7,232,9],[233,7,233,9],[234,7,234,9],[225,7,225,9],[226,7,226,9],[227,7,227,9],[228,7,228,9],[229,7,229,9],[42,10,42,12],[39,10,39,12],[40,10,40,12],[41,10,41,12],[35,10,35,12],[36,10,36,12],[37,10,37,12],[38,10,38,12],[30,10,30,12],[31,10,31,12],[32,10,32,12],[33,10,33,12],[34,10,34,12],[47,10,47,12],[58,10,58,12],[59,10,59,12],[60,10,60,12],[61,10,61,12],[43,10,43,12],[44,10,44,12],[45,10,45,12],[46,10,46,12],[57,10,57,12],[52,10,52,12],[53,10,53,12],[54,10,54,12],[55,10,55,12],[56,10,56,12],[48,10,48,12],[49,10,49,12],[50,10,50,12],[51,10,51,12],[67,10,67,12],[68,10,68,12],[69,10,69,12],[70,10,70,12],[71,10,71,12],[62,10,62,12],[63,10,63,12],[64,10,64,12],[65,10,65,12],[66,10,66,12],[85,10,85,12],[86,10,86,12],[87,10,87,12],[108,10,108,12],[109,10,109,12],[77,10,77,12],[72,10,72,12],[73,10,73,12],[74,10,74,12],[75,10,75,12],[76,10,76,12],[115,10,115,12],[116,10,116,12],[117,10,117,12],[118,10,118,12],[122,10,122,12],[110,10,110,12],[111,10,111,12],[112,10,112,12],[113,10,113,12],[114,10,114,12],[131,10,131,12],[132,10,132,12],[133,10,133,12],[134,10,134,12],[123,10,123,12],[124,10,124,12],[126,10,126,12],[127,10,127,12],[129,10,129,12],[140,10,140,12],[141,10,141,12],[142,10,142,12],[143,10,143,12],[144,10,144,12],[135,10,135,12],[136,10,136,12],[137,10,137,12],[138,10,138,12],[139,10,139,12],[150,10,150,12],[151,10,151,12],[152,10,152,12],[153,10,153,12],[154,10,154,12],[145,10,145,12],[146,10,146,12],[147,10,147,12],[148,10,148,12],[149,10,149,12],[162,10,162,12],[161,10,161,12],[166,10,166,12],[167,10,167,12],[168,10,168,12],[169,10,169,12],[155,10,155,12],[156,10,156,12],[157,10,157,12],[158,10,158,12],[160,10,160,12],[163,10,163,12],[180,10,180,12],[181,10,181,12],[182,10,182,12],[183,10,183,12],[184,10,184,12],[170,10,170,12],[171,10,171,12],[175,10,175,12],[177,10,177,12],[178,10,178,12],[190,10,190,12],[192,10,192,12],[193,10,193,12],[194,10,194,12],[195,10,195,12],[185,10,185,12],[186,10,186,12],[187,10,187,12],[188,10,188,12],[189,10,189,12],[203,10,203,12],[205,10,205,12],[206,10,206,12],[207,10,207,12],[196,10,196,12],[197,10,197,12],[198,10,198,12],[200,10,200,12],[201,10,201,12],[209,10,209,12],[210,10,210,12],[211,10,211,12],[208,10,208,12],[229,10,229,12],[230,10,230,12],[231,10,231,12],[232,10,232,12],[224,10,224,12],[225,10,225,12],[226,10,226,12],[227,10,227,12],[15,4,21,4],[15,5,21,5],[15,3,21,3],[210,3,216,3],[194,3,199,3],[248,10,248,12],[249,10,249,12],[0,0,1,0],[244,10,244,12],[245,10,245,12],[246,10,246,12],[247,10,247,12],[239,10,239,12],[240,10,240,12],[241,10,241,12],[242,10,242,12],[243,10,243,12],[235,10,235,12],[236,10,236,12],[237,10,237,12],[238,10,238,12],[233,10,233,12],[234,10,234,12],[228,10,228,12]]}
["Question Number","Requirement\nand location","Name of person completing assessment:"]
[null,null,"Name of department or entity (if applicable):"]
[null,null,"Date completed:"]
[null,"Kansas \nCybersecurity Act\nK.S.A 75-7240 \nSection and Line"]
[null,null,"Executive Branch Agency Head; Responsibilities; reports; training; breach protocol","What to look for:","Overall KCA",{"$f":"AVERAGE(F6:F23)","v":0},null,"Evidence/Explanation"]
[1,"(a)","Agency executive understands they are solely responsible for security of all data and information technology resources under such agency's purview, irrespective of the location of the data or resources.","Assessor should look to ask executives if they are aware of and understand their requirements for information security. ","NO",{"$f":"VLOOKUP(E6,Lookups!$A$2:$B$4,2,FALSE)","v":0}]
[2,"(b)","Ensure that an agency-wide information security program is in place","Organization leadership should affirm a program is in place.  An information security governance charter would be an example.","NO",{"$f":"VLOOKUP(E7,Lookups!$A$2:$B$4,2,FALSE)","v":0}]
[3,"(c) ","Designate an information security officer to administer the agency's information security program that reports directly to executive leadership","Organization should have an appointment letter on file for and ISO or communication appointing one.","NO",{"$f":"VLOOKUP(E8,Lookups!$A$2:$B$4,2,FALSE)","v":0}]
[4,"(d) ","Participate in CISO-sponsored statewide cybersecurity program initiatives and services",null,"NO",{"$f":"VLOOKUP(E9,Lookups!$A$2:$B$4,2,FALSE)","v":0}]
[5,"(e)","Implement policies and standards to ensure that all the agency's data and information technology resources are maintained in compliance with applicable state and federal laws","Agency should have information security policies in place or know to reference ITEC 7230 as their information security policy.","NO",{"$f":"VLOOKUP(E10,Lookups!$A$2:$B$4,2,FALSE)","v":0}]
[6,"(f)","Implement appropriate cost-effective safeguards to reduce, eliminate or recover from identified threats to data and information technology resources",null,"NO",{"$f":"VLOOKUP(E11,Lookups!$A$2:$B$4,2,FALSE)","v":0}]
[7,"(g)","Include all appropriate cybersecurity requirements in the agency's request for proposal specifications for procuring data and information technology systems and services","Agency should have recent RFP or contract available that has a section that addresses cybersecurity requirements.","NO",{"$f":"VLOOKUP(E12,Lookups!$A$2:$B$4,2,FALSE)","v":0}]
[8,"(h)(1)","Submit a cybersecurity vulnerability assessment report to the CISO by October 16 of each even-numbered year","Agency should have a copy of a complete agency vulnerability assessment.","NO",{"$f":"VLOOKUP(E13,Lookups!$A$2:$B$4,2,FALSE)","v":0}]
[9,"(h)(2)","Ensure that the agency conducts annual internal assessments of its security program.","Agency should have a copy of their internal security program assessment (e.g. a completed copy of this document or a previous version).","NO",{"$f":"VLOOKUP(E14,Lookups!$A$2:$B$4,2,FALSE)","v":0}]
[10,"(h)(3)","Prepare or have prepared a summary of the cybersecurity assessment report required in paragraph  excluding information that might put the data or information resources of the agency or its contractors at risk and submit such report to the house of representatives committee on government, technology and security or its successor committee and the senate committee on ways and means","Organization should have a redacted or aggregate summary report of their vulnerability assessment available for review.","NO",{"$f":"VLOOKUP(E15,Lookups!$A$2:$B$4,2,FALSE)","v":0}]
[11,"(i)","Participate in annual agency leadership training to ensure understanding of:","Organization should have record of executives taking awareness course specific to executives (e.g. certificate of completion from KISO executive training, or participating in a KISO sponsored executive symposium).","NO",{"$f":"VLOOKUP(E16,Lookups!$A$2:$B$4,2,FALSE)","v":0}]
[12,"(i)(1)","The information and information systems that support the operations and assets of the agency"]
[13,"(i)(2)","The potential impact of common types of cyberattacks and data breaches on the agency's operations and assets"]
[14,"(i)(3)","How cyber attacks and data breaches on the agency's operations and assets could impact the operations and assets of other governmental entities on the state enterprise network"]
[15,"(i)(4)","How cyber attacks and data breaches occur"]
[16,"(i)(5)","Steps to be undertaken by the executive director or agency head and agency employees to protect their information and information systems"]
[17,"(i)(6)","The annual reporting requirements required of the executive director or agency head"]
[null,"(j)","Agency must understand breach notification requirements outlined in K.S.A. 2018 Supp. 50-7a01 et seq., and amendments thereto, and applicable federal laws and rules and regulations.  In addition that they must notify the CISO not later than 48 hours after the discovery of the breach, suspected breach or unauthorized exposure. If breach, suspected breach or unauthorized exposure involves election data, they must notify the secretary of state","Assessor should ask organization executives if they are aware of their notification requirements.  Additional evidence could be in the inclusion of notification requirements in their incident response policy, plans, procedures, or incident response communication plan.","NO",{"$f":"VLOOKUP(E23,Lookups!$A$2:$B$4,2,FALSE)","v":0}]
[]
[null,"ITEC \n7230A\n(2019)\nSection\nand Line"]
[null,"6.0"," RISK MANAGEMENT STANDARD",null,null,{"$f":"IFERROR(AVERAGE(F27:F46),\"\")","v":0},null,"Evidence/Explanation"]
[{"$f":"IF(ISBLANK(G27),IF(ISBLANK(A26),A4+1,A26+1),\" \")","v":1},6.1,"Entities must develop a hierarchal Information Asset classification standard that assigns appropriate controls to each Information Asset classification. The standard must require the security controls specified in this document to be applied to Restricted-Use Information.","Organization should have a information asset classification (data classification) policy or reference that they use the 7230a standard to classify information assets.","NO",{"$f":"VLOOKUP(E27,Lookups!$A$2:$B$4,2,FALSE)","v":0}]
[{"$f":"IF(ISBLANK(G28),IF(ISBLANK(A27),A5+1,A27+1),\" \")","v":2},6.2,"Entities must also set a default information classification for all information. If no default standard is created, all information must be considered Restricted-Use Information.","Organization should have a information asset classification (data classification) policy or reference that they use the 7230a standard to classify information assets.","NO",{"$f":"VLOOKUP(E28,Lookups!$A$2:$B$4,2,FALSE)","v":0}]
[{"$f":"IF(ISBLANK(G29),IF(ISBLANK(A28),A6+1,A28+1),\" \")","v":3},6.3,"Entities must ensure that Information Asset trustees are appointed for the following Information Assets:","Entities should have a document that indicates who the Information Asset Trustee is.  (This role could also be labeled as the \"Data Owner\", Can use \"Roles and Responsibilities document published on KISO website.)","NO",{"$f":"VLOOKUP(E29,Lookups!$A$2:$B$4,2,FALSE)","v":0}]
[{"$f":"IF(ISBLANK(G30),IF(ISBLANK(A29),A7+1,A29+1),\" \")","v":4},"6.3.1","Intellectual property or",null,"NO",{"$f":"VLOOKUP(E30,Lookups!$A$2:$B$4,2,FALSE)","v":0}]
[{"$f":"IF(ISBLANK(G31),IF(ISBLANK(A30),A9+1,A30+1),\" \")","v":5},"6.3.2","Data compilations that contain or may be projected to contain Source Records on thirty (30) or more individuals of Restricted-Use Information.",null,"NO",{"$f":"VLOOKUP(E31,Lookups!$A$2:$B$4,2,FALSE)","v":0}]
[6,6.4,"Information Asset trustees must perform the following tasks for each information Asset: ","Organization should show that the individual identified as the Information Asset Trustee has seen and understands their role and responsibilities.  (Could use the Roles and Responsibilities document published on the KISO website and have the Trustee sign the document).","NO",{"$f":"VLOOKUP(E32,Lookups!$A$2:$B$4,2,FALSE)","v":0}]
[7,"6.4.1","Determine the potential impact to the affected entity, individuals and the State in the event of a loss of confidentiality, integrity, and availability of the Information Asset.",null,"NO",{"$f":"VLOOKUP(E33,Lookups!$A$2:$B$4,2,FALSE)","v":0}]
[8,"6.4.2","Classify the asset in accordance with the Entity’s Information Asset classification standard.",null,"NO",{"$f":"VLOOKUP(E34,Lookups!$A$2:$B$4,2,FALSE)","v":0}]
[9,"6.4.3","Ensure that the asset is handled in accordance with the Entity’s Information Asset handling standard.",null,"NO",{"$f":"VLOOKUP(E35,Lookups!$A$2:$B$4,2,FALSE)","v":0}]
[10,"6.4.4","Ensure that adverse events are reported to the Entity Information Security Officer (ISO).",null,"NO",{"$f":"VLOOKUP(E36,Lookups!$A$2:$B$4,2,FALSE)","v":0}]
[11,"6.4.5","Appoint Information Asset custodians.",null,"NO",{"$f":"VLOOKUP(E37,Lookups!$A$2:$B$4,2,FALSE)","v":0}]
[12,"6.4.6","Approve all access and use of the Information Asset.",null,"NO",{"$f":"VLOOKUP(E38,Lookups!$A$2:$B$4,2,FALSE)","v":0}]
[13,"6.4.7"," Recertify annually the classification, access, users and custodians of the Information Asset.",null,"NO",{"$f":"VLOOKUP(E39,Lookups!$A$2:$B$4,2,FALSE)","v":0}]
[14,6.5,"Information Asset custodians must perform the following responsibilities:","Organization should show that the individual identified as the Information Asset Custodian has seen and understands their role and responsibilities.  (Could use the Roles and Responsibilities document published on the KISO website)","NO",{"$f":"VLOOKUP(E40,Lookups!$A$2:$B$4,2,FALSE)","v":0}]
[15,"6.5.1","Implement and operate the safeguards and controls for Information Assets as directed by Information Asset trustees.",null,"NO",{"$f":"VLOOKUP(E41,Lookups!$A$2:$B$4,2,FALSE)","v":0}]
[16,6.6,"Entities must implement a documented risk management process that addresses risk identification, tracking, mitigation, reporting, and acceptance.","Organizations should have a Risk Management policy or procedure document","NO",{"$f":"VLOOKUP(E42,Lookups!$A$2:$B$4,2,FALSE)","v":0}]
[17,6.7,"Entities must document and track all outstanding risks (i.e. risk register).","Organization should have a document that lists identified risk and status of the risk.  Most likely a spreadsheet.","NO",{"$f":"VLOOKUP(E43,Lookups!$A$2:$B$4,2,FALSE)","v":0}]
[18,"6.8","Entities must periodically review existing risks","Organization should have a standing meeting to review risk.  A recurring calendar entry would evidence or dates or review indicated in the risk register.","NO",{"$f":"VLOOKUP(E44,Lookups!$A$2:$B$4,2,FALSE)","v":0}]
[{"$f":"IF(ISBLANK(G45),IF(ISBLANK(A44),A24+1,A44+1),\" \")","v":19},"6.9","Entities must process and approve any Variances or Exceptions to the requirements in this policy","Organization should have a signature process by where management approves and accepts the reisk of exceptions or variances to policy. Signed/Approved variance request form on KISO website would be an example ","NO",{"$f":"VLOOKUP(E45,Lookups!$A$2:$B$4,2,FALSE)","v":0}]
[20,"6.10","Entities must document, track and report any approved Variances or Exceptions","Organization should have a document to report exceptions/variances to policy.  (Can use exception form published on KISO website).","NO",{"$f":"VLOOKUP(E46,Lookups!$A$2:$B$4,2,FALSE)","v":0}]
[null,"7.0","ASSESSMENT AND SECURITY PLANNING STANDARD",null,"Section 7 Overall",{"$f":"IFERROR(AVERAGE(F48,F52),\"\")","v":0}]
[null,null,"Risk Assessment",null,null,{"$f":"IFERROR(AVERAGE(F49:F51),\"\")","v":0},null,"Evidence/Explanation"]
[21,"7.1","Entities must assess and document the risks to information systems that process, store or transmit Restricted-Use Information.","Organization should have a risk assessment for each of their information systems (Check to see if they have a completed assessment)","NO",{"$f":"VLOOKUP(E49,Lookups!$A$2:$B$4,2,FALSE)","v":0}]
[{"$f":"IF(ISBLANK(G50),IF(ISBLANK(A49),A48+1,A49+1),\" \")","v":22},"7.2","Entity risk assessments must identify potential threats and characterize the likelihood and impact of the threat being realized.","These components should be within the risk assessments","NO",{"$f":"VLOOKUP(E50,Lookups!$A$2:$B$4,2,FALSE)","v":0}]
[{"$f":"IF(ISBLANK(G51),IF(ISBLANK(A50),A49+1,A50+1),\" \")","v":23},"7.3","Entities must assess and document risks prior to placing an information system into service, whenever a significant change is made, and at least once every three (3) years thereafter.","Organizations should date when their risk assessment was initially conducted, update, or reviewed.  This should be on the risk assessment document.","NO",{"$f":"VLOOKUP(E51,Lookups!$A$2:$B$4,2,FALSE)","v":0}]
[null,null,"Security Planning",null,null,{"$f":"IFERROR(AVERAGE(F53:F54),\"\")","v":0},null,"Evidence/Explanation"]
[{"$f":"IF(ISBLANK(G53),IF(ISBLANK(A52),A51+1,A52+1),\" \")","v":24},"7.4","Entities must document a security plan that specifies security controls based upon a risk assessment for information systems that process, store or transmit Restricted-Use Information.","Organization should have a System Security Plan (SSP) document for each of their defined information systems ( See if they have a completed SSP for any of their systems)","NO",{"$f":"VLOOKUP(E53,Lookups!$A$2:$B$4,2,FALSE)","v":0}]
[{"$f":"IF(ISBLANK(G54),IF(ISBLANK(A53),A52+1,A53+1),\" \")","v":25},"7.5","The set of security controls in the security plan must be sufficient to adequately mitigate risks to organizational operations and assets, individuals, other organizations and the state, based on the entity risk tolerance.","Information system controls should be determined off of some sort of risk categorization such as NIST FIPS199 or other organization defined risk categories.","NO",{"$f":"VLOOKUP(E54,Lookups!$A$2:$B$4,2,FALSE)","v":0}]
[null,"8.0","AWARENESS AND TRAINING STANDARD",null,"Section 8 Overall",{"$f":"IFERROR(AVERAGE(F56),\"\")","v":0}]
[null,null,"Security Awareness Training",null,null,{"$f":"IFERROR(AVERAGE(F57:F73),\"\")","v":0},null,"Evidence/Explanation"]
[{"$f":"IF(ISBLANK(G56),IF(ISBLANK(A55),A54+1,A55+1),A56+1)","v":26},"8.1","Entities must provide and conduct security awareness training for all Users.","Organization should identify where they are getting their security awareness training from (internally produce, utilize KISO, or contract). This could be included an a Training Policy","NO",{"$f":"VLOOKUP(E57,Lookups!$A$2:$B$4,2,FALSE)","v":0}]
[{"$f":"IF(ISBLANK(G58),IF(ISBLANK(A57),A56+1,A57+1),\" \")","v":27},"8.2","Entities must require all employees to complete security awareness training within ninety (90) days of hire and on an annual basis thereafter.","Check training completion records for individuals within the organization to include a long time employee and a new hire individual","NO",{"$f":"VLOOKUP(E58,Lookups!$A$2:$B$4,2,FALSE)","v":0}]
[28,"8.3","Entities must retain a form of acknowledgement of training completion.","Organization should have some way of tracking user completion such as a signed attendance roster for in person training, signature sheet, system generated report, or certificate of completion.","NO",{"$f":"VLOOKUP(E59,Lookups!$A$2:$B$4,2,FALSE)","v":0}]
[29,"8.4","Entities must review their security awareness training materials at least annually or more frequently as needed.","Entities should document the review of material or show that the material has changed from year to year.","NO",{"$f":"VLOOKUP(E60,Lookups!$A$2:$B$4,2,FALSE)","v":0}]
[30,"8.5","Awareness training must address the following topics at a minimum:","Organization should be able to provide a list of topics covered in their security awareness training or provide a copy of the training.","NO",{"$f":"VLOOKUP(E61,Lookups!$A$2:$B$4,2,FALSE)","v":0}]
[31,"8.5.1","Passwords including creation, changing, aging and confidentiality"]
[32,"8.5.2","Privacy and proper handling of sensitive information"]
[33,"8.5.3","Physical security"]
[34,"8.5.4","Social engineering"]
[35,"8.5.5","Identity theft avoidance and action"]
[36,"8.5.6","Email usage"]
[37,"8.5.7","Internet usage"]
[38,"8.5.8","Viruses and malware"]
[39,"8.5.9","Software usage, copyrights and file sharing"]
[40,"8.5.10","Portable devices"]
[41,"8.5.11","Proper use of encryption devices"]
[42,"8.5.12","Reporting of suspicious activity and abuse"]
[null,"9.0","ACCESS CONTROL STANDARD",null,"Section 9 Overall",{"$f":"IFERROR(AVERAGE(F75,F117,F124),\"\")","v":0}]
[null,null,"Identification and Authentication",null,null,{"$f":"IFERROR(AVERAGE(F76:F116),\"\")","v":0},null,"Evidence/Explanation"]
[{"$f":"IF(ISBLANK(G75),IF(ISBLANK(A74),A73+1,A74+1),A75+1)","v":43},"9.1","User access to Critical Systems or Information Systems that process, store or transmit Restricted-Use Information must be authorized by an appropriate Entity official through established protocols within the entity.","A paper trail of approval or system should be in place tracking a users access to resources.  Look for a user access request form or a system access form to request access.","NO",{"$f":"VLOOKUP(E76,Lookups!$A$2:$B$4,2,FALSE)","v":0}]
[{"$f":"IF(ISBLANK(G77),IF(ISBLANK(A76),A75+1,A76+1),\" \")","v":44},"9.2","Users of Critical Systems or Information Systems that process, store or transmit Restricted-Use Information must be authenticated by a unique system identifier.","Each user should have a unique UserID or account.  Organizations should be able to show in Active Directory or other applications.","NO",{"$f":"VLOOKUP(E77,Lookups!$A$2:$B$4,2,FALSE)","v":0}]
[45,"9.3","Users with administrative rights or elevated privileges must use a separate account to perform tasks that require elevated privileges or administrative rights.","Organization should show the two separate accounts used by administrators. This would typically be done in Active Directory","NO",{"$f":"VLOOKUP(E78,Lookups!$A$2:$B$4,2,FALSE)","v":0}]
[46,"9.3.1","Administrative rights and elevated privilege accounts must only be used for activities that require elevated privileges (i.e. not for email access or internet browsing).","Organization should have a policy indicating the abilities of admin accounts or have a technical control in place to prevent prohibited activities.","NO",{"$f":"VLOOKUP(E79,Lookups!$A$2:$B$4,2,FALSE)","v":0}]
[47,"9.3.2","Multi-Factor Authentication must be used for administrative rights or elevated privilege accounts","Organization should show the MFA solution that is being utilized for admin accounts","NO",{"$f":"VLOOKUP(E80,Lookups!$A$2:$B$4,2,FALSE)","v":0}]
[48,"9.3.3","User accounts with administrative rights or elevated privileges must not have an email account or mailbox provisioned or associated with it.","Organization should show that admin accounts do not have an address in the Email Global Address List (GAL)","NO",{"$f":"VLOOKUP(E81,Lookups!$A$2:$B$4,2,FALSE)","v":0}]
[49,"9.4","System Service Accounts must be approved and documented for proper business use prior to creation and must be reviewed and approved annually for continued use.","Organizations should have a document that tracks service accounts and has review dates (Could be an Excel document or Word document)","NO",{"$f":"VLOOKUP(E82,Lookups!$A$2:$B$4,2,FALSE)","v":0}]
[50,"9.5","System Service Accounts must be configured with least privilege and only used for a single task or service","Service Accounts should not be in the \"Domain Admin\" group in active directory or used in multiple applications.","NO",{"$f":"VLOOKUP(E83,Lookups!$A$2:$B$4,2,FALSE)","v":0}]
[51,"9.6","Unique system identifiers will be associated with a unique Information System authenticator (i.e. password, token etc.)","Language should be in account creation standards and procedures to address linking of unique authenticators to idenfiers","NO",{"$f":"VLOOKUP(E84,Lookups!$A$2:$B$4,2,FALSE)","v":0}]
[52,"9.7","Unique Information System authenticators must be delivered in a secure and confidential manner.","Organization should have procedure to deliver authenticators to the user of authenticators","NO",{"$f":"VLOOKUP(E85,Lookups!$A$2:$B$4,2,FALSE)","v":0}]
[53,"9.8","Passwords must not be viewable in clear text except by the account holder.","Passwords should not be transmitted or stored  in uncrypted formats like Excel spreadsheets or Telnet etc.","NO",{"$f":"VLOOKUP(E86,Lookups!$A$2:$B$4,2,FALSE)","v":0}]
[54,"9.9","Passwords must not be transmitted or electronically stored in clear text.","Passwords should not be transmitted or stored  in uncrypted formats like Excel spreadsheets or Telnet etc.","NO",{"$f":"VLOOKUP(E87,Lookups!$A$2:$B$4,2,FALSE)","v":0}]
[55,"9.10","Passwords must not be shared and must be kept confidential.","Organizations should have reminders to staff or policy not to share passwords to their unique accounts.  This could also be part of training material.","NO",{"$f":"VLOOKUP(E88,Lookups!$A$2:$B$4,2,FALSE)","v":0}]
[56,"9.11","Passwords for sytem User accounts must be constructed with the following requirements:","Password settings are typically controlled through Active Directory Group Policy.  Have agency show GPO settings that show password requirements.","NO",{"$f":"VLOOKUP(E89,Lookups!$A$2:$B$4,2,FALSE)","v":0}]
[57,"9.11.1","A minimum of twelve (12) characters in length."]
[58,"9.11.2","Contain three (3) of four (4) of the following categories:"]
[59,null,"Uppercase"]
[60,null,"Lowercase"]
[61,null,"Numeral"]
[62,null,"Non-alpha numeric character"]
[63,"9.11.3","Must not contain the user ID"]
[64,"9.11.4","Must not be changed more frequently than once every one (1) day without system administrator intervention"]
[65,"9.11.5","Must not have a lifespan that exceeds one hundred eighty (180) days"]
[66,"9.11.6","Must be different from the previous twenty-four (24) passwords"]
[67,"9.12","Passwords for System Service Accounts must be constructed with the following requirements:","Password settings are typically controlled through Active Directory Group Policy.  Have agency show GPO settings that show password requirements.","NO",{"$f":"VLOOKUP(E100,Lookups!$A$2:$B$4,2,FALSE)","v":0}]
[68,"9.12.1","A minimum of twelve (12) characters in length."]
[69,"9.12.2","Contain three (3) of four (4) of the following categories:"]
[70,null,"Uppercase"]
[71,null,"Lowercase"]
[72,null,"Numeral"]
[73,null,"Non-alpha numeric character"]
[74,"9.12.3","Must not contain the user ID"]
[75,"9.12.4","Must not have a lifespan that exceeds three hundred sixty-five (365) days"]
[76,"9.13","Where tokens, whether soft tokens or physical tokens, as authenticators are used:","If agency uses tokens, agnecy should have a procedure document that addresses the issuance, revocation and handling of lost, stolen or damaged tokens.","NO",{"$f":"VLOOKUP(E109,Lookups!$A$2:$B$4,2,FALSE)","v":0}]
[77,"9.13.1","A documented process must be followed for token distribution. "]
[78,"9.13.2","A documented process must be followed for token revocation. "]
[79,"9.13.3","A documented process must be followed for the handling of lost, stolen or damaged tokens. "]
[80,"9.14","Where biometric data is used for authentication:","If agency uses biometrics, agnecy should have a procedure document that addresses the how they capture biometric data, revoke it and properly handling of the biometric data.","NO",{"$f":"VLOOKUP(E113,Lookups!$A$2:$B$4,2,FALSE)","v":0}]
[81,"9.14.1","A documented process must be followed for capturing user biometric data. "]
[82,"9.14.2","A documented process must be followed for biometric revocation."]
[83,"9.14.3"," A documented process must be followed for the handling of user biometric data."]
[null,null,"Account Management",null,null,{"$f":"IFERROR(AVERAGE(F118:F123),\"\")","v":0},null,"Evidence/Explanation"]
[{"$f":"IF(ISBLANK(G118),IF(ISBLANK(A117),A116+1,A117+1),\" \")","v":84},"9.15","All Information System accounts must be configured according to the principle of least privilege.","Organization accounts should only be given permission to resources specifically needed to do their jobs.  Organization should describe how they accomplish that (e.g. role based access, system roles, etc.).","NO",{"$f":"VLOOKUP(E118,Lookups!$A$2:$B$4,2,FALSE)","v":0}]
[85,"9.16","Separation of duties must be enforced through account privileges","Accounts should have specific abilities that they can perform (In Active Directory this is done through security groups and permissions)","NO",{"$f":"VLOOKUP(E119,Lookups!$A$2:$B$4,2,FALSE)","v":0}]
[86,"9.16.1","No single user account can have privileges to authorize, perform, review, and audit a single transaction","Check to see if applications allow users to delete records of their activity.  ","NO",{"$f":"VLOOKUP(E120,Lookups!$A$2:$B$4,2,FALSE)","v":0}]
[87,"9.16.2","When available, role-based access controls (RBAC) must be implemented and enforced for systems that contain Restricted-Use Information or systems designated as a Critical System.","Where possible, systems should have defined sets of permissions based on specific roles.  Organization should have a roles/permissions document or matrix for each information system.","NO",{"$f":"VLOOKUP(E121,Lookups!$A$2:$B$4,2,FALSE)","v":0}]
[88,"9.17","Information System accounts must be restricted to a maximum of five (5) consecutive failed attempts before being locked.","Account lockout settings are typically controlled through Active Directory Group Policy.  Have agency show GPO settings that show account lockout settings.","NO",{"$f":"VLOOKUP(E122,Lookups!$A$2:$B$4,2,FALSE)","v":0}]
[89,"9.18","Accounts must remain locked out for a minimum of thirty (30) minutes without administrator intervention.","Account lockout settings are typically controlled through Active Directory Group Policy.  Have agency show GPO settings that show account lockout settings.","NO",{"$f":"VLOOKUP(E123,Lookups!$A$2:$B$4,2,FALSE)","v":0}]
[null,null,"Session Management",null,null,{"$f":"IFERROR(AVERAGE(F125:F132),\"\")","v":0},null,"Evidence/Explanation"]
[{"$f":"IF(ISBLANK(G125),IF(ISBLANK(A124),A123+1,A124+1),\" \")","v":90},"9.19","Information systems must display a system use notification identifying system ownership, system usage restrictions, prohibition of unauthorized access, implied consent and associated penalties for unauthorized access. The user must acknowledge the system use notification before gaining access to the information system.","Check workstation login process or ask to see GPO setting within Active Directory.","NO",{"$f":"VLOOKUP(E125,Lookups!$A$2:$B$4,2,FALSE)","v":0}]
[91,"9.20","Entities must establish and document usage restrictions, configuration/connection requirements, and implementation guidance for each type of Remote Access allowed.","Organization should have a remote access policy or procedure document.","NO",{"$f":"VLOOKUP(E126,Lookups!$A$2:$B$4,2,FALSE)","v":0}]
[92,"9.21","Entities must authorize Remote Access to an Information System prior to allowing such connections","Organization should have an approval process whether written or systematically to request and approve remote access.","NO",{"$f":"VLOOKUP(E127,Lookups!$A$2:$B$4,2,FALSE)","v":0}]
[93,"9.22","When available, entities must deploy MFA for Remote Access to Critical Systems or systems containing Restricted-Use Information.","Organizations should begin employing applications that require multifactor authentication.","NO",{"$f":"VLOOKUP(E128,Lookups!$A$2:$B$4,2,FALSE)","v":0}]
[94,"9.23","Remote Access sessions must be encrypted, auditable, and traverse managed access points.","Remote access from outside the organization into the organization network should utilize a technology such as a VPN","NO",{"$f":"VLOOKUP(E129,Lookups!$A$2:$B$4,2,FALSE)","v":0}]
[95,"9.24","Remote sessions to information systems that process, store or transmit Restricted-Use Information must be terminated after a period of thirty (30) minutes of inactivity.","Organization can show session termination and time limit settings within Active Directory or within their VPN solution.","NO",{"$f":"VLOOKUP(E130,Lookups!$A$2:$B$4,2,FALSE)","v":0}]
[96,"9.25","Local console sessions on information systems that process, store or transmit Restricted-Use Information must be locked after a period of thirty (30) minutes of inactivity.  ","Organization can show inactivity limit settings within Active Directory","NO",{"$f":"VLOOKUP(E131,Lookups!$A$2:$B$4,2,FALSE)","v":0}]
[97,"9.26","Authentication must be required to unlock a console session or reestablish a remote session.","Organization can show unlock settings within Active Directory","NO",{"$f":"VLOOKUP(E132,Lookups!$A$2:$B$4,2,FALSE)","v":0}]
[null,"10.0","SYSTEMS CONFIGURATION STANDARD",null,"Section 10 Overall",{"$f":"IFERROR(AVERAGE(F134,F140,F150),\"\")","v":0}]
[null,null,"Configuration Management",null,null,{"$f":"IFERROR(AVERAGE(F135:F139),\"\")","v":0},null,"Evidence/Explanation"]
[{"$f":"IF(ISBLANK(G135),IF(ISBLANK(A134),IF(ISBLANK(A133),A132+1,A133+1),A134+1),\" \")","v":98},"10.1","Entities must build information systems that process, store or transmit Restricted-Use Information from a standard configuration baseline.","Organization should use a baseline configuration such as CIS Benchmarks, DISA Stigs, IRS SCSEMS, etc. to configure their systems.  They may define their own if they wish.","NO",{"$f":"VLOOKUP(E135,Lookups!$A$2:$B$4,2,FALSE)","v":0}]
[{"$f":"IF(ISBLANK(H136),IF(ISBLANK(A135),A134+1,A135+1),\" \")","v":99},"10.2","The standard configuration baseline must include the specifications of the information system components and the security controls for each component.","If using a known baseline like CIS Benchmarks etc., controls are specified by the baseline","NO",{"$f":"VLOOKUP(E136,Lookups!$A$2:$B$4,2,FALSE)","v":0}]
[{"$f":"IF(ISBLANK(G137),IF(ISBLANK(A136),A135+1,A136+1),\" \")","v":100},"10.3","Entities must maintain an asset inventory of information systems components and update it as it changes and review it at least annually.","Organization should track information system components, whether physical or virtual, in an inventory system, spreadsheet, or diagram.","NO",{"$f":"VLOOKUP(E137,Lookups!$A$2:$B$4,2,FALSE)","v":0}]
[{"$f":"IF(ISBLANK(G138),IF(ISBLANK(A137),A136+1,A137+1),\" \")","v":101},"10.4","The asset inventory must also identify and document the relationships between each of the information system components and the ownership of each component.","Organization should have  diagrams depicting the relationship or explain the relationship within the inventory documents.","NO",{"$f":"VLOOKUP(E138,Lookups!$A$2:$B$4,2,FALSE)","v":0}]
[{"$f":"IF(ISBLANK(G139),IF(ISBLANK(A138),A137+1,A138+1),\" \")","v":102},"10.5","Collaborative infrastructure, such as video and teleconferencing, must be configured to prohibit remote activation.","Check configuration settings for video and teleconferencing equipment.  Physical barrier devices are acceptable such as web camera shields etc.","NO",{"$f":"VLOOKUP(E139,Lookups!$A$2:$B$4,2,FALSE)","v":0}]
[null,null,"Change Control",null,null,{"$f":"IFERROR(AVERAGE(F141:F155),\"\")","v":0},null,"Evidence/Explanation"]
[{"$f":"IF(ISBLANK(G141),IF(ISBLANK(A140),A139+1,A140+1),\" \")","v":103},"10.6","Entities must document and adhere to change control processes when making changes to production systems.","Organization should have a change control policy or procedures document.","NO",{"$f":"VLOOKUP(E141,Lookups!$A$2:$B$4,2,FALSE)","v":0}]
[104,"10.7","Change control requests must include proposed change description, justification, risk assessment, implementation plan, test plan, back-out plan, review and approval.","A change control request document should be created and available for review","NO",{"$f":"VLOOKUP(E142,Lookups!$A$2:$B$4,2,FALSE)","v":0}]
[105,"10.8","Entities must maintain a change log for information systems containing Restricted-Use Information.","Entity should have a change register (Excel Document, Form in binder, System/Application, etc.)","NO",{"$f":"VLOOKUP(E143,Lookups!$A$2:$B$4,2,FALSE)","v":0}]
[106,"10.9","The change log must include:","Review Change log for details","NO",{"$f":"VLOOKUP(E144,Lookups!$A$2:$B$4,2,FALSE)","v":0}]
[107,"10.9.1","Date and time of maintenance"]
[108,"10.9.2","Name and organization of person performing change"]
[109,"10.9.3","Name of escort, if required"]
[110,"10.9.4","Description of maintenance performed"]
[111,"10.9.5","List of affected information systems components or component elements"]
[null,null,"Systems Protection",null,null,{"$f":"IFERROR(AVERAGE(F151:F155),\"\")","v":0},null,"Evidence/Explanation"]
[{"$f":"IF(ISBLANK(G151),IF(ISBLANK(A163),A149+1,A163+1),\" \")","v":112},"10.10","Entities must implement boundary protection mechanisms with capability to monitor and control network communications.","Organization should have a Firewall the physically and logically separates their network from public networks or other organizations networks","NO",{"$f":"VLOOKUP(E151,Lookups!$A$2:$B$4,2,FALSE)","v":0}]
[{"$f":"IF(ISBLANK(G152),IF(ISBLANK(A151),A163+1,A151+1),\" \")","v":113},"10.11","Within the boundary, entities must create security zones based on data and information system classification.","Organizations should further logically separate their internal networks with VLAN,VRFs, or DMZs.","NO",{"$f":"VLOOKUP(E152,Lookups!$A$2:$B$4,2,FALSE)","v":0}]
[{"$f":"IF(ISBLANK(G153),IF(ISBLANK(A152),A151+1,A152+1),\" \")","v":114},"10.12","Entities must employ malicious code protection mechanisms on systems that contain Restricted-Use Information.","Organization should have an anti-virus client on systems. ","NO",{"$f":"VLOOKUP(E153,Lookups!$A$2:$B$4,2,FALSE)","v":0}]
[{"$f":"IF(ISBLANK(G154),IF(ISBLANK(A153),A152+1,A153+1),\" \")","v":115},"10.13","Entities must configure malicious code protection mechanisms to perform weekly scans of files on information systems.","Organization anti-virus console should show the scanning schedule","NO",{"$f":"VLOOKUP(E154,Lookups!$A$2:$B$4,2,FALSE)","v":0}]
[{"$f":"IF(ISBLANK(G155),IF(ISBLANK(A154),A153+1,A154+1),\" \")","v":116},"10.14","Where malicious code protection mechanisms require regular signature or detection engine updates, entities must employ a documented update mechanism that includes testing and installation of applicable updates.","Anti-virus console anti-virus client should show the update cadence of the program.","NO",{"$f":"VLOOKUP(E155,Lookups!$A$2:$B$4,2,FALSE)","v":0}]
[null,"11.0","DATA PROTECTION STANDARD",null,"Section 11 Overall",{"$f":"IFERROR(AVERAGE(F157:F162,F163),\"\")","v":0},null,"Evidence/Explanation"]
[{"$f":"IF(ISBLANK(G157),IF(ISBLANK(A156),A155+1,A156+1),\" \")","v":117},"11.1","Entities must employ mechanism(s) to ensure the confidentiality, availability and integrity of Restricted-Use Information.","Organization should have managerial, operational, and technical controls in place to ensure confidentiality, integrity and availability of RUI.","NO",{"$f":"VLOOKUP(E157,Lookups!$A$2:$B$4,2,FALSE)","v":0}]
[118,"11.2","Restricted-Use Information that has met the information retention schedule must be removed, destroyed or deleted in a verifiable manner.","Organization should have a data retention policy and procedures to remove old data. (Overwrite, database purge, system deletes)","NO",{"$f":"VLOOKUP(E158,Lookups!$A$2:$B$4,2,FALSE)","v":0}]
[119,"11.3","Restricted-Use Information must be protected from unauthorized disclosure.","Organization should have access controls in place to prevent unauthorized access/disclosure to RUI.  Access control policy or procedures should be in place.","NO",{"$f":"VLOOKUP(E159,Lookups!$A$2:$B$4,2,FALSE)","v":0}]
[120,"11.4","Entities must use encryption modules, ciphers, or algorithms found within the NIST FIPS 140-2 validated list when encrypting Restricted-Use Information.","Organization should use encryption solutions built into systems and not create their own (e.g. not creating XOR ciphers).","NO",{"$f":"VLOOKUP(E160,Lookups!$A$2:$B$4,2,FALSE)","v":0}]
[121,"11.5","Restricted-Use Information when transmitted electronically outside of a secure boundary must be encrypted.","Organization should use tools such as Enterprise VPNs, client VPNs, websites with SSL/TLS or SSL/TLS tunnels to share sensitive information outside of their network to customers, partners, or other state organizations.","NO",{"$f":"VLOOKUP(E161,Lookups!$A$2:$B$4,2,FALSE)","v":0}]
[122,"11.6","Restricted-Use Information must be encrypted when stored on Portable Electronic Media or Portable Electronic Devices.","Devices such as laptops, tablets, smart phones, USB storage devices (hard drives or thumb drives) etc. must have encryption enabled.  For Windows based tablets and laptops, and USB storage devices (hard drives or thumb drives), Microsoft Bitlocker is the simplest solution.","NO",{"$f":"VLOOKUP(E162,Lookups!$A$2:$B$4,2,FALSE)","v":0}]
[null,null,"Media",null,null,{"$f":"IFERROR(AVERAGE(F164:F166),\"\")","v":0},null,"Evidence/Explanation"]
[{"$f":"IF(ISBLANK(G164),IF(ISBLANK(A163),A162+1,A163+1),\" \")","v":123},"11.7","Media containing Restricted-Use Information must be disposed of in accordance with NIST Special Publication 800-88 – Guidelines for Media Sanitization.","Digital media should be degaussed, shredded, or overwritten with approved tools. Paper media should be shredded using a shredder not by hand.  Organization should identify how they dispose of media or provided the contract/vendor they use to dispose of media.","NO",{"$f":"VLOOKUP(E164,Lookups!$A$2:$B$4,2,FALSE)","v":0}]
[{"$f":"IF(ISBLANK(G165),IF(ISBLANK(A164),A162+1,A164+1),\" \")","v":124},"11.8","Media that stores Restricted-Use Information must be stored securely within a controlled area and physical access to that controlled area must be restricted to authorized personnel.","RUI should not be left in the open without individuals monitoring and protecting it.  Cleared staff serve as a control method.  If no staff is around media should be out of sight and secured in locked offices or locked file cabinets.","NO",{"$f":"VLOOKUP(E165,Lookups!$A$2:$B$4,2,FALSE)","v":0}]
[{"$f":"IF(ISBLANK(G166),IF(ISBLANK(A165),A163+1,A165+1),\" \")","v":125},"11.9","Media containing Restricted-Use Information must be transported by authorized personnel when leaving a controlled area and must be transported in a manner that ensures appropriate safeguards are applied.","Organization should have procedure for transporting RUI outside of the office if data is not encrypted on digital media, or on printed media.","NO",{"$f":"VLOOKUP(E166,Lookups!$A$2:$B$4,2,FALSE)","v":0}]
[null,"12.0","APPLICATION PROCESSING STANDARD",null,"Section 12 Overall",{"$f":"IFERROR(AVERAGE(F168:F169),\"\")","v":0},null,"Evidence/Explanation"]
[{"$f":"IF(ISBLANK(G168),IF(ISBLANK(A167),A166+1,A167+1),\" \")","v":126},"12.1","Entities must define and document principles and procedures for secure application development.","Entities should have a secure coding or coding standards document","NO",{"$f":"VLOOKUP(E168,Lookups!$A$2:$B$4,2,FALSE)","v":0}]
[{"$f":"IF(ISBLANK(G169),IF(ISBLANK(A168),A167+1,A168+1),\" \")","v":127},"12.2","The application element of all information systems components must logically separate user functionality from administrative functionality such that the interface for the one cannot be used to operate the other.","Applications should have at least two roles within the system, administrator and user.  Examine roles within an application to validate separation.","NO",{"$f":"VLOOKUP(E169,Lookups!$A$2:$B$4,2,FALSE)","v":0}]
[null,"13.0","SYSTEMS OPERATIONS STANDARD",null,"Section 13 Overall",{"$f":"IFERROR(AVERAGE(F171,F182,F187),\"\")","v":0}]
[null,null,"Assessment Operations",null,null,{"$f":"IFERROR(AVERAGE(F172:F181),\"\")","v":0},null,"Evidence/Explanation"]
[{"$f":"IF(ISBLANK(G171),IF(ISBLANK(A170),A169+1,A170+1),\"A166+1\")","v":128},"13.1","Entities must perform security assessments against all Critical Systems and all Information Systems that process, store or transmit Restricted-Use Information prior to installation in production environments and at least annually thereafter. Security assessments are required to ensure that security controls are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting the security requirements of the system.","Organization should test security controls of applications such as password requirements, timeouts, etc.  Organization should have document that describes what is tested and what the outcome was.","NO",{"$f":"VLOOKUP(E172,Lookups!$A$2:$B$4,2,FALSE)","v":0}]
[{"$f":"IF(ISBLANK(G172),IF(ISBLANK(A172),A170+1,A172+1),\" \")","v":129},"13.1.1","Entities must have a documented remediation plan for security issues discovered in security assessments.","Entity should create a Plan of Action and Milestones document (POA&M) for each information system.  KISO template is available.  Organization should date each review.","NO",{"$f":"VLOOKUP(E173,Lookups!$A$2:$B$4,2,FALSE)","v":0}]
[130,"13.1.2","Entities must prioritize and establish timelines for implementing corrective actions for all security issues within the remediation plan."]
[131,"13.1.3","Entities must review all remediation plans and update them at least quarterly."]
[132,"13.2","Entities must perform vulnerability scans against all Information Systems prior to installation into production environments.","Organization should have a vulnerability scan on file for systems going into production after September 30, 2019.","NO",{"$f":"VLOOKUP(E176,Lookups!$A$2:$B$4,2,FALSE)","v":0}]
[133,"13.3","Entities must perform vulnerability scans against all network connected Information Systems at least monthly.","Organization should provide a copy of a recent vulnerability scan report for review","NO",{"$f":"VLOOKUP(E177,Lookups!$A$2:$B$4,2,FALSE)","v":0}]
[134,"13.4","Entities must monitor for security alerts and advisories relative to the technologies that are operating within their environments.","Organization should receive alerts from the KISO, MS-ISAC, US-CERT, Microsoft, Oracle, or other recognizable authorities on computer security.","NO",{"$f":"VLOOKUP(E178,Lookups!$A$2:$B$4,2,FALSE)","v":0}]
[135,"13.5","Entities must have a documented patch management process.","Organization should have a patch management policy, procedure, or standards document","NO",{"$f":"VLOOKUP(E179,Lookups!$A$2:$B$4,2,FALSE)","v":0}]
[136,"13.5.1","Patch requirements discovered or resulting from vulnerability scans or continuous monitoring must be addressed expeditiously.","Compare Scan results over time and see if there is a trend of stability or decline","NO",{"$f":"VLOOKUP(E180,Lookups!$A$2:$B$4,2,FALSE)","v":0}]
[137,"13.5.2","Entities must use a risk-based approach to patch vulnerabilities or deploy mitigating controls when unable to patch vulnerabilities.","See if organization documents mitigating controls when patching is unavailable or unfeasible","NO",{"$f":"VLOOKUP(E181,Lookups!$A$2:$B$4,2,FALSE)","v":0}]
[null,null,"Integrity Operations",null,null,{"$f":"IFERROR(AVERAGE(F183:F186),\"\")","v":0},null,"Evidence/Explanation"]
[{"$f":"IF(ISBLANK(G183),IF(ISBLANK(A182),A181+1,A182+1),\" \")","v":138},"13.6","Entities must implement controls to ensure that configuration settings are within acceptable parameters.","Organization should provide a copy of a configuration compliance scan to measure configurations against their baselines. ","NO",{"$f":"VLOOKUP(E183,Lookups!$A$2:$B$4,2,FALSE)","v":0}]
[{"$f":"IF(ISBLANK(G184),IF(ISBLANK(A183),A182+1,A183+1),\" \")","v":139},"13.7","Entities must implement integrity monitoring on information systems that process, store or transmit Restricted-Use Information.","Organization should provide a copy of a configuration compliance scan to measure configurations against their baselines. Tracking against the baseline can identify changes to configuration settings.","NO",{"$f":"VLOOKUP(E184,Lookups!$A$2:$B$4,2,FALSE)","v":0}]
[{"$f":"IF(ISBLANK(G185),IF(ISBLANK(A184),A183+1,A184+1),\" \")","v":140},"13.8","Entities must document and investigate integrity discrepancies.","Organization should determine the nature of discrepancies and how they came about.","NO",{"$f":"VLOOKUP(E185,Lookups!$A$2:$B$4,2,FALSE)","v":0}]
[{"$f":"IF(ISBLANK(G186),IF(ISBLANK(A185),A184+1,A185+1),\" \")","v":141},"13.9","Entities must validate, then circulate security alerts to appropriate personnel and ensure corrective action is taken.","Organization should describe how they treat security alerts once received from sources internally or externally.","NO",{"$f":"VLOOKUP(E186,Lookups!$A$2:$B$4,2,FALSE)","v":0}]
[null,null,"Maintenance Operations",null,null,{"$f":"IFERROR(AVERAGE(F188:F192),\"\")","v":0},null,"Evidence/Explanation"]
[{"$f":"IF(ISBLANK(G188),IF(ISBLANK(A187),A186+1,A187+1),\" \")","v":142},"13.10","Entities must not operate information systems containing Restricted-Use Information without either redundant qualified in-house staff or by contract for vendor managed support.","Information systems should not have any support single points of failure or left in an unsupported stated.  See if organization has assignments of who is supporting information system.","NO",{"$f":"VLOOKUP(E188,Lookups!$A$2:$B$4,2,FALSE)","v":0}]
[{"$f":"IF(ISBLANK(G189),IF(ISBLANK(A188),A187+1,A188+1),\" \")","v":143},"13.11","Entities must configure critical information systems to be fault tolerant.","Critical information systems should be made up of redundant components such as power supplies, hard drives, etc.","NO",{"$f":"VLOOKUP(E189,Lookups!$A$2:$B$4,2,FALSE)","v":0}]
[{"$f":"IF(ISBLANK(G190),IF(ISBLANK(A189),A188+1,A189+1),\" \")","v":144},"13.12","Entities must ensure that critical data is restorable to a known secure state of operations.","Organization should be taking backups of their system.  Review backup schedule for completion and success","NO",{"$f":"VLOOKUP(E190,Lookups!$A$2:$B$4,2,FALSE)","v":0}]
[{"$f":"IF(ISBLANK(G191),IF(ISBLANK(A190),A189+1,A190+1),\" \")","v":145},"13.13","Entities must test critical information system’s restoration annually.","Organization should have an after action write up of their Disaster Recovery Tests.  Review an after action report","NO",{"$f":"VLOOKUP(E191,Lookups!$A$2:$B$4,2,FALSE)","v":0}]
[{"$f":"IF(ISBLANK(G192),IF(ISBLANK(A191),A190+1,A191+1),\" \")","v":146},"13.14","Entities must update Information Systems when the support for the components of the Information System are no longer available from the developer, vendor, or the manufacturer.","Check to see if organization does not have any unsupported components such as outdated operating systems or applications.","NO",{"$f":"VLOOKUP(E192,Lookups!$A$2:$B$4,2,FALSE)","v":0}]
[null,"14.0","SYSTEM AUDIT STANDARD",null,"Section 14 Overall",{"$f":"IFERROR(AVERAGE(F194:F206),\"\")","v":0},null,"Evidence/Explanation"]
[{"$f":"IF(ISBLANK(H194),IF(ISBLANK(A193),A192+1,A193+1),\" \")","v":147},"14.1","Critical Systems and Information Systems that process, store or transmit Restricted-Use Information must be configured such that all user access interactions and system administrators’ actions are logged to both the internal system and to an external log repository (not on the local system).  ","Organization should be collecting and storing logs for review if necessary. Check to see if logs are being collected and shipped to some form of log repository.  Logs from Active Directory, Firewall, Databases, Applications, and webservers are key locations.","NO",{"$f":"VLOOKUP(E194,Lookups!$A$2:$B$4,2,FALSE)","v":0}]
[{"$f":"IF(ISBLANK(G195),IF(ISBLANK(A194),A193+1,A194+1),\" \")","v":148},"14.2","The following data points must be logged:","Organization should make audit logs available for review.  Active Directory is a good source for security audit logs.  Agency should be able to retrieve them easily.","NO",{"$f":"VLOOKUP(E195,Lookups!$A$2:$B$4,2,FALSE)","v":0}]
[149,"14.2.1"," Event date "]
[150,"14.2.2","Event time  "]
[151,"14.2.3"," Event source "]
[152,"14.2.4"," Event description"]
[153,"14.2.5","Identity of any individual(s) or subject(s) associated with the event(s)."]
[154,"14.3","Logs for Critical Systems and Information Systems that process, store or transmit Restricted-Use Information must be stored and maintained for at least 120 days (180 days recommended) on an external log repository or in accordance with other regulatory requirements.","Organization should show a log source that goes back 120 days or show significant storage capacity to support 120 days worth of logs.","NO",{"$f":"VLOOKUP(E201,Lookups!$A$2:$B$4,2,FALSE)","v":0}]
[155,"14.4","Critical Systems and Information Systems that process, store or transmit Restricted-Use Information must be configured to raise alerts to the system administrative personnel if logging space becomes limited, upon system logging failure, or when suspicious activity is detected within the system logging component.","Organization systems should be configured to generate alerts check configuration portals or administration consoles to see if systems are enabled to alert on logging failures.","NO",{"$f":"VLOOKUP(E202,Lookups!$A$2:$B$4,2,FALSE)","v":0}]
[156,"14.4.1","Entities must actively review and address alerts raised from the logging component","Check to see if alerts for logging failures go to monitored emails or monitored consoles.","NO",{"$f":"VLOOKUP(E203,Lookups!$A$2:$B$4,2,FALSE)","v":0}]
[157,"14.5","Information Systems that store logging data must be configured to continue logging by overwriting the oldest logs in the event available space is limited.","This setting is in Active Directory for the domain and is typically available in most systems.  Check to see if it is enabled in AD.","NO",{"$f":"VLOOKUP(E204,Lookups!$A$2:$B$4,2,FALSE)","v":0}]
[158,"14.6","Information System logging data must be manually reviewed according to a pre-defined period of time or the logging system configured to automatically raise alerts to the system administrative personnel.","Organization should demonstrate that somebody reviews logs for anomalies, or that a Security Incident Event Management system is monitoring logs for various conditions and anomalous traffic","NO",{"$f":"VLOOKUP(E205,Lookups!$A$2:$B$4,2,FALSE)","v":0}]
[159,"14.7","All Production Information Systems must be configured to have time synchronized with authoritative time sources.","Organization should show their Network Time Protocol (NTP) settings.  This is within Active Directory.","NO",{"$f":"VLOOKUP(E206,Lookups!$A$2:$B$4,2,FALSE)","v":0}]
[null,"15.0","INCIDENT RESPONSE STANDARD",null,"Section 15 Overall",{"$f":"IFERROR(AVERAGE(F208:F224),\"\")","v":0},null,"Evidence/Explanation"]
[{"$f":"IF(ISBLANK(G208),IF(ISBLANK(A207),A206+1,A207+1),\" \")","v":160},"15.1","Entities must adopt a documented incident response plan which addresses the following stages: preparing for a security incident, detecting and analyzing a security incident; containing a security incident; eradicating and recovering from a security incident; and post incident activities.","Organization should have an incident response plan or a policy available for review.","NO",{"$f":"VLOOKUP(E208,Lookups!$A$2:$B$4,2,FALSE)","v":0}]
[161,"15.2","Entities must define and document what constitutes a security incident. Security incidents must include intentional and unintentional incidents.","This would likely be part of their incident response plan, policy, or procedures.","NO",{"$f":"VLOOKUP(E209,Lookups!$A$2:$B$4,2,FALSE)","v":0}]
[162,"15.3","Entities must define and document a process to track and categorize the severity of all incidents which must drive the associated response, reporting, and communication activities.","This would likely be part of their incident response plan, policy, or procedures.","NO",{"$f":"VLOOKUP(E210,Lookups!$A$2:$B$4,2,FALSE)","v":0}]
[163,"15.4","Entities must appoint team members or outside staff/contractors to incident response roles with the following skills:","The members should be identified in the incident response plan, policy, or procedures.  An individual may have multiple roles and that is okay. ","NO",{"$f":"VLOOKUP(E211,Lookups!$A$2:$B$4,2,FALSE)","v":0}]
[164,"15.4.1","Communication and coordination"]
[165,"15.4.2","Network analysis"]
[166,"15.4.3","System administration"]
[167,"15.4.4","Security analysis"]
[168,"15.4.5","Legal counsel"]
[169,"15.4.6","Privacy"]
[170,"15.5","Entities must ensure that Incident Response (IR) training for all IR team members has been completed within ninety (90) days of initial assignment of the individual to the IR team. In the event the entity contracts for IR services, the entity must receive assurance that the contractor has the necessary skills and training to carry out incident response services.","Organization should have a training record for people on their IR team that includes IR training dates.","NO",{"$f":"VLOOKUP(E218,Lookups!$A$2:$B$4,2,FALSE)","v":0}]
[171,"15.6","Entities must ensure annual IR training for all IR team members as identified above.","Organization should have training records on their IR team members","NO",{"$f":"VLOOKUP(E219,Lookups!$A$2:$B$4,2,FALSE)","v":0}]
[172,"15.7","Entities must annually conduct IR operations testing using classroom, tabletop exercises, or live incidents.","Organization should have an incident report or an incident response exercise report available for review.","NO",{"$f":"VLOOKUP(E220,Lookups!$A$2:$B$4,2,FALSE)","v":0}]
[173,"15.8","Entities must conduct an exercise recreating a significant incident scenario that requires an operations-based functional exercise (or a major live incident) to validate the IR plan, procedures, and agreements, to clarify roles and responsibilities, and to identify resource gaps once every five (5) years.","Organization should have a post exercise report or an incident report that includes a section that identified lessons learned or gaps that can improve their incident response activities.","NO",{"$f":"VLOOKUP(E221,Lookups!$A$2:$B$4,2,FALSE)","v":0}]
[174,"15.9","Entities must have dedicated tools and documented processes to conduct incident response activities. If the entity does not have the tools, resources, or expertise, then the entity must identify a service provider to assist with incident response activities.","Organization should have tools to analyze system and security logs , take system images, etc.  If they do not have tools, they should indicate who to contact that does have the capability.  This could be in their incident response policy or procedures document.","NO",{"$f":"VLOOKUP(E222,Lookups!$A$2:$B$4,2,FALSE)","v":0}]
[175,"15.10","Entities must have a documented incident communications strategy to provide adequate and timely communication to all appropriate stakeholders.","Organization should provide incident communication plan or strategy document","NO",{"$f":"VLOOKUP(E223,Lookups!$A$2:$B$4,2,FALSE)","v":0}]
[176,"15.11","For significant security incidents, entities must perform a post-incident review within a reasonable timeframe upon containment, to document lessons learned and to improve Information System protection and incident response capabilities in the future. Post-incident review documentation must be communicated to entity leadership.","Organization should have a lessons learned section in their incident reports.  ","NO",{"$f":"VLOOKUP(E224,Lookups!$A$2:$B$4,2,FALSE)","v":0}]
[null,"16.0","PHYSICAL SECUIRTY STANDARD",null,"Section 16 Overall",{"$f":"F226","v":0}]
[null,null,"Data centers",null,null,{"$f":"IFERROR(AVERAGE(F227:F235),\"\")","v":0},null,"Evidence/Explanation"]
[{"$f":"IF(ISBLANK(G226),IF(ISBLANK(A225),A224+1,A225+1),A224+1)","v":177},"16.1","Entities must restrict physical access to data centers that process, store or transmit Restricted-Use Information to authorized personnel only.","Data center doors should be locked at all times.","NO",{"$f":"VLOOKUP(E227,Lookups!$A$2:$B$4,2,FALSE)","v":0}]
[{"$f":"IF(ISBLANK(G228),IF(ISBLANK(A227),A226+1,A227+1),\" \")","v":178},"16.2","Entities must maintain a list of all authorized personnel with physical access to data centers that process, store or transmit Restricted-Use Information.","Organization should have and Access Control List(ACL) (Word Doc, Excel Doc, or system)","NO",{"$f":"VLOOKUP(E228,Lookups!$A$2:$B$4,2,FALSE)","v":0}]
[179,"16.2.1","This list must be reviewed and updated annually.","ACL should have an updated date on it","NO",{"$f":"VLOOKUP(E229,Lookups!$A$2:$B$4,2,FALSE)","v":0}]
[180,"16.2.2","This list must be updated as user access privileges change.","Examine ACL to make sure individuals that are no longer employees are not on the list","NO",{"$f":"VLOOKUP(E230,Lookups!$A$2:$B$4,2,FALSE)","v":0}]
[181,"16.3","Entities must require authorized personnel to authenticate themselves prior to entry to data centers that process, store or transmit Restricted-Use Information.","Data center must be locks should use a key card system or key checkout system to access the data center","NO",{"$f":"VLOOKUP(E231,Lookups!$A$2:$B$4,2,FALSE)","v":0}]
[182,"16.3.1","Visitors to data centers that process, store or transmit Restricted-Use Information must be escorted by authorized personnel at all times.","Examine if organization has visitor escort procedures documented.","NO",{"$f":"VLOOKUP(E232,Lookups!$A$2:$B$4,2,FALSE)","v":0}]
[183,"16.3.2","Entities must log all visitor access to data centers that process, store or transmit Restricted-Use Information.","Organization should have a visitor sign in sheet or log. ","NO",{"$f":"VLOOKUP(E233,Lookups!$A$2:$B$4,2,FALSE)","v":0}]
[184,"16.4","Data centers must implement physical environmental controls that mitigate or prevent damage from water, fire, temperature and humidity for information systems that process, store or transmit Restricted-Use Information.","Organizations should have datacenter HVAC, water sensors, and fire suppression systems in place.","NO",{"$f":"VLOOKUP(E234,Lookups!$A$2:$B$4,2,FALSE)","v":0}]
[185,"16.5","Entities must ensure sufficient power protection is available for critical information systems to perform an orderly shutdown.","Organizations have UPS systems installed and protecting their servers","NO",{"$f":"VLOOKUP(E235,Lookups!$A$2:$B$4,2,FALSE)","v":0}]
[null,"17.0","PERSONNEL SECURITY STANDARDS",null,"Section 17 Overall ",{"$f":"IFERROR(AVERAGE(F237,F242),\"\")","v":0}]
[null,null,"Acceptable Use",null,null,{"$f":"IFERROR(AVERAGE(F238:F241),\"\")","v":0},null,"Evidence/Explanation"]
[{"$f":"IF(ISBLANK(G237),IF(ISBLANK(A236),A235+1,A236+1),A237+1)","v":186},"17.1","Acceptable use policies must restrict the use of all equipment and access to public and private networks to approved entity related operations.","Organization should provide an acceptable use policy","NO",{"$f":"VLOOKUP(E238,Lookups!$A$2:$B$4,2,FALSE)","v":0}]
[{"$f":"IF(ISBLANK(G239),IF(ISBLANK(A238),A237+1,A238+1),\" \")","v":187},"17.2","Entities must require employees and contractors to acknowledge adherence to the entity acceptable use policy prior to being granted access to information systems.","Acceptable use policy should have a signature page or require a digital acknowledgement","NO",{"$f":"VLOOKUP(E239,Lookups!$A$2:$B$4,2,FALSE)","v":0}]
[{"$f":"IF(ISBLANK(G240),IF(ISBLANK(A239),A238+1,A239+1),\" \")","v":188},"17.3","Entities must include policy violation consequences in their acceptable use policies.","Acceptable use policy should include language indicating actions that may be taken if policy is violated","NO",{"$f":"VLOOKUP(E240,Lookups!$A$2:$B$4,2,FALSE)","v":0}]
[{"$f":"IF(ISBLANK(G241),IF(ISBLANK(A240),A239+1,A240+1),\" \")","v":189},"17.4","Entity acceptable use policies must assert that violations will be investigated as a security event.","Acceptable use policy should include language","NO",{"$f":"VLOOKUP(E241,Lookups!$A$2:$B$4,2,FALSE)","v":0}]
[null,null,"Personnel Operations",null,null,{"$f":"IFERROR(AVERAGE(F243:F247),\"\")","v":0},null,"Evidence/Explanation"]
[{"$f":"IF(ISBLANK(G243),IF(ISBLANK(A242),A241+1,A242+1),\" \")","v":190},"17.5","Entities must retain a form of acknowledgement of the acceptable use policy.","Acceptable use policy should have a signature page or require a digital acknowledgement.  Record of acknowledgement should be with HR in the personnel file or within a digital system of record.","NO",{"$f":"VLOOKUP(E243,Lookups!$A$2:$B$4,2,FALSE)","v":0}]
[{"$f":"IF(ISBLANK(G244),IF(ISBLANK(A243),A242+1,A243+1),\" \")","v":191},"17.6","Entities must assign all users to a user categorization based upon their role and least privilege.","Determine if organization has position description that describes user roles and function","NO",{"$f":"VLOOKUP(E244,Lookups!$A$2:$B$4,2,FALSE)","v":0}]
[{"$f":"IF(ISBLANK(G245),IF(ISBLANK(A244),A243+1,A244+1),\" \")","v":192},"17.7","Entities must assign information system authorizations to users based on user categorization and information system classification.","Organization should have process to validate user is cleared to work in certain information systems ","NO",{"$f":"VLOOKUP(E245,Lookups!$A$2:$B$4,2,FALSE)","v":0}]
[{"$f":"IF(ISBLANK(G246),IF(ISBLANK(A245),A244+1,A245+1),\" \")","v":193},"17.8","Entities must revoke system access or eliminate unnecessary permissions for user accounts as users are transferred, terminated, or their role has changed.","Organization should have a documented checkout process or procedure that includes suspension of accounts when users are no longer in a position.","NO",{"$f":"VLOOKUP(E246,Lookups!$A$2:$B$4,2,FALSE)","v":0}]
[{"$f":"IF(ISBLANK(G247),IF(ISBLANK(A246),A245+1,A246+1),\" \")","v":194},"17.9","Entities must recover all property that has been assigned to terminated personnel.","Organization should have a documented checkout process or procedure that includes property recovery of all assigned state property.","NO",{"$f":"VLOOKUP(E247,Lookups!$A$2:$B$4,2,FALSE)","v":0}]
[null,"18.0","SECURE PURCHASING/ACQUISITION STANDARD",null,"Section 18 Overall",{"$f":"IFERROR(AVERAGE(F249:F250),\"\")","v":0},null,"Evidence/Explanation"]
[{"$f":"IF(ISBLANK(G249),IF(ISBLANK(A248),A247+1,A248+1),\" \")","v":195},"18.1","Entities must include system security requirements with all Requests for Proposal, Information, Quotation (RFP, RFI, RFQ) and all contracts.","Organization should have recent RFP or contract available that has a section that addresses cybersecurity requirements","NO",{"$f":"VLOOKUP(E249,Lookups!$A$2:$B$4,2,FALSE)","v":0}]
[{"$f":"IF(ISBLANK(G250),IF(ISBLANK(A249),A248+1,A249+1),\" \")","v":196},"18.2","All acquisition documents must specify the entity's security requirements and allow for the validation of those security requirements.","Organization should have recent RFP or contract available that has a section that has a right to audit clause.","NO",{"$f":"VLOOKUP(E250,Lookups!$A$2:$B$4,2,FALSE)","v":0}]
[null,null,null,null,"Overall Compliance ",{"$f":"IFERROR(AVERAGE(F248,F236,F225,F207,F193,F170,F167,F156,F133,F74,F55,F47,F26,F5),\"\")","v":0}]

{"sheet":"How to Score","index":3,"n_rows":9,"n_cols":3,"rows_kept":9,"cut":false,"hidden":true,"merged":[[6,2,7,2],[6,1,7,1],[6,0,7,0]]}
[null,"Definitions","NIST"]
[0,"There are no security controls or plans in place. The controls are nonexistent.","Non-existent"]
[1,"Base practices of the control area are generally performed on an ad hoc basis. There is general agreement within the organization that identified actions should be performed, and they are performed when required.  The practices are not formally adopted, tracked, and reported on.  Alternatively, policy has been adopted but is not implemented or is not followd widely through out the entity.","Adhoc control or Documented Policy only"]
[2,"The base requirements for the control area are planned, implemented, and repeatable. A documented policy and documented process or procedure exsits. Implementation of the process and control may to be to varying degrees throughout the entity.","Documented Procedures"]
[3,"The primary distinction from Level 2,documented procedures, is that in addition to being repeatable the processes used are more mature: documented, approved, and implemented organization-wide. Demonstrable entity wide acceptance is required to meet this level and above.","Implementeded Procedures & Controls"]
[4,"The primary distinction from Level 3, Measured Program, is that the process is measured and verified (e.g., auditable).","Measured Program"]
[5,"The primary distinction from Level 4, Prevasive Program, is that the defined, standard processes are regularly reviewed and updated. Improvements reflect an understanding of, and response to, a vulnerability's impact and metrics gathered from autid trails.","Pervasive Program"]
[]
["ISO 21827 https://www.sabs.co.za/content/uploads/files/SANS21827%28colour%29.pdf"]

{"sheet":"Tool Mapping","index":4,"n_rows":191,"n_cols":5,"rows_kept":191,"cut":false,"hidden":true,"merged":[[162,0,163,0],[162,1,163,1],[0,0,0,4],[83,0,85,0],[83,1,85,1],[94,0,95,0],[94,1,95,1]]}
["Assessment Tool Questions* Mapped to ISO and NIST**"]
["Assessment Questions",null,"ISO","NIST Controls","NIST Family"]
[1]
[2]
[3,4.0999999999999996]
[4,4.2]
[null,null,"A.5 Security Policy",null,"AC: Access Control"]
[5,"5.1.1","A.5.1 Information security policy",null,"AT: Awareness and Training "]
[6,"5.1.1","A.5.1.1 Information security policy document ","XX-1 controls","AU: Audit and Accountability"]
[7,"5.1.2","A.5.1.2 Review of the information security policy","XX-1 controls","CA: Security Assessment and Authorization"]
[null,null,"A.6 Organization of information security",null,"CM: Configuration Management"]
[null,null,"A.6.1 Internal",null,"CP: Contingency Planning"]
[8,"6.1.1","A.6.1.1 Management commitment to information security","XX-1 controls, PM-2, PM-3, PM-9; SP 800-39,SP 800-37","IA: Identificaton and Authentication"]
[9,"6.1.2","A.6.1.2 Information security coordination ","CP-2, CP-4, IR-4, PL-1, PL-2, PM-2, SA-2;SP 800-39, SP 800-37","IR: Incident Response"]
[10,"6.1.3","A.6.1.3 Allocation of information security responsibilities ","XX-1 controls, AC-5, AC-6, CM-9, PM-2; SP 800-39, SP 800-37","MP: Media Protection"]
[11,"6.1.4","A.6.1.4 Authorization process for information processing facilities ","CA-1, CA-6, PM-10; SP 800-37","PE: Physical and Environmental Protection"]
[12,"6.1.5","A.6.1.5 Confidentiality agreements ","PL-4, PS-6, SA-9","PL: Planning"]
[13,"6.1.6","A.6.1.6 Contact with authorities ","Multiple controls with contact reference (e.g.,IR-6, SI-5), SP 800-39; SP 800-37","PS: Personnel Security"]
[14,"6.1.7","A.6.1.7 Contact with special interest groups ","AT-5, SI-5","RA: Risk Assessment"]
[15,"6.1.8","A.6.1.8 Independent review of information security","CA-2, CA-7; SP 800-39, SP 800-37","SA: System and Services Acquisition"]
[null,null,"A.6.2 External Parties",null,"SC: System and Communications Protection"]
[16,"6.2.1","A.6.2.1 Identification of risks related to external parties"," CA-3, PM-9, RA-3, SA-1, SA-9, SC-7","SI: System and Information Integrity"]
[17,"6.2.2","A.6.2.2 Addressing security when dealing with customers"," AC-8 , AT-2, PL-4","PM: Program Management"]
[null,null,"A.6.2.3 Addressing security in third party agreements ","AU-16, CA-2, CA-3, PS-7, SA-9"]
[null,null,"A.7 Asset Management"]
[null,null,"A.7.1 Responsibility for assets"]
[18,"7.1.1","A.7.1.1 Inventory of assets ","CM-8, CM-9, PM-5"]
[19,"7.2.1","A.7.1.2 Ownership of assets ","CM-8, CM-9, PM-5"]
[null,null,"A.7.1.3 Acceptable use of assets ","AC-20, PL-4"]
[null,null,"A.7.2 Information Classification"]
[null,null,"A.7.2.1 Classification Guidelines"," RA-2"]
[null,null,"A.7.2.2 Information labeling and handling ","AC-16, MP-2, MP-3, SC-16"]
[null,null,"A.8 Human Resources Security"]
[null,null,"A.8.1 Prior to Employment"]
[null,null,"A.8.1.1 Roles and Responsibilities ","XX-1 controls, AC-5, AC-6, AC-8, AC-20, AT-2, AT-3, CM-9, PL-4, PS-2, PS-6, PS-7, SA-9"]
[null,null,"A.8.1.2 Screening ","PS-3"]
[null,null,"A.8.1.3 Terms and conditions of employment ","AC-20, PL-4, PS-6, PS-7"]
[null,null,"A.8.2 During employment"]
[20,"8.2.1","A.8.2.1 Management responsibilities ","PL-4, PM-13, PM-15, PS-6, PS-7, SA-9"]
[21,"8.2.2","A.8.2.2 Awareness, education, and training ","AT-2, AT-3, IR-2"]
[22,"8.2.3","A.8.2.3 Disciplinary process ","PS-8"]
[23,"8.3.1","A.8.3 Termination or change of employment"]
[24,"8.3.2\n8.3.3","A.8.3.1 Termination responsibilities ","PS-4, PS-5"]
[null,null,"A.8.3.2 Return of assets ","PS-4, PS-5"]
[null,null,"A.8.3.3 Removal of access rights ","AC-2, PS-4, PS-5"]
[null,null,"A.9 Physical and environmental security"]
[null,null,"A.9.1 Secure areas"]
[null,null,"A.9.1.1 Physical security perimeter ","PE-3"]
[25,"9.1.2","A.9.1.2 Physical entry controls ","PE-3, PE-5, PE-6"]
[null,null,"A.9.1.3 Securing offices, rooms, facilities ","PE-3, PE-4, PE-5"]
[26,"9.1.4","A.9.1.4 Protecting against external and environmental threats ","CP Family; PE-1, PE-9, PE-10, PE-11, PE-13,PE-15"]
[27,"9.1.5","A.9.1.5 Working in secure areas ","AT-2, AT-3 , PL-4, PS-6, PE-2, PE-3, PE-4, PE-6, PE-8"]
[null,null,"A.9.1.6 Public access, delivery and loading areas ","PE-3 , PE-16"]
[null,null,"A.9.2 Equipment security"]
[null,null,"A.9.2.1 Equipment siting and protection ","PE-1, PE-18"]
[null,null,"A.9.2.2 Supporting utilities ","PE-1, PE-9, PE-11, PE-12, PE-14"]
[null,null,"A.9.2.3 Cabling security ","PE-4, PE-9"]
[28,"9.2.4","A.9.2.4 Equipment maintenance ","MA Family"]
[null,null,"A.9.2.5 Security of equipment off-premises ","MP-5, PE-17"]
[29,"9.2.6","A.9.2.6 Secure disposal or reuse of equipment ","MP-6"]
[30,"9.2.7","A.9.2.7 Removal of property MP-5, PE-16","MP-5 , PE-16"]
[null,null,"A.10 Communications and operations management"]
[null,null,"A.10.1 Operational procedures and responsibilities"]
[31,"10.1.1","A.10.1.1 Documented operating procedures ","XX-1 controls, CM-9"]
[32,"10.1.2","A.10.1.2 Change management ","CM-1, CM-3, CM-4, CM-5, CM-9"]
[33,"10.1.3","A.10.1.3 Segregation of duties ","AC-5"]
[34,"10.1.4","A.10.1.4 Separation of development, test and operational facilities ","CM-2"]
[null,null,"A.10.2 Third-party service delivery management"]
[35,"10.2.1","A.10.2.1 Service delivery","SA-9"]
[36,"10.2.2","A.10.2.2 Monitoring and review of third-party services","SA-9"]
[null,null,"A.10.2.3 Managing changes to third-party services ","RA-3, SA-9, SA-10"]
[null,null,"A.10.3 System planning and acceptance"]
[40,"10.3.1","A.10.3.1 Capacity management"," AU-4, AU-5, CP-2, SA-2, SC-5"]
[null,null,"A.10.3.2 System acceptance ","CA-2, CA-6, CM-3, CM-4, CM-9, SA-11, SA-15, SA-17"]
[null,null,"A.10.4 Protection against malicious and mobile code"]
[41,"10.4.1","A.10.4.1 Controls against malicious code ","AC-19, AT-2, PE-20, SA-8, SC-2, SC-3, SC-7,SC-14, SC-38, SI-3, SI-7"]
[null,null,"A.10.4.2 Controls against mobile code ","SA-8, SC-2, SC-3, SC-7, SC-14, SC-8, SC-18"]
[null,null,"A.10.5 Backup"]
[43,"10.5.1","A.10.5.1 Information backup","CP-9"]
[null,null,"A.10.6 Network security management"]
[45,"10.6.1","A.10.6.1 Network controls ","AC-4, AC-17, AC-18, AC-20, CA-3, CP-8, PE-5,SC-7, SC-8, SC-9, SC-10, SC-19, SC-20, SC-21, SC-22, SC-23"]
[null,null,"A.10.6.2 Security of network services","CA-3, SA-9, SC-8, SC-9"]
[null,null,"A.10.7 Media handling"]
[50,"10.7.1\n10.7.3","A.10.7.1 Management of removable media","PE-16,  MP Family"]
[null,null,"A.10.7.2 Disposal of media","MP-6"]
[null,null,"A.10.7.3 Information handling procedures","SI-12,  MP Family"]
[null,null,"A.10.7.4 Security of system documentation ","MP-4, SA-5"]
[null,null,"A.10.8 Exchange of information"]
[51,"10.8.1","A.10.8.1 Information exchange policies and procedures","AC-1, AC-3, AC-4, AC-17, AC-18, AC-20, CA-3, PL-4, PS-6, SC-7, SC-16, SI-9"]
[null,null,"A.10.8.2 Exchange agreements","CA-3, SA-9"]
[null,null,"A.10.8.3 Physical media in transit","MP-5"]
[null,null,"A.10.8.4 Electronic messaging ","Multiple controls; electronic messaging not addressed separately in SP 800-53"]
[null,null,"A.10.8.5 Business information systems","CA-1, CA-3"]
[null,null,"A.10.9 Electronic commerce services"]
[52,"10.9.1\n10.9.2 ","A.10.9.1 Electronic commerce ","AU-10, IA-8, SC-7, SC-8, SC-9, SC-3, SC-14"]
[null,null,"A.10.9.2 Online transactions","SC-3, SC-7, SC-8, SC-9, SC-14"]
[null,null,"A.10.9.3 Publicly available information","SC-14"]
[null,null,"A.10.10 Monitoring"]
[53,"10.10.1","A.10.10.1 Audit logging ","AU-1, AU-2, AU-3, AU-4, AU-5, AU-8, AU-11, AU-12"]
[54,"10.10.2","A.10.10.2 Monitoring system use ","AU-1, AU-6, AU-7, PE-6, PE-8, SC-7, SI-4"]
[null,null,"A.10.10.3 Protection of log information","AU-9"]
[57,"10.10.4","A.10.10.4 Administrator and operator logs","AU-2, AU-12"]
[59,"10.10.5","A.10.10.5 Fault logging","AU-2, AU-12, SI-2"]
[60,"10.10.6","A.10.10.6 Clock synchronization","AU-8"]
[null,null,"A.11 Access Control"]
[null,null,"A.11.1 Business requirement for access control"]
[61,"11.1.1","A.11.1.1 Access control policy ","AC-1, AC-5, AC-6, AC-17, AC-18, AC-19, CM-5, MP-1, SI-9"]
[null,null,"A.11.2 User access management"]
[62,"11.2.1","A.11.2.1 User registration ","AC-1, AC-2, AC-21, IA-5, PE-1, PE-2"]
[null,"11.2.2","A.11.2.2 Privilege management","AC-1, AC-2, AC-6, AC-21, PE-1, PE-2, SI-9"]
[63,"11.2.3","A.11.2.3 User password management","IA-5"]
[64,"11.2.4","A.11.2.4 Review of user access rights","AC-2, PE-2"]
[null,null,"A 11.3 User responsibilities"]
[null,null,"A.11.3.1 Password use","IA-2, IA-5"]
[null,null,"A.11.3.2 Unattended user equipment ","AC-11, IA-2, PE-3, PE-5, PE-18, SC-10"]
[null,null,"A.11.3.3 Clear desk and clear screen policy","AC-11, MP-4"]
[null,null,"A.11.4 Network access control"]
[null,null,"A.11.4.1 Policy on use of network services ","AC-1, AC-5, AC-6, AC-17, AC-18, AC-20"]
[65,"11.4.2","A.11.4.2 User authentication for external connections ","AC-17, AC-18, AC-20, CA-3, IA-2, IA-8"]
[null,null,"A.11.4.3 Equipment identification in networks","AC-19, IA-3"]
[66,"11.4.4","A.11.4.4 Remote diagnostic and configuration port protection ","AC-3, AC-6, AC-17, AC-18, PE-3, MA-3, MA-4"]
[null,null,"A.11.4.5 Segregation in networks "]
[67,"11.4.6","A.11.4.6 Network connection control ","AC-3, AC-6, AC-17, AC-18, SC-7"]
[68,"11.4.7","A.11.4.7 Network routing control","AC-4, AC-17, AC-18"]
[null,null,"A 11.5 Operating system access control"]
[69,"11.5.1","A.11.5.1 Secure log-on procedures ","AC-7, AC-8, AC-9, AC-10, IA-2, IA-6, IA-8, SC-10"]
[70,"11.5.2","A.11.5.2 User identification and authentication ","IA-2, IA-4, IA-5, IA-8"]
[72,"11.5.3","A.11.5.3 Password management system","IA-2, IA-5"]
[73,"11.5.4","A.11.5.4 Use of system utilities ","AC-3, AC-6"]
[null,null,"A.11.5.5 Session time-out ","AC-11, SC-10"]
[null,null,"A.11.5.6 Limitation of connection time","AC-2"]
[null,null,"A.11.6 Application and information access control"]
[null,null,"A.11.6.1 Information access restriction","AC-3, AC-6, AC-14, CM-5"]
[74,"11.6.2","A.11.6.2 Sensitive system isolation ","SC-7; SP 800-39"]
[null,null,"A.11.7 Mobile computing and teleworking"]
[75,"11.7.1","A.11.7.1 Mobile computing and communications ","AC-1, AC-17, AC-18, AC-19, PL-4, PS-6"]
[77,"11.7.2","A.11.7.2 Teleworking ","AC-1, AC-4, AC-17, AC-18, PE-17, PL-4, PS-6"]
[null,null,"A.12 Information systems acquisition, development and maintenance"]
[78,12.1,"A.12.1 Security requirements of information systems"]
[79,"12.1.1","A.12.1.1 Security requirements analysis and specification ","PL-7, PL-8, SA-1, SA-3, SA-4"]
[null,null,"A.12.2 Correct processing in applications"]
[80,"12.2.1","A.12.2.1 Input data validation ","SI-10"]
[81,"12.2.2","A.12.2.2 Control of internal processing ","SI-7, SI-9, SI-10"]
[82,"12.2.3","A.12.2.3 Message integrity ","AU-10, SC-8, SC-23, SI-7"]
[83,"12.2.4","A.12.2.4 Output data validation","SI-7"]
[null,null,"A.12.3 Cryptographic controls"]
[84,"12.3.1","A.12.3.1 Policy on the use of cryptographic controls"," Multiple controls address cryptography (e.g., IA-7, SC-8, SC-9, SC-12, SC-13)"]
[85,"12.3.2","A.12.3.2 Key management"," SC-12, SC-17"]
[null,null,"A.12.4 Security of system files"]
[86,"12.4.1","A.12.4.1 Control of operational software ","CM-1, CM-2, CM-3, CM-4, CM-5, CM-9, CM-10, CM-11, PL-4"]
[87,"12.4.2","A.12.4.2 Protection of system test data Multiple controls; protection of test data not addressed separately in SP 800-53 (e.g., AC-3, AC-4)"]
[88,"12.4.3","A.12.4.3 Access control to program source code ","AC-3, AC-6, CM-5, CM-9, MA-5, SA-10"]
[89,"12.5.1","A.12.5 Security in development and support processes"]
[90,"12.5.2","A.12.5.1 Change control procedures","CM-1, CM-3, CM-9, SA-10"]
[null,null,"A.12.5.2 Technical review of applications after operating system changes","CM-3, CM-4, CM-9, SI-2"]
[null,null,"A.12.5.3 Restrictions on changes to software packages ","CM-3, CM-4, CM-5, CM-9"]
[91,"12.5.4","A.12.5.4 Information leakage","AC-4, IR-9, PE-19"]
[92,"12.5.5","A.12.5.5 Outsourced software development ","CM-10, CM-11, SA-1, SA-4, SA-8, SA-9, SA-11, SA-12, SA-15, SA-17"]
[null,null,"A.12.6 Technical Vulnerability Management"]
[93,"12.6.1","A.12.6.1 Control of technical vulnerabilities ","RA-3, RA-5, SI-2, SI-5"]
[null,null,"A.13 Information security incident management"]
[null,null,"A.13.1 Reporting information security events and weaknesses"]
[94,"13.1.1\n13.1.2","A.13.1.1 Reporting information security events ","AU-6, IR-1, IR-6, SI-4, SI-5"]
[null,null,"A.13.1.2 Reporting security weaknesses ","PL-4, SI-2, SI-4, SI-5"]
[null,null,"A.13.2 Management of information security incidents and improvements"]
[null,null,"A.13.2.1 Responsibilities and procedures"," IR-1"]
[null,null,"A.13.2.2 Learning from information security incidents ","IR-4"]
[95,"13.2.3","A.13.2.3 Collection of evidence ","AU-7, AU-9, IR-4"]
[null,null,"A.14 Business continuity management"]
[null,null,"A.14.1 Information security aspects of business continuity management"]
[96,"14.1.1","A.14.1.1 Including information security in the business continuity management process","CP-1, CP-2, CP-4"]
[null,null,"A.14.1.2 Business continuity and risk assessment ","CP-2, PM-9, RA Family"]
[null,null,"A.14.1.3 Developing and implementing continuity plans including information security","CP Family"]
[null,null,"A.14.1.4 Business continuity planning framework ","CP-2, CP-4"]
[null,null,"A.14.1.5 Testing, maintaining and reassessing business continuity plans","CP-2, CP-4"]
[null,null,"A.15 Compliance"]
[null,null,"A.15.1 Compliance with legal requirements"]
[null,null,"A.15.1.1 Identification of applicable legislation ","XX-1 controls, IA-7"]
[null,null,"A.15.1.2 Intellectual property rights (IPR) ","CM-10"]
[97,"15.1.3","A.15.1.3 Protection of organizational records ","AU-9, AU-11, CP-9, MP-1, MP-4, SA-5, SI-12"]
[98,"15.1.4","A.15.1.4 Data protection and privacy of personal information ","Appendix J; SI-12"]
[99,"15.1.5","A.15.1.5 Prevention of misuse of information processing facilities ","AC-8, AU-6, CM-11, PL-4, PS-6, PS-8"]
[100,"15.1.6","A.15.1.6 Regulation of cryptographic controls ","IA-7, SC-13"]
[null,null,"A.15.2 Compliance with security policies and standards, and technical compliance"]
[101,"15.2.1","A.15.2.1 Compliance with security policies and standards ","XX-1 controls, AC-2, CA-2, CA-7, IA-7, PE-8, SI-12"]
[102,"15.2.2","A.15.2.2 Technical compliance checking ","CA-2, CA-7, RA-5"]
[null,null,"A.15.3 Information systems audit considerations"]
[103,"15.3.1","A.15.3.1 Information systems audit controls ","AU-1, AU-2"]
[104,"15.3.2","A.15.3.2 Protection of information systems audit tools ","AU-9"]
["* Direct mappings are listed above. In some cases questions were formed that covered more than one ISO area making one-to-one mapping difficult."]
["**NIST to ISO mapping from http://csrc.nist.gov/publications/drafts/800-53-rev4/sp800-53-rev4-ipd.pdf"]

{"sheet":"Lookups","index":5,"n_rows":4,"n_cols":7,"rows_kept":4,"cut":false,"hidden":false,"merged":[]}
["Description","Value",null,null,null,"Description","Value"]
["NO",0,null,null,null,"YES",1]
["YES",1,null,null,null,"NO",0]
["Not Applicable","Blank"]