
Goal: Select and implement necessary cybersecurity controls
Information Security Management & Governance
- Information Security Policy
- Acceptable Use Policy (AUP)
- Access Control (AC) Policy
- Password Policy
- Remote Working Policy
- Bring Your Own Device (BYOD) Policy
- Data Classification & Handling Policy
- AI Usage Policy
- Web Publishing Policy
- Privacy Policy
- Backup Policy & Strategy
- Incident Response (IR) Policy & Plan
- Incident Response Team
- Incident Response Procedures & Playbooks
- Business Continuity Management (BCM) Capabilities
- Disaster Recovery Plan (DRP)
- Business Continuity Plan (BCP)
- Communication Channels
- Maintenance Windows & Blackout Periods
Physical Security
- Documentation of Physical Access Permissions
- Entrance Protection
- Visitor Logs
- Device Locks
- Privacy Filters
- Asset Tags
- Cabling Security
- Server Room & Network Closet Protections
- Security Cameras
- Redundant Power Sources
- Surge Protection
- Temperature Control
- Fire Detection & Suppression
- Removal of Unnecessary Hardware Components
Personnel Security
- Screening & Background Checks
- Onboarding, Transfer, and Offboarding Procedures
- Nondisclosure Agreements (NDAs)
- Return of Assets
- Separation of Duties
- Job Rotation
- Mandatory Vacations
- Split Knowledge & Dual Authorization
- Clear Desks & Screens
- Contact With Law Enforcement & Cybercrime Authorities
Identity, Credential, and Access Management
- Identity Provider selection & standardization
- Domain registration
- Multifactor Authentication (MFA)
- Passwordless Authentication
- Password Managers
- Conditional Access
- Account Lockout
- Privileged Access Workstations (PAWs)
Network Security
- Default Credentials on Network Hardware Removed
- Remote and Local Management Configuration
- Wi-Fi Standards
- Wireless Transmission Power
- Disabling SSID Broadcast
- Configuration Pages Obscured
- Wireless Access Schedule
- MAC Address Filtering
- Port Security
- Binding MAC & IP Addresses
- Network Address Translation (NAT)
- Network Firewalls
- Macrosegmentation
- Microsegmentation
- Three Dumb Routers
- Content/DNS filtering
- Intrusion Detection & Prevention Systems (IDPS)
- Demilitarized Zone (DMZ) for Public-Facing Systems
- Backup Internet Service Provider (ISP)
Endpoint Security
- Endpoint Management Model (Workgroup vs Domain)
- Enterprise Mobility Management Strategies
- Mobile Device Management (MDM)
- Mobile Application Management (MAM)
- Refresh Cycles
- Trusted Platform Module (TPM)
- Unified Extensible Firmware Interface (UEFI)
- UEFI Secure Boot
- Secure Operating System Selection & Provisioning
- Windows Hardening
- Linux Hardening
- Host Firewalls
- Anti-Malware Software
- Application Whitelisting
- Web Browser Protections
- Full Disk Encryption (FDE)
- File Integrity Monitoring (FIM)
- Endpoint Detection and Response (EDR) & Extended Detection and Response (XDR)
Data Governance & Safeguards
- Data Loss Prevention (DLP)
- Data Tokenization
- Data Watermarking
- File/Folder Encryption
- Data Destruction & Disposal
- Steganography
