Prevent Flashcards
PR.AC-1
Identities and credentials are managedfor authorized devices and users
PR.AC-2
Physical access to assets is managed and protected
PR.AC-3
Remote access is managed
PR.AC-4
Access permissions are managed, incorporating the principles of least privilege and separation of duties
PR.AC-5
Network integrity is protected, incorporating network segregation where appropriate
PR.AT-1
All users are informed and trained
PR.AT-2
Privileged users understand roles & responsibilities
PR.AT-3
Third-party stakeholders (e.g., suppliers, customers, partners) understand roles & responsibilities
PR.AT-4
Senior executives understand roles & responsibilities
PR.AT-5
Physical and information security personnel understand roles & responsibilities
PR.DS-1
Data-at-rest is protected
PR.DS-2
Data-in-transit is protected
PR.DS-3
Assets are formally managed throughout removal, transfers, and disposition
PR.DS-4
Adequate capacity to ensure availability is maintained
PR.DS-5
Protections against data leaks are implemented
PR.DS-6
Integrity checking mechanisms are used to verify software, firmware, and information integrity
PR.DS-7
The development and testing environment(s) are separate from the production environment
PR.IP-1
A baseline configuration of information technology/industrial control systems is created and maintained
PR.IP-2
A System Development Life Cycle to manage systems is implemented
PR.IP-3
Configuration change control processes are in place
PR.IP-4
Backups of information are conducted, maintained, and tested periodically
PR.IP-5
Policy and regulations regarding the physical operating environment for organizational assets are met
PR.IP-6
Data is destroyed according to policy
PR.IP-7
Protection processes are continuously improved
PR.IP-8
Effectiveness of protection technologies is shared with appropriate parties
PR.IP-9
Response plans (Incident Response and Business Continuity) and recovery plans (Incident Recovery and Disaster Recovery) are in place and managed
PR.IP-1
: Response and recovery plans are tested
PR.IP-1
: Cybersecurity is included in human resources practices (e.g., deprovisioning, personnel screening)
PR.IP-1
: A vulnerability management plan is developed and implemented
PR.MA-1
Maintenance and repair of organizational assets is performed and logged in a timely manner, with approved and controlled tools
PR.MA-2
Remote maintenance of organizational assets is approved, logged, and performed in a manner that prevents unauthorized access
PR.PT-1
Audit/log records are determined, documented, implemented, and reviewed in accordance with policy
PR.PT-2
Removable media is protected and its use restricted according to policy
PR.PT-3
Access to systems and assets is controlled, incorporating the principle of least functionality
PR.PT-4
Communications and control networks are protected
