European Cybersecurity Audit Assurance Program Res Eng 0914

European Cybersecurity Audit/Assurance Program

About ISACA® With more than 115,000 constituents in 180 countries, ISACA (www.isaca.org) helps business and IT leaders build trust in, and value rom, inormation and inormation s!stems" #stablished in 1$%$, ISACA is the trusted source o &no'lede, standards, net'or&in, and career development or inormation s!stems audit, assurance, securit!, ris&, privac! and overnance proessionals" ISACA oers the C!bersecurit! e*us+, a comprehensive set o resources or c!bersecurit! proessionals, and C-IT., a business rame'or& that helps enterprises overn and manae their inormation and technolo!" ISACA also advances and validates business/critical s&ills and &no'lede throuh the loball! respected Certiied Inormation S!stems Auditor . (CISA.), Certiied Inormation Securit! anaer . (CIS.), Certiied in the overnance o #nterprise IT. (C#IT.) and Certiied in 2is& and Inormation S!stems Control+ (C2ISC+) credentials" The association has more than 300 chapters 'orld'ide" Disclaimer ISACA has desined and created European Cybersecurity Audit/Assurance Program 'hite paper (the 4Wor&) primaril! as an educational resource or assurance, overnance, ris& and securit! proessionals" ISACA ma&es no claim that use o an! o the Wor& 'ill assure a successul outcome" The Wor& should not be considered inclusive o all proper inormation, procedures and tests or e*clusive o other inormation, procedures and tests that are reasonabl! directed to obtainin the same results" In determinin the propriet! o an! speciic inormation, procedure or test, assurance, overnance, ris& and securit! proessionals should appl! their o'n proessional 6udement to the speciic circumstances presented b! the particular s!stems or inormation technolo! environment" Reservation of Rights 7 301 ISACA" All rihts reserved" ISACA 9:01 Alon;uin 2oad, Suite 1010 2ollin eado's, I< %0008 =SA >hone? @1"8:"359"155 a*? @1"8:"359"19 #mail? inoBisaca"or Web site? '''"isaca"or

>rovide eedbac&? www.isaca.org/EU-cyber-implementation >articipate in the ISACA no'lede Center? www.isaca.org/knowledge-center ollo' ISACA on T'itter? https://twitter.com/ISACANews Doin ISACA on
IS- $:8/1/%030/%$/8

©ISACA2014

Allrightsreserved

2


E$ropean Cybersec$rity A$dit/Ass$rance %rogram

©ISACA2014

Allrightsreserved

3


Acknowledgements Development Team: 2ol " von 2oessin, CISA, CIS, C#IT, CISS>, -CI, ora A, S'itEerland, h"F", CISA, C2ISC, 2FCS, h"F", CISA, CIS, C2ISC, IT2A<T S"A", reece Ivo Ivanovs, CISA, CIS, CS#, #rnst H oun -altic SIA, , ICS>, Industrial C!bersecurit! Center (CCI), Spain Charlie curdie, >rice'aterhouseCoopers, = Andreas Teuscher, CISA, C#IT, C2ISC, Sic& A, erman! !pert Reviewers:

Desper Jansen, CIS, C2ISC, CISS>, #S<, >A >ension, Fenmar& artins al&is, CIS, h"F",CISA, CIS, C#IT, C2ISC, CISS>, Galuendo, -elium ISACA "oard of Directors: 2obert # Stroud, C#IT, C2ISC, CA, =SA, International >resident Steven A" -abb, C#IT, C2ISC, ITI<, Godaone, =, Gice >resident arr! D" -arnes, CISA, CIS, C#IT, C2ISC, -A# S!stems Fetica, Australia, Gice >resident 2obert A" Cl!de, CIS, Adaptive Computin, =SA, Gice >resident 2amses alleo, CIS, C#IT, CCS, CISS>, SC>, Si* Sima -lac& -elt, Fell, Spain, Gice >resident Theresa raenstine, CISA, C#IT, C2ISC, CA>, CA, CIA, C>A, =S Jouse o 2epresentatives, =SA, Gice >resident Gittal 2" 2a6, CISA, CIS, C#IT, C2ISC, C#, CIA, CISS>, CA, umar H 2a6, India, Gice >resident Ton! Ja!es, C#IT, ACJS#, CJ#, ACS, C>A, IIA, Kueensland overnment, Australia, >ast International >resident reor! T" rochols&i, CISA, SA-IC, Saudi Arabia, >ast International >resident Febbie A" , =SA, Firector

ran& "" am, CISA, CIA, JCS, JIoF, ocus Strateic roup Inc", Jon on, Firector Ale*ander Lapata >, rupo C!nthus S"A" de C"G", e*ico, Firector #nowledge "oard: Steven A" -abb, C#IT, C2ISC, ITI<, Godaone, =, Chairman 2osemar! " Amato, CISA, CA, C>A, Feloitte Touche Tohmatsu atric& -arlo', CISA, CIS, C2ISC, CISS>, Intercontinental#*chane, Inc" S#, = Charlie -lanchard, CISA, CIS, C2ISC, ACA, CI>>M#, CI>>M=S, CISS>, -CS, Amen Inc", =SA Sushil Chatter6i, C#IT, #dutech #nterprises, Sinapore >hil D" A, > <<>, =SA Anthon! >" oble, CISA, Giacom, =SA Damie >asield, C#IT, ITI< G9, S>, >2IC#3, >iEer, = Ivan SancheE , IS 3:001 , CS#, >>, =SA, Chairman anuel Aceves, CISA, CIS, C#IT, C2ISC, CISS>, CITS, Cerberian Consultin, SA de CG, e*ico San6a! -ahl, CIS, CI>>, India eil >atric& -arlo', CISA, CIS, C2ISC, CISS>, Intercontinental#*chane, Inc" S#, =

-rent Conran, CIS, CISS>, =SA Fere& roc&e, CISA, JA-S, Australia Samuel , ICS>, Industrial C!bersecurit! Center (CCI), Spain arc Sachs, GeriEon, =SA

©ISACA2014

Allrightsreserved

4


Introduction

Overview ISACA developed the IT Assurance Framework (ITAF) as a comprehensive and good-practice-setting model. ITAF provides standards that are designed to be mandator and that are the guiding principles under which the IS audit and assurance pro!ession operates. The guidelines provide in!ormation and direction !or the practice o! IS audit and assurance. Purpose The audit"assurance program is a tool and template to be used as a road map !or the completion o! a speci!ic assurance process. ISACA has commissioned assurance programs to be developed !or use b IS audit and assurance practitioners. This assurance program is intended to be used b IS audit and assurance pro!essionals with the re#uisite knowledge o! the sub$ect matter under review% as described in ITAF standard &'' ro!icienc. Control Framework The audit"assurance programs have been developed in alignment with the ISACA C*+IT , !ramework% using generall applicable and accepted good practices. The generic assurance program is presented in COBIT 5 for Assurance and ensures integration o! all seven enablers in the assurance approach. Governance, Risk and Control of IT overnance% risk and control o! IT are critical in the per!ormance o! an assurance management process. overnance o! the process under review is evaluated as part o! the policies and management oversight controls. isk plas an important role in evaluating what to audit and how management approaches and manages risk. +oth issues are evaluated in the assurance program. /nablers are the primar evaluation point in the process. The assurance program identi!ies the enablers and the steps to determine their design and operating e!!ectiveness. Responsiilities of I! Audit and Assurance Professionals IS audit and assurance pro!essionals are e0pected to customi1e the 2IT Audit"Assurance rogram !or /uropean Cbersecurit3 !or the environment in which the are per!orming the assurance engagement. This document is to be used as a review tool and starting point and ma be modi!ied b the IS audit and assurance pro!essional4 it ishas notthe intended to besub$ect a checklist or e0pertise #uestionnaire. is assumed that thethe IS audit and assurance pro!essional necessar matter that isItre#uired to conduct work (see !ollowing paragraph) and is supervised b a pro!essional with the Certi!ied In!ormation Sstems Auditor (CISA) designation and"or necessar sub$ect matter e0pertise to ade#uatel review the work per!ormed.

"inimum Audit !kills Cbersecurit incorporates man IT processes. +ecause the !ocus is on in!ormation governance% IT management% network% data% contingenc and encrption controls% the audit and assurance pro!essional should have re#uisite knowledge o! these issues. In addition% pro!icienc in risk assessment% in!ormation securit components o! IT architecture% risk management% and the threats and vulnerabilities o! cloud computing and Internet-based data processing is re#uired. There!ore% it is recommended that the audit and assurance pro!essional who is conducting the assessment has the re#uisite e0perience and organisational relationships to e!!ectivel e0ecute the assurance processes. Assurance Program Approach The assurance program table is a template !or a detailed assurance work program% which is based on C*+IT ,. The assurance work program structures an assurance engagement into three ma$or phases% as depicted in figure 1. Figure 1—Generic COBIT 5-ased Assurance !ngagement Approach & 1 See www.isaca.org/C&I'/%ages/Ass$rance-prod$ct-page.asp( for more information on COBIT 5 for Assurance.

©ISACA2014

Allrightsreserved

5


Assurance Engagement Approach Based on COBIT 5 As shown in figure 1% the proposed audit"assurance engagement approach re!ers e0plicitl to all C*+IT , enabler categories. The C*+IT , !ramework e0plains that the enablers are interconnected% e.g.% rocesses use *rganisational Structures as well as In!ormation items (inputs 5I6 and outputs 5*6). 7hen developing the audit"assurance program% it will become clear that when all possible entities o! all enablers are included in the scope and reviewed in detail% there is potential !or duplication. In the development o! this audit"assurance program% care has been taken to avoid or minimi1e duplication% meaning that8 Some aspects o! a process also relate to another enabler and are classi!ied there% e.g.% inputs and outputs can also be classi!ied under the In!ormation enabler heading and treated in detail there. 

Some aspects relating to Skills and Competencies are to a large e0tent covered b process A*'9 "ana#e $uman resources. 

In practice% assurance pro!essionals will have to use their own pro!essional $udgement when developing their own customi1ed audit"assurance programs% to avoid duplication o! work.

©ISACA2014

Allrightsreserved

6


In addition% while audit"assurance programs will be available !or each process% in practice% a group o! processes are o!ten selected !or audit. There!ore% a relevant set o! audit"assurance programs o! the applicable processes will need to be selected !or conducting assurance. The assurance approach depicted in figure 1 is described in more detail and developed into a generic audit"assurance program : including guidance on how to proceed during each step:in section &+ o! COBIT 5 for Assurance . The %uropean C&ersecurit& Audit'Assurance Pro#ram is8 Full aligned with C*+IT ,8 ; It e0plicitl re!erences all seven enablers. In other words% it is no longer e0clusivel process!ocused4 it also uses the di!!erent dimensions o! the enabler model to cover all aspects contributing to the per!ormance o! the enablers. ; It re!erences the C*+IT , goals cascade to ensure that detailed ob$ectives o! the assurance engagement can be put into the enterprise and IT conte0t% and concurrentl it enables linkage o! 



the assurance ob$ectives to enterprise and IT risk and bene!its. Comprehensive et !le0ible8 The generic program is comprehensive because it contains assurance steps covering all enablers in #uite some detail% et it is also !le0ible because this detailed structure allows clear and well-understood scoping decisions to be made. That is% the assurance pro!essional can decide to not cover a set o! enablers or some enabler instances and% while the decision will reduce the scope and related assurance engagement e!!ort% the issue o! what is or is not covered will be #uite transparent to the assurance engagement user.



; ;

/as to understand% !ollow and appl because o! its clear structure8 The table !ollows the !low described in figure 1% but splits each phase into di!!erent steps and substeps. For each step% a short description is included% as is guidance !or the assurance pro!essional on how to proceed with the step (te0t in italics).

Additional guidance on how to use other IT assurance-related standards !or per!orming assurance can be !ound in section < o! COBIT 5 for Assurance .

Customi(ation of t$e Audit'Assurance Pro#ram Customi1ation and completion o! the %uropean C&ersecurit& Audit'Assurance Pro#ram will still be re#uired% and consists o! re!ining the scope b selecting goals and enabler instances:the lists included in the e0ample are comprehensive% et still are e0amples (i.e.% di!!erent strategic priorities o! the enterprise ma dictate a di!!erent scope). The lists can also be considered prohibitive b some% as the can lead to a ver broad scope% and there!ore a ver e0pensive assurance engagement4 selection and prioriti1ation will be re#uired. The assurance pro!essional will need to consider the !ollowing steps8 =etermine the stakeholders o! the assurance initiative and their stake. 

=etermine the assurance ob$ectives based on assessment o! the internal and e0ternal environment"conte0t% including the strategic ob$ectives% goals (!igures >' and >? o! COBIT 5 for Assurance) and priorities o! the enterprise. 



=etermine the ena#ers in scope and the instance(s) o! the enablers in scope.

In each phase% one or two enabler e0amples are !ull elaborated% to illustrate and demonstrate the suggested approach. The audit"assurance program phases !or the other processes and other enablers in scope need to be detailed to the re#uired level o! detail. $sing the Assurance Program

©ISACA2014

Allrightsreserved

7


In the !ollowing section% the /uropean Cbersecurit assurance topic is !ull developed based on the generic audit"assurance program. This detailed program contains the !ollowing additional in!ormation8 In the uidance column% the shaded te0t is speci!ic to the e0ample and provides practical guidance% e.g.% e0amples on which processes to include in scope% on which organisational structures to include in scope% on how to set assessment criteria !or the di!!erent enablers% on how to actuall assess the di!!erent enablers. 



Two additional columns% allowing the audit and assurance pro!essional to identi! and cross-re!erence issues and to record comments8 ;

;

Issue Cross-reference:This column can be used to !lag a !inding"issue that the IT assurance pro!essional wants to !urther investigate or establish as a potential !inding. The potential !indings should be documented in a work paper that indicates the disposition o! the !indings (!ormall reported% reported as a memo or verbal !inding% or waived). Comment:This column can be used to document an !urther notes.

For most o! the enablers% there are several instances in scope. @owever% the assurance pro!essional must complete the list to meet the environment in scope. The remaining instances can be deduced ver similarl to those described in this program% using the C*+IT , !ramework and the COBIT 5) %nalin# Processes guides.

Assurance Engagement: European Cybersecurity Assurance Topic The topic covered b this assurance engagement is Cbersecurit. Goal of t$e Review The primar ob$ective o! the audit"assurance review is to provide management with an impartial and independent assessment relating to the e!!ectiveness o! cbersecurit and related governance% management and assurance. !copin# The review will !ocus on cbersecurit standards% guidelines andin!ormation proceduressecurit as well as the levels is implementation and governance o! these activities. Traditional at on lower outside the scope o! this review. The !ollowing ISACA publications appl to cbersecurit8 COBIT 5 for Information !ecurit& Transformin# C&ersecurit& *sin# COBIT 5 Respondin# to Tar#eted C&erattacks ISACA /uropean Cbersecurit Series !ecurin# "oile +evices *sin# COBIT 5     

From a process re!erence model () perspective% the !ollowing domains and processes appl to this audit and assurance programme8 /='< /nsure isk *ptimisation:overnance in the widest sense should address the intrinsic risk within cbersecurit and set policies and steps accordingl. A*?& anage isk:anagement in IT should ade#uatel address risk issues related to cbersecurit. A*?< anage Securit:The in!ormation securit management sstem (ISS) should incorporate ade#uate provisions !or cbersecurit. 





=SS'& anage Service e#uests and Incidents:Incidents in cbersecurit should be identi!ied and managed. =SS'> anage Continuit:*rganisational !unctions and IT should be resilient with regard to cbersecurit. 



©ISACA2014

Allrightsreserved

8


=SS', anage Securit Services:There should be comprehensive and ade#uate securit services in place to ensure the desired level o! cbersecurit. 

e!er to the above-mentioned detailed publications !or guidance on controls and good practice in cbersecurit. IT Audit and Assurance Program for European Cybersecurity Phase A—Determine cope of the Assurance Initiati!e "ef# A%& A-1.1

As s u r a n cet ep

Issue Cross%refe

$ u i d an ce

Determine the sta'eho(dersof the assurance initiative and their sta'es# Identify the intended users! of the assurance re"ort and their sta#e in the assurance engagement. $his is the assurance o%&ective.

Intended user)s* of the assurance report

Board+audit committee ' (eeds assurance effectiveness and efficiency of cy%ersecurity )ithin the enter"rise ,or's Counci(+-nion "epresentation ' (e assurance in terms of cy%ersecurity facts aff industrial relations ' In *uro"e+ "art or O.ners + shareho(ders cy%ersecurity assurance re"ort may %e inclu statutory re"orting

A-1.2

Identify the interested "arties+ accounta%le and res"onsi%le for the su%&ect matter over )hich assurance needs to %e "rovided.

Accountab(e and responsib(e parties for the sub/ect matter

"egu(ators' In *uro"e+ "art or all of cy%ers re"orting may need to %e disclosed to res"e authorities teering committee:Accounta%le for guida cy%ersecurity "rocesses and services+ includ management and monitoring+ allocation of re delivery of %enefits and value+ and manage Business e0ecuti!es:$he individuals res" identifying re,uirements+ a""roving design a managing "erformance. $hese "eo"le are+ t )ith I$ management+ res"onsi%le for managi correct and controlled use of cy%ersecurity s in line )ith good "ractices. IT management: es"onsi%le for managing correct and controlled use of cy%ersecurity s together )ith the %usiness e/ecutives

A%1

Determine the assurance ob/ecti!es%ased on assessment of the internal and e/ternal environmentconte/t and of the relevant ris' and related opportunitiesi.e.+ not achieving the enter"rise goals!.

Assurance ob/ecti!esare essentially a more detailed and tangi%le e/"ression of those enter"rise o%&ectives relevant to the su%&ect of the assurance engagement. Enterprise ob/ecti!escan %e formulated in terms of the generic enter"rise goals CI$ 3 frame)or#! or they can %e e/"ressed more s"ecifically. Ob/ecti!es of the assurance engagementcan %e e/"ressed using the CI$ 3 enter"rise goals+ the I$-related goals )hich relate more to technology!+ information goals or any other set of s"ecific goals. Ob/ecti!es of the assurance engagement)ill consider all three value o%&ective

©ISACA2014

Allrightsreserved

9


IT Audit and Assurance Program for European Cybersecurity Phase A—Determine cope of the Assurance Initiati!e "ef#


Issue Cross%refe

$ u i d an ce

A-2.1

5nderstand the enter"rise strategy and "riorities.

A-2.2

5nderstand the internal conte/t of the enter"rise.

com"onents+ i.e.+ delivering %enefits that su""ort strategic o%&ectives+ o"timiing the ris# that strategic o%&ectives are not achieved and o"timiing resource levels re,uired to achieve the strategic o%&ectives. 6erform a high-level )al#through of cy%ersecurity arrangements+ including goals+ strategy+ "olicy and "rocesses. 

*sta%lish any "rior cy%ersecurity incidents that serve as trigger events for the audit



Ascertain any "rior audit findings relating to cy%ersecurity.



%tain and understand any s"ecific ris# scenarios relating to the cy%ersecurity audit e.g.+ crime+ cy%er)arfare+ end-user-%ased attac#s!.



Determine the a""lications and o"erating environments affected %y these cy%ersecurity arrangements.



%tain and revie) the organisation7s definition of cy%ersecurity and the organisational sco"e attri%uted to it. Delineate cy%ersecurity from traditional information security.

©ISACA2014

Allrightsreserved



%tain and revie) all I$ services+ a""lications+ "latforms and infrastructure elements covered %y cy%ersecurity arrangements.



Identify and document the relevant %usiness ris# in res"ect to cy%ersecurity+ attac#s and %reaches.



Identify the technology ris# associated )ith cy%ersecurity.



Identify the social ris# associated )ith cy%ersecurity.



Discuss the ris# )ith management of I$+ %usiness and o"erational audit+ and ad&ust the ris# assessment as a""ro"riate ased on the ris# assessment+ revise the sco"e!.



8erify that the cy%ersecurity function has an esta%lished and clear interface )ith the assurance  com"liance function.



8erify that all relevant

10




Issue Cross%refe

$ u i d an ce *uro"ean la)s+ regulations and recommendations for cy%ersecurity are communicated %et)een the assurance  com"liance function+ audit and the cy%ersecurity function. 

%tain and analye documentation of "revious cy%ersecurity-related audits if done %y other auditors!.

A-2.:

5nderstand the e/ternal conte/t of the enter"rise.



9or internal auditors! 8erify that the enter"rise has incor"orated and ado"ted all e/ternal rulings+ directives or other %inding "rovisions related to cy%ersecurity.



9or e/ternal auditors! 8erify that the enter"rise o"erates a com"rehensive internal audit regime )ith regard to cy%ersecurity.



Identify any limitations andor constraints affecting the audit of s"ecific systems and su%systems.



Identify any third-"arty services+ a""lications+ "latforms and infrastructure elements that may not %e accessi%le or are only "artially accessi%le.



Identify any legal+ regulatory or contractual constraints on audit.

Identify any industrial relations-%ased or end-user%ased audit constraints. $he follo)ing goals are retained as #ey goals to %e su""orted+ in reflection of enter"rise strategy and "riorities' 2e yg o a (s 

A-2.4

;iven the overall assurance o%&ective+ translate the identified strategic "riorities into concrete o%&ectives for the assurance engagement.

A-2.4 Cont.

En t e rp r is ego a (s : 

*;0:


*;04 Com"liance )ith e/ternals la)s an regulations

IT%re(ated goa(s: 

I$;02 I$ com"liance and su""ort for %usi com"liance )ith e/ternal la)s and regulat



I$;04
I$;10 Security of information+ "rocessing infrastructure and a""lications En t e r p r is e g o a (s :



Ad d i t i o n a ( g o a ( s

©ISACA2014

Allrightsreserved



*;01 Sta#eholder value of %usiness inve



*;0= Agile res"onses to a changing %usi environment

11




Issue Cross%refe

$ u i d an ce 

*;10 "timisation of service delivery cos

IT%re(ated goa(s:

A-2.3

Define the organisational %oundaries of the assurance initiative.



I$;03 ealised %enefits from I$-ena%led investments and services "ortfolio



I$;0> Delivery of I$ services in line )ith % re,uirements

Describe the organisational boundaries of the assurance engagement i!e! to "hich organisational entities the re#ie" is limited! All other aspects of scope limitation are identified during phase A$%! 

$he revie) must have a defined sco"e. $he revie)er must understand the o"erating environment and "re"are a "ro"osed sco"e+ su%&ect to a later ris# assessment.



%tain information and form an understanding of the %usiness reasons underlying the audit.



Identify the senior %usiness resources res"onsi%le for the revie).



Identify the senior I$ auditassurance resource



res"onsi%le for the revie). *sta%lish the "rocess for suggesting and im"lementing changes to the auditassurance "rogram+ and list the authoriations re,uired.



Identify any limitations andor constraints affecting the audit of s"ecific systems and su%systems.



Identify and third-"arty services+ a""lications+ "latforms and infrastructure elements that may not %e accessi%le or are only "artially accessi%le.



Identify any legal+ regulatory or contractual constraints on audit.

Identify any industrial relations-%ased or end-user%ased audit constraints. CI$ 3 identifies seven ena%ler categories. In this section all seven are covered+ and the assurance "rofessional has the o""ortunity to select ena%lers from all categories to 

A%3

©ISACA2014

Determine the enab(ersin sco"e and the instances! of the ena%lers in sco"e.

Allrightsreserved

12



A-:.1


Issue Cross%refe

$ u i d an ce

Define the Princip(es4 Po(icies and rame.or's in sco"e.

o%tain the most com"rehensive sco"e for the assurance engagement. ;uiding "rinci"les and "olicies include' 

Cy%ersecurity "olicy and standards documentation.



Security management frame)or#+ such as ISI*C 2>001 )ith IS 2>0:2+ or the (IS$ =00 series+ )ill %e used as a good-"ractice reference.



SA(S 20 Critical Controls



IS


Information architecture model

?egal and regulatory com"liance re,uirements COBIT 5& Enabling Processes distinguishes a governance domain )ith a set of "rocesses and a management domain+ )ith four sets of "rocesses. $he "rocesses in sco"e are identified using the goals cascade and su%se,uent customiation. $he resulting lists contain #ey "rocesses and additional "rocesses to %e considered during this assurance engagement. Availa%le resources )ill determine )hether they can all %e effectively assessed. 2ey processes 

A-:.2

Define )hich Processesare in sco"e of the revie). 6rocesses )ill %e assessed during "hase  of the assurance engagement against the criteria defined in "hase A+ and assessments )ill ty"ically focus on' 

Achievement of "rocess goals



A""lication of "rocess good "ractices



*/istence and ,uality of )or# "roducts in"uts and out"uts! insofar not covered %y the information items assessments!

Additiona( processes

©ISACA2014

Allrightsreserved



*D<0: *nsure is# "timisation;overn the )idest sense should address the intrins )ithin cy%ersecurity and set "olicies and st accordingly.



A612


A61:


DSS02


DSS04


DSS03


*D<01 *nsure ;overnance 9rame)or# S





A60>


A60


A610
13



A-:.: A-:.: Cont.


Define )hich Organisationa( tructures)ill %e in sco"e. rganisational Structures )ill %e assessed during "hase  of the assurance engagement against the criteria defined in "hase A+ and assessments )ill ty"ically focus on' 

Achievement of rganisational Structure goals+ i.e.+ decisions



A""lication of rganisational Structures good "ractices

ased on the #ey "rocesses identified in A-:.2+ the follo)ing rganisational Structures and functions are considered to %e in sco"e of this assurance engagement+ and availa%le resources )ill determine )hich ones )ill %e revie)ed in detail. 2ey Organisationa( tructures

Additiona( Organisationa( tructures

A-:.4

Issue Cross%refe

$ u i d an ce

Define the Cu(ture4 Ethics and Beha!iour as"ects in sco"e.



AI0=


AI0


AI10


Cy%ersecurity team



usiness e/ecutives



Service manager



Chief information officer CI!



usiness "rocess o)ners



Chief information security officer 



Chief e/ecutive officer C*!



@ead I$ o"erations



is# function



6rivacy officer



Com"liance



Audit



9ormal Cy%ersecurity 6olicy



Code of Conduct



$hird-"arty access "olicies



8irtual architecture documentation



8irtualiation "olicies

In the conte/t of this engagement+ the follo)ing enter"rise)ide cu(ture and beha!ioursare in sco"e' 

Integrity and elia%ility

6ersonal and 6rofessional elia%ility COBIT 5& Enabling Processes defines a num%er of in"uts and out"uts %et)een "rocesses. ased on the fact that AI02+ AI0:+ DSS03 and DSS0 )ere defined as #ey "rocesses in sco"e+ the related in"uts and out"uts are considered in this section. ey "riorities and availa%ility of resources )ill determine ho) many and )hich ones )ill %e revie)ed in detail. $he follo)ing items are considered for this e/am"le. 2ey Information Items 

A-:.3

Define the Information itemsin sco"e. Information items )ill %e assessed during "hase  of the assurance engagement against the criteria defined in "hase A+ and assessments )ill ty"ically focus on' 

Achievement of Information goals+ i.e.+ ,uality criteria of the information items



A""lication of Information good "ractices Information attri%utes!



Cy%ersecurity technical standards $echnical guidelines and "rocedur I$ service level+ including services "artially "rovided %y third "arties



A-:.3 Cont.

©ISACA2014

$echnical guidelines and "rocedur I$ a""lication level



Allrightsreserved

14




Issue Cross%refe

$ u i d an ce

$echnical guidelines and "rocedur I$ "latform level+ including remotely controll administered "latforms rental virtual serve



$echnical guidelines and "rocedur autonomous I$ hard)are level including st servers and clusters+ end user 6C devices



$echnical guidelines and "rocedur critical or "articularly e/"osed hard)are ite nota%ly mo%ile devices such as smart"hon ta%lets  $echnical and administrative guide "rocedures around ED 

$echnical and administrative guide "rocedures for industrial control systems a interfaces



$echnical and administrative guide "rocedures for %uilding and facilities mana systems



Incident management+ disaster rec service  %usiness continuity "rocedures for assets



;uidelines and "rocedures concer identification+ documentation and safeguar informational evidence+ e.g. logs





8irtualiation controls assessment



$hird-"arty access controls asses

results Additiona( Information Items

Cy%ersecurity attri%utes in data an information classification



*vidence of cy%ersecurity inclusio and information classification



A-:.

Define the er!ices4 Infrastructure and App(ications In the conte/t of this assignment+ in sco"e. and ta#ing into account the goals identified in A-2.4+ the follo)ing services and related a""lications or infrastructure could %e considered in sco"e of the revie)' 

Cy%ersecurity training



Change management



@uman resources



@el" des#

Incident trac#ing system In the conte/t of this engagement+ ta#ing into account #ey "rocesses and #ey roles+ the follo)ing s#ill sets are included in sco"e' 

A-:.>

©ISACA2014

Define the Peop(e4 'i((s and Competenciesin sco"e. S#ill sets and com"etencies )ill %e assessed during "hase  of the assurance engagement against the criteria defined in "hase A+ and assessments )ill ty"ically focus on' 

Achievement of s#ills set goals



Cy%ersecurity 6ersonnel S#ills



A""lication of s#ills set and com"etencies good "ractices



*nter"rise)ide Cy%ersecurity A)areness

Allrightsreserved

15


IT Audit and Assurance Program for European Cybersecurity

"e f #

B%& -1.1

Phase B—-nderstand Enab(ers4 etting uitab(e Assessment Criteria and Perform the Asse 6etrics Issue A s s u r a n c e  t e p s a n d $ u i d a n ce Cross%reference Agree on metrics and criteria for enterprise goa(s and IT%re(ated goa(s# Assess enterprise goa(s and IT%re(ated goa(s# %tain and agree on! metrics for enter"rise goals and e/"ected values of the metrics. Assess )hether enter"rise goals in sco"e are achieved. 'e#erage the list of suggested metrics for the enterprise goals to define discuss and agree on a set of rele#ant customi(ed metrics for the enterprise goals ta)ing care that the suggested metrics are dri#en by the performance of the topic of this assurance initiati#e! *e+t agree on the e+pected #alues for these metrics i!e! the #alues against "hich the assessment "ill ta)e place! $he follo)ing metrics and e/"ected values are agreed on for the #ey enter"rise goals defined in ste" A-2.4. En t er p r is e$ o a ( *;0:
6e t r i c

E0 p ect e dO u tco me)E0* Agree on the e+pected #alues for the Enterprise goal metrics i!e! the #alues against "hich the assessment "ill ta)e place

As s e s s me n tt e p In this step the related metri each goal "ill be re#ie"ed a assessment "ill be made "h the defined criteria are achie

9re,uenc y of u"date of ris# "rofile (um%er of regulatory noncom"liance issues relating to cy%er incidents

Agree on the e+pected #alues for the Enterprise goal metrics i!e! the #alues against "hich the assessment "ill ta)e place

In this step the related metri each goal "ill be re#ie"ed a assessment "ill be made "h the defined criteria are achie

6e t r i c (um%er of

E0 p ect e dO u tco me)E0* Agree on the e+pected #alues for the IT$

As s e s s me n tt e p In this step the related metri

cy%ersecurit y-related noncom"liance issues re"orted to

related metrics i!e! the #alues against goal "hich the assessment "ill ta)e place!

each goal "ill"ill bebe re#ie"ed a assessment made "h the defined criteria are achie



6ercent of critical %usiness o%&ectives and services covered %y ris# assessme nt



*;04 Com"liance )ith e/ternals la)s and regulations

-1.2

%tain and agree on! metrics for I$-related goals and e/"ected values of the metrics and assess )hether I$-related goals in sco"e are achieved. $he follo)ing metrics and e/"ected values are agreed for the #ey I$-related goals defined in ste" A-2.4. IT % r e (at e d$ o a ( I$;02 I$ com"liance and su""ort for %usiness com"liance )ith e/ternal la)s and regulations

©ISACA2014

Allrightsreserved

16



"e f #

Phase B—-nderstand Enab(ers4 etting uitab(e Assessment Criteria and Perform the Asse 6etrics Issue A s s u r a n c e  t e p s a n d $ u i d a n ce Cross%reference the %oard or causing "u%lic comment or em%arrassm ent I$;04
-1.2 Cont.

"rocesses + I$ services and I$ena%led %usiness "rogramm es covered %y ris# assessme nt 



I$;10 Security of information+ "rocessing infrastructure and a""lications

©ISACA2014

place!

the defined criteria are achie

Agree on the e+pected #alues for the IT$ related goal metrics i!e! the #alues against "hich the assessment "ill ta)e place!

In this step the related metri each goal "ill be re#ie"ed a assessment "ill be made "h the defined criteria are achie

(um%er of significant I$-related incidents that )ere not identified in ris# assessme nt 6ercent of enter"rise ris# assessme nts including I$-related ris#



9re,uenc y of u"date of ris# "rofile



(um%er of security incidents related to cy%ersecu rity )ea#ness es causing financial loss+ %usiness disru"tion or "u%lic em%arras sment



9re,uenc

Allrightsreserved

17



"e f #

©ISACA2014

Phase B—-nderstand Enab(ers4 etting uitab(e Assessment Criteria and Perform the Asse 6etrics Issue A s s u r a n c e  t e p s a n d $ u i d a n ce Cross%reference y of cy%ersecu rity assessme nt against latest standards and guidelines

Allrightsreserved

18


IT Audit and Assurance Program for European Cybersecurity Phase B—-nderstand Enab(ers4 etting uitab(e Assessment Criteria and Perform the Asse Princip(es4 Po(icies and rame.or's "ef.

Assurance teps and $uidance

%tain an understanding of the Princip(es4 Po(icies and rame.or's in sco"e and set suita%le assessment criteria. B%1 Assess 6rinci"les+ 6olicies and 9rame)or#s# Princip(es4 po(icies and frame.or's: Cybersecurity po(icy and standards documentation -2.1a -2.2a

-2.:a

5nderstand the Princip(es4 Po(icies and rame.or's conte0t . Obtain and understanding of the o#erall system of internal control and the associated Principles Policies and ,rame"or)s 5nderstand the sta#eholders of the Princip(es4 Po(icies and rame.or's ' Cybersecurity po(icy and standards documentation -nderstand the sta)eholders in the policies! The sta)eholders for the policies include those setting the policies and those "ho need to be in compliance "ith the policies! 5nderstand the goa(s for the Princip(es4 Po(icies and rame.or's + and the related metrics and agree on e/"ected values. Assess )hether the Princip(es4 Po(icies and rame.or's goals outcomes! are achieved+ i.e.+ assess the effectiveness of the Princip(es4 and rame.or's. ;oal' Descri%e the goal of the Cybersecurity po(icy and standards documentation 6erform the assurance ste"s using the e/ criteria descri%ed %elo). $oa( C r it e r i a As s e s s me n tt ep Com"rehensiveness $he set of "olicies is 8erify that the set of "olicies is com"rehensive in its coverage. com"rehensive in its coverage. Currency $he set of "olicies is u" to 8erify that the set of "olicies is u" to date. $his at least re,uires' date. $his at least re,uires'  A regular validation of all "olicies )hether they are still u" to date 

A regular validation of all "olicies )hether they are still u" to date

An indication of the "olicies7 e/"iration date or date of last u"date $he set of "olicies is fle/i%le. It is structured in such a )ay that it is easy to add or u"date "olicies as circumstances re,uire.



An indication of the "olicies7 e/"iration date or date of last u"date



8erification of com"liance )ith cycle dates for "olicies



9le/i%ility

Availa%ility



6olicies are availa%le to all sta#eholders.

8erify the fle/i%ility of the set of "olicies+ i.e.+ that it is structured in su that it is easy to add or u"date "olicies as circumstances re,uire.



8erify that "olicies are availa%le to all sta#eholders.

8erify that "olicies are easy to navigate and have a logical and hie 6olicies are easy to structure. navigate and have a logical and hierarchical structure. 5nderstand the life cycle stages of the Princip(es4 Po(icies and rame.or's + and agree on the relevant criteria. Assess to )hat e/tent the Princip(es4 Po(icies and rame.or's life cycle is managed. The life cycle of the IT$related policies is managed by the Process APO.! The re#ie" of this life cycle is therefore e0ui#alent to a process r process APO.


-2.4a

-2.3a -2.3a Cont.

escalation "rocedure is e/"lained and commonly #no)n. 



©ISACA2014

$he e/ce"tion and escalation "rocedure has not %ecome the de facto standard "rocedure. */em"tions from cy%ersecurity "olicy are a""lied for+ revie)ed and authoried in conformance

Allrightsreserved

and commonly #no)n. $hrough o%servation of a re"resentative sam"le+ verify that the e/ce escalation "rocedure has not %ecome de facto standard "rocedure. 

If the organisation grants e/em"tions from cy%ersecurity "olicy+ o% co"y of the list of currently authoried e/em"tions and a co"y of th "rocedure for */em"tions to 6olicy.



Determine that e/em"tions are granted only for a limited time "erio ma/imum one year.



Determine that each cy%ersecurity e/em"tion is regularly revie)ed

19



Assurance teps and $uidance )ith the organisation7s */ce"tions to 6olicy "rocedures. A61:! Com"liance

Communication

@Su""ort

$hecom"liancechec#ing mechanism and noncom"liance conse,uences are clearly descri%ed and enforced. $he "olicies havecy%ersecurity %een defined %y management+ documented+ a""roved at an a""ro"riate senior level+ disseminated to all relevant em"loyees and third "arties+ and de"loyed across the organisation. A61:! Cy%ersecurity"rocessesare integrated into @ services+ "olicies and com"liance. A61:!

continuing a""lica%ility. Determine )hether a ris# assessment )as "erformed %efore any e/em"tion is granted and com"ensating controls are in "lace+ if ne 8erify that the com"liance chec#ing mechanism and non-com"liance conse,uences are clearly descri%ed and enforced. 



8erify that an a""ro"riate cy%ersecurity "olicy )as drafted and de" %efore the cy%ersecurity "rogram )as de"loyed into "roduction.



8erify that senior %usiness management formally a""roved the cy%ersecurity "olicy.



8erify that all em"loyees are a""ro"riately informed of the cy%erse "olicy+ e.g.+ during initial orientation and in information security trai



%tain a co"y of the organisation7s Code of Conduct and determin )hether it s"ecifically states that a violation of the cy%ersecurity "o considered a violation of the Code of Conduct )ith a""lica%le sanc



Determine )hether disci"linary "olicies and su""orting "rocesses effect for violations of cy%ersecurity "olicy. $hese should include' *sta%lished "enalties for infringements



*sta%lish )hether a)areness cam"aigns are conducted "eriodicall



Determine the "olicies in effect to "ermit third "arties to use the organisation7s I$ resources+ and to "rotect the organisation7s asset intellectual "ro"erty from unauthoried access.



*valuate the effectiveness of cy%ersecurity controls u"on third "art determine )hether additional controls+ "olicies or "rocedures are r to "rotect the organisation7s assets.

5niform a""lication of "enalty "olicy -2.3a Cont.

$hird-"arty com"liance

$hird "arties+ such as contractors+ are contractually re,uired to com"ly )ith the organisation7s cy%ersecurity "olicies. A60+ A610!

Cloud services and virtualied environments

$he enter"rise7s architecture  %tain and revie) architecture elements and com"onents involvin e/tends cy%ersecurity or virtualised elements. arrangements to cover all  Determine the "olicies in effect to govern cloud and virtualisation u cloud-%ased andor virtualised esta%lish the level of "rotection )ith regard to cy%ersecurity. services+ a""lications and  *valuate the effectiveness of cy%ersecurity controls on cloud servi information assets. A60:+ virtualised environments and identify any ga"s. A60+ A610+ DSS03! Princip(es4 po(icies and frame.or's: Cybersecurity rame.or's and tandards -2.1% -2.2%

-2.:%

5nderstand the Princip(es4 Po(icies and rame.or's conte0t . Obtain and understanding of the o#erall system of internal control and the associated Principles Policies and ,rame"or)s 5nderstand the sta#eholders of the Princip(es4 Po(icies and rame.or's ' Cybersecurity rame.or's and tandards -nderstand the sta)eholders in the policies! The sta)eholders for the policies include those setting the policies and those "ho need to be in compliance "ith the policies! 5nderstand the goa(s for the Princip(es4 Po(icies and rame.or's + and the related metrics and agree on e/"ected values. Assess )hether the Princip(es4 Po(icies and rame.or's goals outcomes! are achieved+ i.e.+ assess the effectiveness of the Princip(es4 and rame.or's. 6erform the assurance ste"s using the e/  ;oal' Cybersecurity rame.or's and tandards Security management frame)or#s+ criteria descri%ed %elo). such as ISI*C 2>001 )ith IS 2>0:2+ or the (IS$ =00 series+ )ill %e used as a good"ractice reference. $oa( Com"rehensiveness Currency

C r it e r i a $he set of frame)or#s are com"rehensive in its coverage. $he set of frame)or#s are u" to date. $his at least re,uires' 

©ISACA2014

As s e s s me n tt ep 8erify that the set of frame)or#s arecom"rehensive in its coverage. 8erify that the set of frame)or#s areu" to date. $his at least re,uire 

A regular validation of all frame)or#s )hether they are still u" to d

A regular validation of all

Allrightsreserved

20



Assurance teps and $uidance frame)or#s )hether they are still u" to date An indication of the frame)or#s e/"iration date or date of last u"date $he set of frame)or#s are fle/i%le. It is structured in such a )ay that it is easy to add or u"date controls as circumstances re,uire.



An indication of the frame)or#s e/"iration date or date of last u"d



8erification of com"liance )ith cycle dates for frame)or#s



9le/i%ility

Availa%ility

-2.4% -2.:% Cont. -2.3%

8erify the fle/i%ility of the set of frame)or#s+ i.e.+ that it is structured i )ay that it is easy to add or u"date controls as circumstances re,uir

9rame)or#s are availa%le to  8erify that frame)or#s are availa%le to all sta#eholders. all sta#eholders.  8erify that frame)or#s are easy to navigate and have a logical and 9rame)or#s are easy to hierarchical structure. navigate and have a logical and hierarchical structure. 5nderstand the life cycle stages of the Princip(es4 Po(icies and rame.or's + and agree on the relevant criteria. Assess to )hat e/tent the Princip(es4 Po(icies and rame.or's life cycle is managed. The life cycle of the IT$related policies is managed by the Process APO.! The re#ie" of this life cycle is therefore e0ui#alent to a process r process APO.
escalation "rocedure is e/"lained and commonly #no)n. $he e/ce"tion and escalation "rocedure has not %ecome the de facto standard "rocedure. $hecom"liancechec#ing mechanism and noncom"liance conse,uences are clearly descri%ed and enforced. Cy%ersecurity technical standards are aligned )ith the organisation7s standards. A61:+ DSS04+ DSS03!

and commonly #no)n. 



Com"liance

Alignment )ith internal "olicies

-2.3% Cont.

$hrough o%servation of a re"resentative sam"le+ verify that the e/ and escalation "rocedure has not %ecome de facto standard "roce

8erify that the com"liance chec#ing mechanism and non-com"liance conse,uences are clearly descri%ed and enforced.



%tain and revie) the current set of a""lica%le technical or technol related standards.



Determine )hether these standards include a""ro"riate reference cy%ersecurity re,uirements and measures.



*valuate drill do)n! for critical services+ a""lications+ "latforms or infrastructure elements as )ell as information assets to ensure tha technical standards are com"rehensive enough to encom"ass the cy%ersecurity.



%tain a co"y of each of the follo)ing' $echnical guidelines and "rocedures at the I$ service level including services "artially or fully "rovided %y third "arties $echnical guidelines and "rocedures at the I$ a""lication l $echnical guidelines and "rocedures at the I$ "latform lev including remotely controlled and administered "latforms r virtual servers etc.! $echnical guidelines and "rocedures at the autonomous I$ hard)are level including stand-alone servers and clusters+ user 6C devices etc.! $echnical guidelines and "rocedures for critical or "articula

©ISACA2014

Allrightsreserved

21



Assurance teps and $uidance e/"osed hard)are items+ nota%ly mo%ile devices such as smart"hones or ta%lets $echnical and administrative guidelines and "rocedures ar ED $echnical and administrative guidelines and "rocedures fo industrial control systems and I$ interfaces $echnical and administrative guidelines and "rocedures fo and facilities management systems Incident management+ disaster recovery and service  %usi continuity "rocedures for critical I$ assets ;uidelines and "rocedures concerning the identification+ documentation and safeguarding of informational evidence logs Identify and document any ga"s+ inconsistencies and "otential )e in the documentation COBIT 5 and related documentsCy%ersecurity is su%&ect to CI$ frame)or#. Detailed guidance using CI$ 3 is a""lied throughout t enter"rise' 

Standards of good "ractice are a""lied to cy%ersecurity

ecognised standards of good "ractice in cy%ersecurity are a""lied )ithin the enter"rise.



Determine if CI$ 3 has %een acce"ted and im"lemented as the frame)or# for cy%ersecurity.

Determine if COBIT 5 for Information 1ecurity and related docume cy%ersecurity are im"lemented IO tandards--elevant IS standards are a""lied to cy%ersecurit 

Determine if the IS 2>000 series has %een acce"ted and im"lem guidance for cy%ersecurity. Determine if the IS 22:00 series has %een acce"ted and im"lemen guidance for the resilience as"ects of cy%ersecurity Incident reporting )Art# &3a*:Incidents are identified+ documented re"orted in line )ith a""lica%le regulations andor good "ractice recommendations. DSS02! 

Critical infrastructure "rotection standards are a""lied to cy%ersecurity

-2.3% Cont.

Fhere organisations are deemed "art of critical information infrastructures+ cy%ersecurity arrangements are aligned )ith e/isting regulations and good "ractice



Determine )hether the enter"rise is su%&ect to the regulations for e communications o"erators and therefore su%&ect to Article 1:a



8erify that all a""lica%le incident re"orting regulations and recommendations are %eing adhered to

ystems%re(ated recommendations and guide(ines: Critical a""li and systems are managed in line )ith good "ractice and recognised recommendations for cy%ersecurity. 

Determine )hether critical systems such as industrial control syst ade,uately covered %y e/isting cy%ersecurity arrangements.



8erify that mo%ile devices are ade,uately covered %y e/isting cy%e arrangements.

Princip(es4 po(icies and frame.or's: A7 18 Critica( Contro(s -2.1c -2.2c

-2.:c

5nderstandt he Princip(es4 Po(icies and rame.or's conte0t . Obtain and understanding of the o#erall system of internal control and the associated Principles Policies and ,rame"or)s 5nderstand the sta#eholders of the Princip(es4 Po(icies and rame.or's ' A7 18 Critica( Contro(s -nderstand the sta)eholders in the policies! The sta)eholders for the policies include those setting the policies and those "ho need to be in compliance "ith the policies! 5nderstandt he goa(s for the Princip(es4 Po(icies and rame.or's + and the related metrics and agree on e/"ected values. Assess )hether the Princip(es4 Po(icies and rame.or's goals outcomes! are achieved+ i.e.+ assess the effectiveness of the Princip(es4 and rame.or's. 6erform the assurance ste"s using the e/  ;oal' A7 18 Critica( Contro(sshould %e used to ensure that critical controls are criteria descri%ed %elo). included in the cy%ersecurity "rogram. $oa( Com"rehensiveness

©ISACA2014

C r it e r i a Documentation a%out SA(S 20 Critical Controls is

Allrightsreserved

As s e s s me n tt ep 8erify that Documentation a%out SA(S 20 Critical Controls is com"r in its coverage.

22




Currency

com"rehensive in its coverage. Documentation a%out SA(S 20 Critical Controls is u" to date. $his at least re,uires' 

A regular validation of all documents )hether they are still u" to date

8erify that Documentation a%out SA(S 20 Critical Controls is u" to d at least re,uires' 

A regular validation of all documentation )hether they are still u" t



An indication of the documentation e/"iration date or date of last u



8erification of com"liance )ith cycle dates



9le/i%ility

Availa%ility

An indication of the documents e/"iration date or date of last u"date Documentation a%out SA(S 20 Critical Controls is fle/i%le. It is structured in such a )ay that it is easy to add or u"date controls as circumstances re,uire. 

Documentation a%out SA(S 20 Critical Controls is availa%le to all sta#eholders.

8erify the fle/i%ility of the documentation a%out SA(S 20 Critical Con i.e.+ that it is structured in such a )ay that it is easy to add or u"date as circumstances re,uire.



8erify that documents are availa%le to all sta#eholders.

8erify that documents are easy to navigate and have a logical and hierarchical structure. Documentation a%out SA(S 20 Critical Controls is easy to navigate and have a logical and hierarchical structure. 5nderstand the life cycle stages of the Princip(es4 Po(icies and rame.or's + and agree on the relevant criteria. Assess to )hat e/tent the Princip(es4 Po(icies and rame.or's life cycle is managed. The life cycle of the IT$related policies is managed by the Process APO.! The re#ie" of this life cycle is therefore e0ui#alent to a process r process APO.


-2.4c

-2.3c

-2.:c Cont.

The assurance professional "ill by using appropriate auditing techni0ues assess the follo"ing aspects! $ ood P r a ct i ce C r it e r i a As s e s s me nt t ep Sco"e and validity $he sco"e is descri%ed and 8erify that the sco"e of the frame)or# is descri%ed and the validity d the validity date is i ndicated. indicated. */ce"tion and escalation  $he e/ce"tion and  8erify that the e/ce"tion and escalation "rocedure is descri%ed+ e/ escalation "rocedure is e/"lained and commonly #no)n. $he e/ce"tion and escalation "rocedure has not %ecome the de facto standard "rocedure. $hecom"liancechec#ing mechanism and noncom"liance conse,uences are clearly descri%ed and enforced. Critical control setshave %een incor"orated into cy%ersecurity arrangements





Com"liance

Com"leteness


$he SA(S 20 critical controls have %een incor"orated and em%edde enter"rise7s cy%ersecurity arrangements. Determine if the enter"rise has formally acce"ted and ado"ted the 20 controls as guidance for cy%ersecurity.

Princip(es4 po(icies and frame.or's: I6 Po(icy -2.1d -2.2d

©ISACA2014

5nderstand the Princip(es4 Po(icies and rame.or's conte0t . Obtain and understanding of the o#erall system of internal control and the associated Principles Policies and ,rame"or)s 5nderstand the sta#eholders of the Princip(es4 Po(icies and rame.or's ' I6 Po(icy -nderstand the sta)eholders in the policies! The sta)eholders for the policies include those setting the policies and those "ho need to be in compliance "ith the policies!

Allrightsreserved

23


IT Audit and Assurance Program for European Cybersecurity Phase B—-nderstand Enab(ers4 etting uitab(e Assessment Criteria and Perform the Asse Princip(es4 Po(icies and rame.or's "ef. -2.:d

-2.:d Cont.

Assurance teps and $uidance 5nderstand the goa(s for the Princip(es4 Po(icies and rame.or's + and the related metrics and agree on e/"ected values. Assess )hether the Princip(es4 Po(icies and rame.or's goals outcomes! are achieved+ i.e.+ assess the effectiveness of the Princip(es4 and rame.or's. 6erform the assurance ste"s using the e/  ;oal' I6 Po(icy' $he cy%ersecurity "olicies have %een defined %y management+ criteria descri%ed %elo). documented+ a""roved at an a""ro"riate senior level+ disseminated to all relevant em"loyees and third "arties+ and de"loyed across the organisation. $oa( C r it e r i a As s e s s me n tt ep Com"rehensiveness $he set of frame)or#s are 8erify that the set of frame)or#s arecom"rehensive in its coverage.

Currency

com"rehensive in its coverage. $he set of frame)or#s are u" to date. $his at least re,uires' 

A regular validation of all frame)or#s )hether they are still u" to date

An indication of the frame)or#s e/"iration date or date of last u"date $he set of frame)or#s are fle/i%le. It is structured in such a )ay that it is easy to add or u"date controls as circumstances re,uire.

8erify that the set of frame)or#s areu" to date. $his at least re,uire 

A regular validation of all frame)or#s )hether they are still u" to d



An indication of the frame)or#s e/"iration date or date of last u"d



8erification of com"liance )ith cycle dates for frame)or#s



9le/i%ility

Availa%ility



9rame)or#s are availa%le to all sta#eholders.

8erify the fle/i%ility of the set of frame)or#s+ i.e.+ that it is structured i )ay that it is easy to add or u"date controls as circumstances re,uir



8erify that frame)or#s are availa%le to all sta#eholders.

8erify that frame)or#s are easy to navigate and have a logical and 9rame)or#s are easy to hierarchical structure. navigate and have a logical and hierarchical structure. 5nderstand the life cycle stages of the Princip(es4 Po(icies and rame.or's + and agree on the relevant criteria. Assess to )hat e/tent the Princip(es4 Po(icies and rame.or's life cycle is managed. 



-2.4d

-2.3d

The life cycle of the IT$related is managed by the Process APO.! The re#ie" of this life cycle is therefore e0ui#alent to a process r process APO.
$he e/ce"tion and escalation "rocedure has not %ecome the de facto -2.3d standard "rocedure. Cont. Com"liance $hecom"liancechec#ing mechanism and noncom"liance conse,uences are clearly descri%ed and enforced. Princip(es4 po(icies and frame.or's: Information architecture mode(





-2.1e -2.2e

©ISACA2014


5nderstand the Princip(es4 Po(icies and rame.or's conte0t . Obtain and understanding of the o#erall system of internal control and the associated Principles Policies and ,rame"or)s 5nderstand the sta#eholders of the Princip(es4 Po(icies and rame.or's: Information architecture mode( -nderstand the sta)eholders in the policies! The sta)eholders for the policies include those setting the policies and those "ho need to be in compliance "ith the policies!

Allrightsreserved

24


IT Audit and Assurance Program for European Cybersecurity Phase B—-nderstand Enab(ers4 etting uitab(e Assessment Criteria and Perform the Asse Princip(es4 Po(icies and rame.or's "ef. -2.:e

Assurance teps and $uidance 5nderstand the goa(s for the Princip(es4 Po(icies and rame.or's + and the related metrics and agree on e/"ected values. Assess )hether the Princip(es4 Po(icies and rame.or's goals outcomes! are achieved+ i.e.+ assess the effectiveness of the Princip(es4 and rame.or's. 6erform the assurance ste"s using the e/  ;oal' Information architecture mode( . criteria descri%ed %elo). $oa( C r it e r i a As s e s s me n tt ep Com"rehensiveness $he architecture model is 8erify that documentation is com"rehensive in its coverage. com"rehensive in its coverage. Currency $he architecture model is u" to 8erify that documentation is u" to date. $his at least re,uires' date. $his at least re,uires'  A regular validation of the document )hether it is still u" to date 

A regular validation of the architecture model )hether it is still u" to date

An indication of the architecture model e/"iration date or date of last u"date $he architecture model is fle/i%le. It is structured in such a )ay that it is easy to u"date as circumstances re,uire.



An indication of the document7s e/"iration date or date of last u"da



8erification of com"liance )ith cycle dates



9le/i%ility

Availa%ility



$he architecture model is availa%le to all sta#eholders.

8erify the fle/i%ility of the documentation+ i.e.+ that it is structured in s )ay that it is easy to u"date as circumstances re,uire.



8erify that documentation is availa%le to all sta#eholders.

 8erify that documentation is easy to navigate and have a logical a $he architecture model is hierarchical structure. easy to navigate and have a logical and hierarchical structure. 5nderstand the life cycle stages of the Princip(es4 Po(icies and rame.or's + and agree on the relevant criteria. Assess to )hat e/tent the Princip(es4 Po(icies and rame.or's life cycle is managed. The life cycle of the IT$related policies is managed by the Process APO.! The re#ie" of this life cycle is therefore e0ui#alent to a process r process APO.
-2.4e -2.4e Cont. -2.3e

escalation "rocedure is e/"lained and commonly #no)n.

and commonly #no)n.

$hrough o%servation of a re"resentative sam"le+ verify that the e/ and escalation "rocedure has not %ecome de facto standard "roce $he e/ce"tion and escalation "rocedure has not %ecome the de facto standard "rocedure. Com"liance $hecom"liancechec#ing 8erify that the com"liance chec#ing mechanism and non-com"liance mechanism and nonconse,uences are clearly descri%ed and enforced. com"liance conse,uences are clearly descri%ed and enforced. Princip(es4 po(icies and frame.or's: 9ega( and regu(atory comp(iance reuirements 



-2.1f -2.2f

©ISACA2014

5nderstand the Princip(es4 Po(icies and rame.or's conte0t . Obtain and understanding of the o#erall system of internal control and the associated Principles Policies and ,rame"or)s 5nderstand the sta#eholders of the Princip(es4 Po(icies and rame.or's: 9ega( and regu(atory comp(iance reuirements -nderstand the sta)eholders in the policies! The sta)eholders for the policies include those setting the policies and those "ho need to be in compliance "ith the policies!

Allrightsreserved

25


IT Audit and Assurance Program for European Cybersecurity Phase B—-nderstand Enab(ers4 etting uitab(e Assessment Criteria and Perform the Asse Princip(es4 Po(icies and rame.or's "ef. -2.:f

-2.:f Cont.

Assurance teps and $uidance 5nderstand the goa(s for the Princip(es4 Po(icies and rame.or's + and the related metrics and agree on e/"ected values. Assess )hether the Princip(es4 Po(icies and rame.or's goals outcomes! are achieved+ i.e.+ assess the effectiveness of the Princip(es4 and rame.or's. 6erform the assurance ste"s using the e/  ;oal' 9ega( and regu(atory comp(iance reuirements criteria descri%ed %elo). $oa( C r it e r i a As s e s s me n tt ep Com"rehensiveness $he legal and regulatory 8erify that documentation is com"rehensive in its coverage. com"liance re,uirements documentation is com"rehensive in its coverage. Currency $he legal and regulatory 8erify that documentation is u" to date. $his at least re,uires' com"liance re,uirements  A regular validation of the document )hether it is still u" to date documentation is u" to date.  An indication of the document7s e/"iration date or date of last u"da $his at least re,uires'  8erification of com"liance )ith cycle dates  A regular validation of the documentation )hether it is still u" to date An indication of the documentation e/"iration date or date of last u"date $he legal and regulatory com"liance re,uirements documentation is fle/i%le. It is structured in such a )ay that it is easy to u"date as circumstances re,uire. 

9le/i%ility

Availa%ility



$he legal and regulatory com"liance re,uirements documentation is availa%le to all sta#eholders.

8erify the fle/i%ility of the documentation+ i.e.+ that it is structured in s )ay that it is easy to u"date as circumstances re,uire.



8erify that documentation is availa%le to all sta#eholders.



8erify that documentation is easy to navigate and have a logical a hierarchical structure.



-2.4f

-2.3f

$he legal and regulatory com"liance re,uirements documentation is easy to navigate and have a logical and hierarchical structure. 5nderstand the life cycle stages of the Princip(es4 Po(icies and rame.or's + and agree on the relevant criteria. Assess to )hat e/tent the Princip(es4 Po(icies and rame.or's life cycle is managed. The life cycle of the IT$related policies is managed by the Process APO.! The re#ie" of this life cycle is therefore e0ui#alent to a process r process APO.
Com"liance

©ISACA2014



$he e/ce"tion and escalation "rocedure has not %ecome the de facto

standard "rocedure. $he com"liance chec#ing mechanism and noncom"liance conse,uences are clearly descri%ed and enforced.

Allrightsreserved


26



©ISACA2014


Allrightsreserved

27


IT Audit and Assurance Program for European Cybersecurity Phase B—-nderstand Enab(ers4 etting uitab(e Assessment Criteria and Perform the Asses Processes "ef. As s u ra n cet ep san d$ u id a n ce Is s u eCr o s s % r ef e re n ce %tain understanding of the Processesin sco"e and set suita%le assessment criteria' for each "rocess in sco"e as determined in B%3 ste" A-:.2!+ additional information is collected and assessment criteria are defined. Assess the 6rocesses. ED683 Ensure ris' optimisation -:.1a

-:.2a

-:.:a

5nderstand the Process conte0t# is# o"timiation refers to governance in the )idest sense should address the intrinsic ris# )ithin cy%ersecurity and set "olicies and ste"s accordingly. 5nderstand the Process purpose# *nsure that I$-related enter"rise ris# does not e/ceed ris# a""etite and ris# tolerance+ the im"act of I$ ris# to enter"rise value is identified and managed+ and the "otential for com"liance failures is minimised. 5nderstand all "rocess sta'eho(dersand their roles. $his is e,uivalent to understanding the real ACI chart of the "rocess COBIT 5& Enabling Processes page %2! 'e#erage the COBIT 5 3ACI charts for the processes in scope to identify any additional sta)eholders that "ill need to be in#ol#ed in the assessment! In this assurance step the translation is made bet"een the theoretical 3ACI chart entry and the real enterprise! $he sta#eholders of the "rocess are already defined in the ACI chart as a result of ste" A-:.:. In addition to those sta#eholders+ this "rocess relies alsotherefore on the follo)ing functions!+ )hich )ill need to %e involved during the assurance engagement'

-:.4a

ED683 Ensure ris' optimi;ation sta#eholders' 5nderstand the Process goa(sand related 3 metrics and define e/"ected 6rocess values criteria!+ and assess )hether the 6rocess goals are achieved+ i.e.+ assess the effectiveness of the "rocess. $he 6rocess ED683 Ensure ris' optimi;ationhas : defined "rocess goals. Pr o ce s s$ o a( is# thresholds are defined and communicated and #ey I$-related ris# is #no)n.

$he follo)ing activities can %e "erformed to assess )hether the goals are achieved. " e (a t e d 6etrics 

?evel of alignm ent %et)e en I$ ris# and

C r i t e r i a + E 0 p e ct e d < a ( u e Agree on the e+pected #alues for the Process goal metrics i!e! the #alues against "hich the assessment "ill ta)e place!

As s e s s m e n t  t e p In this step the related metrics for eac "ill be re#ie"ed and an assessment made "hether the defined criteria are achie#ed!

enter" rise ris#

3 9or CI$ 3 "rocesses+ a set of goals and metrics are identified in COBIT 5& Enabling Processes.

©ISACA2014

Allrightsreserved

28


IT Audit and Assurance Program for European Cybersecurity Phase B—-nderstand Enab(ers4 etting uitab(e Assessment Criteria and Perform the Asses Processes -:.4a Cont.



(um% er of "otenti al I$ ris# identifi ed and manag ed



efres hment rate of ris# factor evalua tion

$he enter"rise is managing critical I$-related enter"rise ris# effectively and efficiently.



(um% er of "otenti al cy%ers ecurity ris# factors identifi ed and manag ed



6erce nt of enter" rise "ro&ect s that

Agree on the e+pected #alues for the Process goal metrics i!e! the #alues against "hich the assessment "ill ta)e place!

In this step the related metrics for eac "ill be re#ie"ed and an assessment made "hether the defined criteria are achie#ed!

consid er I$ ris# 

©ISACA2014

6erce nt of I$ ris# action "lans

Allrightsreserved

29


IT Audit and Assurance Program for European Cybersecurity Phase B—-nderstand Enab(ers4 etting uitab(e Assessment Criteria and Perform the Asses Processes e/ecut ed on time 

6erce nt of critical ris# that has %een effecti vely mitigat ed

I$-related enter"rise ris# does not e/ceed ris# a""etite and the im"act of I$ ris# to enter"rise value is identified and managed.



6erce nt of critical ris# that has %een mitigat ed effecti vely



?evel of une/" ected enter" rise im"act



6erce nt of


In this step the related metrics for eac "ill be re#ie"ed and an assessment made "hether the defined criteria are achie#ed!

I$ ris# that e/cee ds enter" rise ris# toleran ce 

©ISACA2014

6erce

Allrightsreserved

30


IT Audit and Assurance Program for European Cybersecurity Phase B—-nderstand Enab(ers4 etting uitab(e Assessment Criteria and Perform the Asses Processes nt of cy%ers ecurity ris# that e/cee ds enter" rise ris# toleran ce -:.3a

Agree on suita%le criteria to evaluate all "rocesses in sco"e of the assurance engagement' Define and agree on the reference "rocess+ i.e.+ determine )hich %ase "ractices a "rocess should at least include. $his usually is &ust a confirmation of the CI$ 3 "rocesses already identified+ unless there is reason for using a different reference "rocess.! Agree on the "rocess "ractices that should %e in "lace "rocess design!. Assess the process design+ i.e.+ assess to )hat e/tent' 

*/"ected "rocess "ractices are a""lied.

Accounta%ility and res"onsi%ility are assigned and assumed. COBIT 5 Processesare descri%ed in COBIT 5& Enabling Processes. *ach 6rocess re,uires a num%er of management "ractices to %e im"lemented+ as descri%ed in the "rocess descri"tion in the same guide. $hese are' 



*ach "ractice is ty"ically im"lemented through a num%er of activities+ and a )ell-designed " )ill im"lement all these "ractices and activities.

A sound "rocess design

$he reference against )hich the "rocess )ill %e assessed in "hase  )ith the criteria as mentioned+ i.e.+ all management "ractices are e/"ected to %e fully im"lemented. "eference Process "eference Process Practices *D<0:.01 *valuate ris# management. 

-:.3a Cont.

©ISACA2014

*D<0: *nsure ris# o"timisation $ o o dPr a ct ice Continually e/amine and ma#e &udgment on the effect of ris# on the current and future use of I$ in the enter"rise. Consider )hether the enter"rise7s ris# a""etite is a""ro"riate and that ris# to enter"rise value related to the use of I$ is identified and managed.

Allrightsreserved

Criteria' ;overnance "ractices to o"timise ris# are esta%lished As s e s s me n tt ep Assess %y a""lying a""ro"riate audit techni,ues intervie)+ o%servati testing! )hether the management "ractices are effectively im"lement through the follo)ing+ ty"ical control! activities' 1. Determine the level of I$-related ris# that the enter"rise is )illing to meet its o%&ectives ris# a""etite!. 2. *valuate and a""rove "ro"osed I$ ris# tolerance thresholds agains enter"rise7s acce"ta%le ris# and o""ortunity levels. :. Determine the e/tent of alignment of the I$ ris# strategy to enter"ri strategy. 4. 6roactively evaluate I$ ris# factors in advance of "ending strategic enter"rise decisions and ensure that ris#-a)are enter"rise decisions made. 3. Determine that I$ use i s su%&ect to a""ro"riate ris# assessment an evaluation+ as descri%ed in relevant international and national standar . *valuate ris# management activities to ensure alignment )ith the enter"rise7s ca"acity for I$-related loss and leadershi"7s tolerance of i

31


IT Audit and Assurance Program for European Cybersecurity Phase B—-nderstand Enab(ers4 etting uitab(e Assessment Criteria and Perform the Asses Processes Direct the Assess %y a""lying a""ro"riate audit techni,ues intervie)+ o%servati esta%lishment of testing! )hether the management "ractices are effectively im"lement ris# management through the follo)ing+ ty"ical control! activities' "ractices to "rovide 1. 6romote an I$ ris#-a)are culture and em"o)er the enter"rise to "r reasona%le identify I$ ris#+ o""ortunity and "otential %usiness im"acts. assurance that I$ 2. Direct the integration of the I$ ris# strategy and o"erations )ith the ris# management enter"rise strategic ris# decisions and o"erations. "ractices are :. Direct the develo"ment of ris# communication "lans covering all le a""ro"riate to the enter"rise! as )ell as ris# action "lans. ensure that the 4. Direct im"lementation of the a""ro"riate mechanisms to res"ond , actual I$ ris# does changing ris# and re"ort immediately to a""ro"riate levels of manage not e/ceed the su""orted %y agreed-on "rinci"les of escalation )hat to re"ort+ )hen+ %oard7s ris# and ho)!. a""etite. 3. Direct that ris#+ o""ortunities+ issues and concerns may %e identifie re"orted %y anyone at any time. is# should %e managed in accordan "u%lished "olicies and "rocedures and escalated to the relevant decis ma#ers. . Identify #ey goals and metrics of ris# governance and management "rocesses to %e monitored+ and a""rove the a""roaches+ methods+ techni,ues and "rocesses for ca"turing and re"orting the measureme information.
*D<0:.02 Direct ris# management.

*D<0:.0:
-:.a

-:.a Cont.

9

Agree on the process .or' products in"uts and out"uts as defined in the "rocess "ractices descri"tion! that are e/"ected to %e "resent "rocess design!. Assess to )hat e/tent the "rocess )or# "roducts are availa%le. 6rocess ED683 Ensure ris' optimi;ation in"uts and out"uts. $he most relevant and not assessed as Information items in sco"e

Criteria' All listed )or# "roducts should demonstra%ly e/ist and %e used.

9 9or CI$ 3 "rocesses+ a set of in"uts and out"uts for the different management "ractices are identified in COBIT 5& Enabling Processes.

©ISACA2014

Allrightsreserved

32



-:.>a

Phase B—-nderstand Enab(ers4 etting uitab(e Assessment Criteria and Perform the Asses Processes in section A-:.3! of these )or# "roducts are identified as follo)s+ as )ell as the criteria against )hich they )ill %e assessed+ i.e.+ e/istence and usage. P r o ce s s P r a c t ic e ,o r ' P r o d u ct s As s e s s m e n tt G6rocess or 6ractice (ameH A""ly a""ro"riate audit  ?ist )or# "roducts no included in the information items techni,ues to determine section. e/istence and a""ro"ria each )or# "roduct. Agree on the process capabi(ity (e!e(to %e achieved %y the "rocess.

This step is "arranted only if the process under re#ie" is a standard COBIT 5 go#ernance or management process to "hich the I1O/IEC 55.4 PA can be applied! Any other processes for "hich no reference practices "or) products or outcomes are appro#ed cannot use this assessment method6 therefore the concept capability le#el does not apply! APO&1 6anage ris' -:.1%

-:.2%

-:.:%

5nderstand the Process conte0t#
©ISACA2014

Allrightsreserved

33


IT Audit and Assurance Program for European Cybersecurity Phase B—-nderstand Enab(ers4 etting uitab(e Assessment Criteria and Perform the Asses Processes involved during the assurance engagement'

-:.4%

APO&1 6anage ris'sta#eholders' 5nderstand the Process goa(sand related  metrics and define e/"ected 6rocess values criteria!+ and assess )hether the 6rocess goals are achieved+ i.e.+ assess the effectiveness of the "rocess. $he 6rocess APO&1 6anage ris'has 4 defined "rocess goals. Pr o ce s s$ o a(

$he follo)ing activities can %e "erformed to assess )hether the goals are achieved. " e (a t

C r i t e r i a + E 0 p e ct e d < a ( u e

As s e s s m e n t  t e p

ed 6etri cs I$-related ris# is identified+ analysed+ managed and re"orted. -:.4% Cont.



D e g r e e o f v i s i % il it y a n d r e c o g n it i o n i n t


In this step the related metrics for each be re#ie"ed and an assessment "ill be "hether the defined criteria are achie#e

 9or CI$ 3 "rocesses+ a set of goals and metrics are identified in COBIT 5& Enabling Processes.

©ISACA2014

Allrightsreserved

34


IT Audit and Assurance Program for European Cybersecurity Phase B—-nderstand Enab(ers4 etting uitab(e Assessment Criteria and Perform the Asses Processes h e c u r r e n t e n v ir o n m e n t 

( u m % e r o f l o s s e v e n ts ) it h # e y c h a r

©ISACA2014

Allrightsreserved

35


IT Audit and Assurance Program for European Cybersecurity Phase B—-nderstand Enab(ers4 etting uitab(e Assessment Criteria and Perform the Asses Processes a c t e ri s ti c s c a " t u r e d i n r e " o s it o ri e s 

6 e r c e n to f a u d it s + e v e

©ISACA2014

Allrightsreserved

36


IT Audit and Assurance Program for European Cybersecurity Phase B—-nderstand Enab(ers4 etting uitab(e Assessment Criteria and Perform the Asses Processes n t s a n d tr e n d s c a " t u r e d i n r e " o s it o ri e s A current and com"lete ris# "rofile e/ists. In this step the related metrics for each  6 Agree on the e+pected #alues for the Process goal metrics i!e! the #alues be re#ie"ed and an assessment "ill be e against "hich the assessment "ill "hether the defined criteria are achie#e r ta)e place! c e n t o f # e y % u s

©ISACA2014

Allrightsreserved

37


IT Audit and Assurance Program for European Cybersecurity Phase B—-nderstand Enab(ers4 etting uitab(e Assessment Criteria and Perform the Asses Processes i n e s s " r o c e s s e s i n c l u d e d i n t h e ri s # " r o fi l e 

©ISACA2014

C o m " l e t e n e s

Allrightsreserved

38


IT Audit and Assurance Program for European Cybersecurity Phase B—-nderstand Enab(ers4 etting uitab(e Assessment Criteria and Perform the Asses Processes s o f a tt ri % u t e s a n d v a l u e s i n t h e ri s # " r o fi l e All significant ris# management actions are In this step the related metrics for each  6 Agree on the e+pected #alues for the managed and under control. Process goal metrics i!e! the #alues be re#ie"ed and an assessment "ill be e against "hich the assessment "ill "hether the defined criteria are achie#e r ta)e place! c e n t o f ri s #

©ISACA2014

Allrightsreserved

39


IT Audit and Assurance Program for European Cybersecurity Phase B—-nderstand Enab(ers4 etting uitab(e Assessment Criteria and Perform the Asses Processes m a n a g e m e n t " r o " o s a l s r e & e c t e d d u e t o l a c # o f c o n s i d e r a

©ISACA2014

Allrightsreserved

40


IT Audit and Assurance Program for European Cybersecurity Phase B—-nderstand Enab(ers4 etting uitab(e Assessment Criteria and Perform the Asses Processes ti o n o f o t h e r r e l a t e d ri s # 

( u m % e r o f s i g n if i c a n t i n c i d e n t s

©ISACA2014

Allrightsreserved

41


IT Audit and Assurance Program for European Cybersecurity Phase B—-nderstand Enab(ers4 etting uitab(e Assessment Criteria and Perform the Asses Processes n o t i d e n ti fi e d a n d i n c l u d e d i n t h e ri s # m a n a g e m e n t " o rt f o li o

©ISACA2014

Allrightsreserved

42


IT Audit and Assurance Program for European Cybersecurity Phase B—-nderstand Enab(ers4 etting uitab(e Assessment Criteria and Perform the Asses Processes is# management actions are im"lemented In this step the related metrics for each  6 Agree on the e+pected #alues for the effectively. Process goal metrics i!e! the #alues be re#ie"ed and an assessment "ill be e against "hich the assessment "ill "hether the defined criteria are achie#e r ta)e place! c e n t o f I $ ri s # a c ti o n " l a n s e / e c u t e d a s d e s i g n e d 

©ISACA2014

( u m %

Allrightsreserved

43


IT Audit and Assurance Program for European Cybersecurity Phase B—-nderstand Enab(ers4 etting uitab(e Assessment Criteria and Perform the Asses Processes e r o f m e a s u r e s n o t r e d u c i n g r e s i d u a l ri s # -:.3%

Agree on suita%le criteria to evaluate all "rocesses in sco"e of the assurance engagement' Define and agree on the reference "rocess+ i.e.+ determine )hich %ase "ractices a "rocess should at least include. $his usually is &ust a confirmation of the CI$ 3 "rocesses already identified+ unless there is reason for using a different reference "rocess.! Agree on the "rocess "ractices that should %e in "lace "rocess design!. Assess the process design+ i.e.+ assess to )hat e/tent'

©ISACA2014

Allrightsreserved

44


IT Audit and Assurance Program for European Cybersecurity Phase B—-nderstand Enab(ers4 etting uitab(e Assessment Criteria and Perform the Asses Processes  */"ected "rocess "ractices are a""lied. Accounta%ility and res"onsi%ility are assigned and assumed. COBIT 5 Processesare descri%ed in COBIT 5& Enabling Processes. *ach 6rocess re,uires a num%er of management "ractices to %e im"lemented+ as descri%ed in the "rocess descri"tion in the same guide. $hese are'

-:.3% Cont.






$he reference against )hich the "rocess )ill %e assessed in "hase  )ith the criteria as mentioned+ i.e.+ all management "ractices are e/"ected to %e fully im"lemented. "eference Process

"eference Process Practices DataClassification


A61 2
Criteria' Control activities to manage ris# are "ro"erly im"lemented..

Assessment tep



Ins"ect and revie) the general data classification method and scheme used enter"rise.



evie) the cy%ersecurity-related classification "arameters used in the data classification.

ed in the gener al data classif ication . usin ess

©ISACA2014

Allrightsreserved

45



-:.3% Cont. InformationAssetInventory

Attac# @istory and ?essons ?earned

Phase B—-nderstand Enab(ers4 etting uitab(e Assessment Criteria and Perform the Asses Processes critical inform ation assets are ade,u ately classif ied )ith regard to cy%ers ecurity . $he  Ins"ect and revie) the information asset inventory for com"leteness and accu enter"  evie) the cy%ersecurity-related criteria and "arameters for information asset rise recorded in the inventory. maint ains an inform ation asset invent ory )ith ade,u ate cy%ers ecurity criteri a. $he enter" rise has duly record ed and analys ed all "revio us attac# s.

©ISACA2014

Allrightsreserved



%tain and revie) sam"les of "revious attac#s and incidents.



Determine+ on a high-level %asis+ )hether all attac#s and incidents have %een identified+ recorded and documented.

46



Attac# and Incident Analysis

ey ?earnings

©ISACA2014

Phase B—-nderstand Enab(ers4 etting uitab(e Assessment Criteria and Perform the Asses Processes ?esso ns learne d have %een docu mente d and are a""lie d to critical inform ation assets . Attac#  */amine the methods of analysis a""lied to the attac# and incident history. s and  %tain and revie) sam"les of attac# and incident analysis. incide nts are analys ed in a formal and com"r ehensi ve mann er. ?esso  ased on the sam"les for documentation and analysis+ revie) the method of ns identifying lessons learnt and "otential im"rovements to cy%ersecurity. learne  Determine )hether "otential im"rovements are formulated in a reasona%le+ d and com"rehensive and understanda%le manner. "otent ial im"ro veme nts are identifi ed and ade,u ately

Allrightsreserved

47



Im"rovements in Information Asset 6rotection

A612.01 Collect data

A612.02 Analyse ris#

©ISACA2014

Phase B—-nderstand Enab(ers4 etting uitab(e Assessment Criteria and Perform the Asses Processes docu mente d. ey  ased on the sam"les for documentation and analysis+ determine )hether learni im"rovements have %een im"lemented. ngs  Determine )hether im"rovements are im"lemented continuously and consiste and throughout the enter"rise. im"ro veme nts are im"le mente d in a contin uous and consis tent mann er. Identif y and collect releva nt data to ena%l e effecti ve I$relate d ris# identifi cation+ analys is and re"orti ng. Devel o" useful inform ation to

Allrightsreserved



Cy%ersecurity is su%&ect to routine ris# assessment "rocesses.





Determine )hether a ris# assessment of cy%erthreats+ vulnera%ilities and %usi related ris# $8A! )as "erformed %efore acce"tance of the "rogram.



%tain and revie) ris# assessment documentation+ if availa%le+ to determine the control level is ade,uate to su""ort the cy%ersecurity "rogram.



%tain %oard minutes or other documentation to su""ort the a""roval of the ri assessment and any formal ris# acce"tances.



%tain and revie) the relevant ris# assessment documentation to determine the ris# assessment sco"e is' a! ade,uate to su""ort the changes in the cy%ersecurity "rogram+ and %! sufficient to "rotect the organisation a""ro"riat in line )ith %usiness ris# a""etite.

48



A612.0:
Phase B—-nderstand Enab(ers4 etting uitab(e Assessment Criteria and Perform the Asses Processes su""o rt ris# decisi ons that ta#e into accou nt the %usine ss releva nce of ris# factor s.
©ISACA2014

Allrightsreserved

49



A612.04 Articulate ris#

A612.03 Define a ris# management action "ortfolio

©ISACA2014

Phase B—-nderstand Enab(ers4 etting uitab(e Assessment Criteria and Perform the Asses Processes t contro l activiti es. 6rovid Assess %y a""lying a""ro"riate audit techni,ues intervie)+ o%servation+ testing! e the management "ractice is effectively im"lemented. inform ation 1. e"ort the results of ris# analysis to all affected sta#eholders in terms and for on the useful to su""ort enter"rise decisions. Fherever "ossi%le+ include "ro%a%ilities a curren ranges of loss or gain along )ith confidence levels that ena%le management to % t state ris#-return. of I$2. 6rovide decision ma#ers )ith an understanding of )orst-case and most-"ro%a relate scenarios+ due diligence e/"osures+ and significant re"utation+ legal or regulatory d considerations. e/"os :. e"ort the current ris# "rofile to all sta#eholders+ including effectiveness of the ures management "rocess+ control effectiveness+ ga"s+ i nconsistencies+ redundancies and remediation status+ and their im"acts on the ris# "rofile. o""ort 4. evie) the results of o%&ective third-"arty assessments+ internal audit and ,ual unities assurance revie)s+ and ma" them to the ris# "rofile. evie) identified ga"s and in a e/"osures to determine the need for additional ris# analysis. timely 3. n a "eriodic %asis+ for areas )ith relative ris# and ris# ca"acity "arity+ identify mann related o""ortunities that )ould allo) the acce"tance of greater ris# and enhance er to and return. all re,uir ed sta#eh olders for a""ro "riate res"o nse.
Allrightsreserved

the management "ractice is effectively im"lemented.

50


IT Audit and Assurance Program for European Cybersecurity Phase B—-nderstand Enab(ers4 etting uitab(e Assessment Criteria and Perform the Asses Processes io. es"o  is# assessments are conducted after incidents. nd in  Determine )hether any su%se,uent ris# assessment has %een "erformed as a of actual cy%erattac#s or %reaches+ including near misses. timely

A612.0 es"ond to ris#

mann er )ith effecti ve meas ures to limit the magni tude of loss from I$relate d events . -:.%

5

Agree on the process .or' products in"uts and out"uts as defined in the "rocess "ractices descri"tion! that are e/"ected to %e "resent "rocess design!. Assess to )hat e/tent the "rocess )or# "roducts are availa%le. APO&1 6anage ris'in"uts and out"uts. $he most relevant and not assessed as Information items in sco"e in section A-:.3! of these )or# "roducts are identified as follo)s+ as )ell as the criteria against )hich they )ill %e assessed+ i.e.+ e/istence and usage. P r o ce s s P r a c t ic e G6rocess or 6ractice (ameH

-:.>%




,o r ' P r o d u ct s ?ist )or# "roducts no included in the information items section.

As s e s s m e n tt A""ly a""ro"riate audi techni,ues to determin e/istence and a""ro"ri of each )or# "roduct.

Agree on the process capabi(ity (e!e(to %e achieved %y the "rocess. This step is "arranted only if the process under re#ie" is a standard COBIT 5 go#ernance or management process to


©ISACA2014

Allrightsreserved

51


IT Audit and Assurance Program for European Cybersecurity Phase B—-nderstand Enab(ers4 etting uitab(e Assessment Criteria and Perform the Asses Processes "hich the I1O/IEC 55.4 PA can be applied! Any other processes for "hich no reference practices "or) products or outcomes are appro#ed cannot use this assessment method6 therefore the concept capability le#el does not apply! APO&3 6anage security -:.1c

-:.2c

-:.:c

-:.4c

5nderstand the Process conte0t# $he information security management system IS
$he follo)ing activities can %e "erformed to assess )hether the goals are achieved. " e( at ed

C r i t e r i a + E 0 p e ct e d < a ( u e

As s e s s m e n tt ep

% 9or CI$ 3 "rocesses+ a set of goals and metrics are identified in COBIT 5& Enabling Processes.

©ISACA2014

Allrightsreserved

52


IT Audit and Assurance Program for European Cybersecurity Phase B—-nderstand Enab(ers4 etting uitab(e Assessment Criteria and Perform the Asses Processes 6 et ric s A system is in "lace that considers and Agree on the e+pected #alues for the In this step the related metrics for each go  effectively addresses enter"rise information Process goal metrics i!e! the #alues re#ie"ed and an assessment "ill be made ( security re,uirements. against "hich the assessment "ill ta)e the defined criteria are achie#ed! place! 

( A security "lan has %een esta%lished+ acce"ted and communicated throughout the enter"rise.



?e 


In this step the related metrics for each go re#ie"ed and an assessment "ill be made the defined criteria are achie#ed!



( -:.4c Cont.



( Information security solutions are im"lemented and o"erated consistently throughout the enter"rise.



( 

( 

( -:.3c

Agree on suita%le criteria to evaluate all "rocesses in sco"e of the assurance engagement' Define and agree on the reference "rocess+ i.e.+ determine )hich %ase "ractices a "rocess should at least of include. $his usually is &ust a confirmation the CI$ 3 "rocesses already identified+ unless there is reason for using a different reference "rocess.! Agree on the "rocess "ractices that should %e in "lace "rocess design!. Assess the process design+ i.e.+ assess to )hat e/tent' */"ected "rocess "ractices are a""lied. Accounta%ility and res"onsi%ility are assigned and assumed. COBIT 5 Processesare descri%ed in COBIT 5& Enabling Processes. *ach 

©ISACA2014


Allrightsreserved

53


IT Audit and Assurance Program for European Cybersecurity Phase B—-nderstand Enab(ers4 etting uitab(e Assessment Criteria and Perform the Asses Processes 6rocess re,uires a num%er of management "ractices to %e im"lemented+ as descri%ed in the "rocess descri"tion in the same guide. $hese are' 





"eference Process Practices

-:.3c Cont.

$argetAccessi%ility

$arget 8alue

$argetAttractiveness

©ISACA2014

A61 :
Allrightsreserved

Criteria' Control activities to manage security are "ro"erly im"lemented.

Assessment tep



9or all critical information assets+ revie) the identity and access management arrangements.



Determine )hether access "rivileges for "otential targets are aligned )ith %usi needs and asset criticality



%tain and revie) the inventory of %usiness critical information assets.



Determine )hether the enter"rise has identified "otential target information as may %e e/"osed to cy%ercrime and cy%er)arfare.

Assess %y a""lying a""ro"riate audit techni,ues intervie)+ o%servation+ testing! the management "ractice is effectively im"lemented.

54


IT Audit and Assurance Program for European Cybersecurity Phase B—-nderstand Enab(ers4 etting uitab(e Assessment Criteria and Perform the Asses Processes mech anism s for recog niing+ meas uring and contro lling target attract ivenes s. A61:.01 *sta%lish and maintain an *sta%l  Cy%ersecurity is su%&ect to a com"rehensive cycle of 6lan-Do-Chec#-Act 6D information security management system ish  Determine )hether cy%ersecurity "rocesses are integrated )ith the overarchin IS
©ISACA2014

Allrightsreserved



*sta%lish the "resence of 6DCA in all cy%ersecurity "rocesses.

55



A61:.02 Define and manage an information security ris# treatment "lan

©ISACA2014

Phase B—-nderstand Enab(ers4 etting uitab(e Assessment Criteria and Perform the Asses Processes are aligne d )ith %usine ss re,uir ement s and enter" rise securit y mana geme nt.
Allrightsreserved

56


IT Audit and Assurance Program for European Cybersecurity Phase B—-nderstand Enab(ers4 etting uitab(e Assessment Criteria and Perform the Asses Processes mend ations for im"le menti ng securit y im"ro veme nts are %ased on a""ro ved %usine ss cases and im"le mente d as an integr al "art of servic es and solutio ns develo "ment + then o"erat ed as an integr al "art of %usine ss o"erat ion. A61:.0:
©ISACA2014

Allrightsreserved

57


IT Audit and Assurance Program for European Cybersecurity Phase B—-nderstand Enab(ers4 etting uitab(e Assessment Criteria and Perform the Asses Processes comm  Determine )hether the enter"rise o"erates an ade,uate and com"rehensive unicat monitoring "rocess for cy%ersecurity-related events and incidents. e the  %tain and revie) sam"les of o"erational monitoring. need for+ and %enefi ts of+ contin uous inform ation securit y im"ro veme nt. Collec t and analys e data a%out the IS
©ISACA2014

Allrightsreserved

58


IT Audit and Assurance Program for European Cybersecurity Phase B—-nderstand Enab(ers4 etting uitab(e Assessment Criteria and Perform the Asses Processes im"ro veme nt. -:.c

-:.c Cont.

:

Agree on the process .or' products in"uts and out"uts as defined in the "rocess "ractices descri"tion! that are e/"ected to %e "resent "rocess design!. Assess to )hat e/tent the "rocess )or# "roducts are availa%le. 6rocess APO&3 6anage securityin"uts and out"uts. $he most relevant and not assessed as Information items in sco"e in section A-:.3! of these )or# "roducts are identified as follo)s+ as )ell as the criteria against )hich they )ill %e assessed+ i.e.+ e/istence and usage. Pr o ces sPr act ice G6rocess or 6ractice (ameH


,o r ' P r o d u ct s 

?ist )or# "roducts no included in the information items section.

As s es s m en t te A""ly a""ro"riate audit techni,ues to determine t e/istence and a""ro"riat each )or# "roduct.

-:.>c

Agree on the process capabi(ity (e!e(to %e achieved %y the "rocess. This step is "arranted only if the process under re#ie" is a standard COBIT 5 go#ernance or management process to "hich the I1O/IEC 55.4 PA can be applied! Any other processes for "hich no reference practices "or) products or outcomes are appro#ed cannot use this assessment method6 therefore the concept capability le#el does not apply! D81 6anage Incidents and er!ice "euests -:.1d -:.2d

-:.:d

5nderstand the Process conte0t# Incidents in cy%ersecurity should %e identified and managed. 5nderstand the Process purpose# Achieve increased "roductivity and minimise disru"tions through ,uic# resolution of user ,ueries and incidents. 5nderstand all "rocess sta'eho(dersand their roles. $his is e,uivalent to understanding the real ACI chart of the "rocess in COBIT 5& Enabling Processes page 87. 'e#erage the COBIT 5 3ACI charts for the processes in scope to identify any

: 9or CI$ 3 "rocesses+ a set of in"uts and out"uts for the different management "ractices are identified in COBIT 5& Enabling Processes.

©ISACA2014

Allrightsreserved

59


IT Audit and Assurance Program for European Cybersecurity Phase B—-nderstand Enab(ers4 etting uitab(e Assessment Criteria and Perform the Asses Processes additional sta)eholders that "ill need to be in#ol#ed in the assessment! In this assurance step the translation is made bet"een the theoretical 3ACI chart entry and the real enterprise! $he sta#eholders of the "rocess are already defined in the ACI chart as a result of ste" A-:.:. In addition to those sta#eholders+ this "rocess relies also on the follo)ing functions!+ )hich therefore )ill need to %e involved during the assurance engagement'

-:.4d

D81 6anage Incidents and er!ice "euestssta#eholders' 5nderstand the Process goa(sand related 8 metrics and define e/"ected 6rocess values criteria!+ and assess )hether the 6rocess goals are achieved+ i.e.+ assess the effectiveness of the "rocess. $he 6rocess D81 6anage Incidents and er!ice "euestshas : defined "rocess goals. Pr o ce s s$ o a(

-:.4d Cont.

I$-related services are availa%le for use.

$he follo)ing activities can %e "erformed to assess )hether the goals are achieved.

" e ( a t e d 6 e tr i c s 

( 

C r it e r ia + E0 p e c t e d < a (u e

As s e s s me n tt ep



Agree on the e+pected #alues for the Process goal metrics i!e! the #alues against "hich the assessment "ill ta)e place! Agree on the e+pected #alues for the Process goal metrics i!e! the #alues against "hich the assessment "ill ta)e place!


< Incidents are resolved according to agreedon service levels.

Service re,uests are dealt )ith according to agreed-on service levels and to the satisfaction of users.



6e



?e 


<


©ISACA2014

Allrightsreserved

60


IT Audit and Assurance Program for European Cybersecurity Phase B—-nderstand Enab(ers4 etting uitab(e Assessment Criteria and Perform the Asses Processes -:.3d

Agree on suita%le criteria to evaluate all "rocesses in sco"e of the assurance engagement' Define and agree on the reference "rocess+ i.e.+ determine )hich %ase "ractices a "rocess should at least include. $his usually is &ust a confirmation of the CI$ 3 "rocesses already identified+ unless there is reason for using a different reference "rocess.! Agree on the "rocess "ractices that should %e in "lace "rocess design!. Assess the process design+ i.e.+ assess to )hat e/tent' */"ected "rocess "ractices are a""lied. Accounta%ility and res"onsi%ility are assigned and assumed. COBIT 5 Processesare descri%ed in COBIT 5& Enabling Processes. *ach 6rocess re,uires a num%er of management "ractices to %e im"lemented+ as descri%ed in the "rocess descri"tion in the same guide. $hese are' 







-:.3d Cont.

"eference Process Practices DSS02.01 Define incident and service re,uest classification schemes

©ISACA2014


DSS0 2
Allrightsreserved

Criteria' Control activities to manage incidents and service re,uests are "ro"erly im"lemented.

Assessment tep



Incident Classification and *scalation' Cy%ersecurity incidents are ade,uately classified and a""ro"riately escalated in line )ith the classification.



%tain and revie) "rocedures and sam"les of incidents+ and ascertain that all incidents are classified in a formal and consistent manner.



evie) the escalation "ath and stages for incidents+ %ased on the e/isting classification.

61


IT Audit and Assurance Program for European Cybersecurity Phase B—-nderstand Enab(ers4 etting uitab(e Assessment Criteria and Perform the Asses Processes and model s. DSS02.02 ecord+ classify and "rioritise Identif  Incident Classification and *scalation' Cy%ersecurity incidents are ade,uately re,uests and incidents y+ classified and a""ro"riately escalated in line )ith the classification. record  evie) the escalation "ath and stages for incidents+ %ased on the e/isting and classification. classif

DSS02.0: 8erify+ a""rove and fulfil service re,uests

y servic e re,ue sts and incide nts+ and assign a "riorit y accor ding to %usine ss critical ity and servic e agree ments . Select the a""ro "riate re,ue st "roce dures and verify that the servic e re,ue sts fulfil define d re,ue st criteri a.

©ISACA2014

Allrightsreserved



8erify entitlement for service re,uests using+ )here "ossi%le+ a "redefined "ro flo) and standard changes.



%tain financial and functional a""roval or sign-off+ if re,uired+ or "redefined a for agreed-on standard changes.



9ulfil the re,uests %y "erforming the selected re,uest "rocedure+ using+ )here "ossi%le+ self-hel" automated menus and "redefined re,uest models for fre,u re,uested items.

62



DSS02.04 Investigate+ diagnose and allocate incidents

DSS02.03 esolve and recover from incidents

DSS02.0 Close service re,uests and incidents

©ISACA2014

Phase B—-nderstand Enab(ers4 etting uitab(e Assessment Criteria and Perform the Asses Processes %tain a""ro val+ if re,uir ed+ and fulfil the re,ue sts. Identif  Cy%ersecurity incidents are investigated and diagnosed in line )ith the classifi y and  Determine )hether any and all incidents are duly investigated+ %ased on the record classification and severity of each incident. incide  %tain and revie) the method and sam"les of incident diagnostics irres"ectiv nt sym"t investigative )or#!. oms+ Determine )hether incident diagnostics are "erformed at an ade,uate level of  deter technical de"th and understanding. mine  Fhere third-"arty services are used in incident i nvestigation and diagnostics+ "ossi% determine )hether the enter"rise has ade,uate control over these "roviders le cause s+ and allocat e for resolu tion. Docu ment+ a""ly and test the identifi ed solutio ns or )or#a round s and "erfor m recov ery action s to restor e the I$relate d servic e. 8erify satisfa

Allrightsreserved

Assess %y a""lying a""ro"riate audit techni,ues intervie)+ o%servation+ testing! the management "ractice is effectively im"lemented 1. Select and a""ly the most a""ro"riate incident resolutions tem"orary )or#arou andor "ermanent solution!. 2. ecord )hether )or#arounds )ere used for incident resolution. :. 6erform recovery actions+ if re,uired. 4. Document incident resolution and assess if the resolution can %e used as a futu #no)ledge source.

Assess %y a""lying a""ro"riate audit techni,ues intervie)+ o%servation+ testing! the management "ractice is effectively im"lemented

63


IT Audit and Assurance Program for European Cybersecurity Phase B—-nderstand Enab(ers4 etting uitab(e Assessment Criteria and Perform the Asses Processes ctory incide 1. 8erify )ith the affected users if agreed on! that the service re,uest has %een nt satisfactory fulfilled or the incident has %een satisfactory resolved. resolu 2. Close service re,uests and incidents. tion andor re,ue st fulfilm ent+ and close. DSS02.0> $rac# status and "roduce re"orts egul Assess %y a""lying a""ro"riate audit techni,ues intervie)+ o%servation+ testing! arly the management "ractice is effectively im"lemented trac#+ analys 1.
-:.>d

$

Agree on the process .or' products in"uts and out"uts as defined in the "rocess "ractices descri"tion! that are e/"ected to %e "resent "rocess design!. Assess to )hat e/tent the "rocess )or# "roducts are availa%le. 6rocess D81 6anage Incidents and er!ice "euestsin"uts and out"uts. $he most relevant and not assessed as Information items in sco"e in section A-:.3! of these )or# "roducts are identified as follo)s+ as )ell as the criteria against )hich they )ill %e assessed+ i.e.+ e/istence and usage. Pr o ces sPr act ice G6rocess or 6ractice (ameH





Agree on the process capabi(ity (e!e(to %e achieved %y the "rocess.

$ 9or CI$ 3 "rocesses+ a set of in"uts and out"uts for the different management "ractices are identified in COBIT 5& Enabling Processes.

©ISACA2014

Allrightsreserved

64


IT Audit and Assurance Program for European Cybersecurity Phase B—-nderstand Enab(ers4 etting uitab(e Assessment Criteria and Perform the Asses Processes This step is "arranted only if the process under re#ie" is a standard COBIT 5 go#ernance or management process to "hich the I1O/IEC 55.4 PA can be applied! Any other processes for "hich no reference practices "or) products or outcomes are appro#ed cannot use this assessment method6 therefore the concept capability le#el does not apply! D8= 6anage Continuity -:.1e -:.2e

-:.:e

-:.4e

-:.4e Cont.

5nderstand the Process conte0t# rganisational functions and I$ should %e resilient )ith regard to cy%ersecurity 5nderstand the Process purpose# Continue critical %usiness o"erations and maintain availa%ility of information at a level acce"ta%le to the enter"rise in the event of a significant disru"tion. 5nderstand all "rocess sta'eho(dersand their roles. $his is e,uivalent to understanding the real ACI chart of the "rocess in COBIT 5& Enabling Processes page 79. 'e#erage the COBIT 5 3ACI charts for the processes in scope to identify any additional sta)eholders that "ill need to be in#ol#ed in the assessment! In this assurance step the translation is made bet"een the theoretical 3ACI chart entry and the real enterprise! $he sta#eholders of the "rocess are already defined in the ACI chart as a result of ste" A-:.:. In addition to those sta#eholders+ this "rocess relies also on the follo)ing functions!+ )hich therefore )ill need to %e involved during the assurance engagement' D8= 6anage Continuitysta#eholders' 5nderstand the Process goa(sand related 10 metrics and define e/"ected 6rocess values criteria!+ and assess )hether the 6rocess goals are achieved+ i.e.+ assess the effectiveness of the "rocess. $he 6rocess D8= 6anage Continuity has 3 defined "rocess goals. Pr o ce s s$ o a(

$he follo)ing activities can %e "erformed to assess )hether the goals are achieved. " e ( a t e d 6 e tr




©ISACA2014

Allrightsreserved

65


IT Audit and Assurance Program for European Cybersecurity Phase B—-nderstand Enab(ers4 etting uitab(e Assessment Criteria and Perform the Asses Processes i c s usiness-critical information is availa%le to Agree on the e+pected #alues for the In this step the related metrics for each go  the %usiness in line )ith minimum re,uired re#ie"ed and an assessment "ill be made 6e Process goal metrics i!e! the #alues service levels. against "hich the assessment "ill ta)e the defined criteria are achie#ed! place! 

6e 

6e Sufficient resilience is in "lace for critical services.

( u m % e r o f c ri ti c al % u si n e s s s y



Agree on the e+pected #alues for the Process goal metrics i!e! the #alues

In this step the related metrics for each go re#ie"ed and an assessment "ill be made

st e m s n o t c o v e r e d % y t h e "l a n Service continuity tests have verified the effectiveness of the "lan.

©ISACA2014



(

Allrightsreserved

66


IT Audit and Assurance Program for European Cybersecurity Phase B—-nderstand Enab(ers4 etting uitab(e Assessment Criteria and Perform the Asses Processes against "hich the assessment "ill ta)e the defined criteria are achie#ed! place!  9r An u"-to-date continuity "lan reflects current %usiness re,uirements.



6e 



Agree ongoal the metrics e+pectedi!e! #alues for the Process the #alues against "hich the assessment "ill ta)e place!

In this step theanrelated metrics"ill forbe each go re#ie"ed and assessment made the defined criteria are achie#ed!

6e Internalin and "arties trained thee/ternal continuity "lan.have %een



6e 

6e -:.3e

Agree on suita%le criteria to evaluate all "rocesses in sco"e of the assurance engagement' Define and agree on the reference "rocess+ i.e.+ determine )hich %ase "ractices a "rocess should at least include. $his usually is &ust a confirmation of the CI$ 3 "rocesses already identified+ unless there is reason for using a different reference "rocess.! Agree on the "rocess "ractices that should %e in "lace "rocess design!. Assess the process design+ i.e.+ assess to )hat e/tent'

-:.3e Cont.

*/"ected "rocess "ractices are a""lied. Accounta%ility and res"onsi%ility are assigned and assumed.



COBIT 5 Processesare descri%ed in COBIT 5& Enabling Processes. *ach 6rocess re,uires a num%er of management "ractices to %e im"lemented+ as descri%ed in the "rocess descri"tion in the same guide. $hese are' 





"eference Process Practices DSS04.01 Define the %usiness continuity

©ISACA2014


DSS0 4
Allrightsreserved

Criteria' Control activities to manage continuity are "ro"erly im"lemented.

Assessment tep



$he continuity and resilience o%&ectives and sco"e have %een ade,uately defi

67



-:.3e Cont.

©ISACA2014

Phase B—-nderstand Enab(ers4 etting uitab(e Assessment Criteria and Perform the Asses Processes "olicy+o%&ectivesandsco"e %usine im"lemented. ss %tain and revie) the cy%ersecurity resilience or %usiness continuity o%&ective  contin stated %y the enter"rise. uity  %tain and revie) the cy%ersecurity resilience sco"e as stated %y the enter"ri "olicy  Determine )hether the enter"rise7s cy%ersecurity resilience sco"e and o%&ecti and aligned )ith good "ractice and that there are no significant ga"s. sco"e aligne  Confirm that the cy%ersecurity resilience sco"e and o%&ectives cover the *uro d )ith recommendations on resilience+ "articularly if "art of the enter"rise7s activities enter" related to a critical infrastructure. rise and sta#eh older o%&ecti ves. DSS04.02
Allrightsreserved

68


IT Audit and Assurance Program for European Cybersecurity Phase B—-nderstand Enab(ers4 etting uitab(e Assessment Criteria and Perform the Asses Processes tion. Devel  Continuity and recovery "lanning and res"onse o" a  8erify that all strategic o%&ectives and "rovisions have %een fully im"lemented %usine continuity  resilience "lans and related solutions. ss

DSS04.0: Develo" and im"lement a %usiness continuity res"onse

DSS04.04 */ercise+ test and revie) the C6

©ISACA2014

contin uity "lan C6! %ased on the strate gy that docu ments the "roce dures and inform ation in readin ess for use in an incide nt to ena%l e the enter" rise to contin ue its critical activiti es. $est the contin uity arrang ement s on a regula r %asis to e/erci se the recov ery "lans agains t "redet ermin ed

Allrightsreserved



%tain and revie) sam"les of cy%ersecurity-related resilience or continuity "la related solutions.



Cy%ersecurity testing and e/ercising



%tain and revie) the enter"rise7s cy%ersecurity testing and e/ercising strateg



%tain and revie) the enter"rise7s cy%ersecurity test and e/ercise "lan.



Determine )hether the testing and e/ercising regime is sufficiently com"rehen cover the needs and re,uirements of cy%ersecurity.



Determine )hether the testing and e/ercise regime is ade,uate i n terms of th enter"rise7s cy%ersecurity "rocess ca"a%ility levels maturity levels!.



%tain and revie) sam"les of test and e/ercise documentation and re"orts.

69


IT Audit and Assurance Program for European Cybersecurity Phase B—-nderstand Enab(ers4 etting uitab(e Assessment Criteria and Perform the Asses Processes outco mes and to allo) innova tive solutio ns to %e develo "ed and hel" to verify over time that the "lan )ill )or# as antici" ated. DSS04.03 evie)+ maintain and im"rove Condu  evie) the continuity "lan and ca"a%ility on a regular %asis against any assu the ct a made and current %usiness o"erational and strategic o%&ectives. continuity "lan mana  Consider )hether a revised %usiness im"act assessment may %e re,uired+ de geme on the nature of the change. nt revie) of the contin uity ca"a%i lity at regula r interv als to ensur e its contin ued suita%i lity+ ade,u acy and effecti venes s.
©ISACA2014

Allrightsreserved



ecommend and communicate changes in "olicy+ "lans+ "rocedures+ infrastru and roles and res"onsi%ilities for management a""roval and "rocessing via th management "rocess.



evie) the continuity "lan on a regular %asis to consider the im"act of ne) or changes to' enter"rise+ %usiness "rocesses+ outsourcing arrangements+ techn infrastructure+ o"erating systems and a""lication systems.

70


IT Audit and Assurance Program for European Cybersecurity Phase B—-nderstand Enab(ers4 etting uitab(e Assessment Criteria and Perform the Asses Processes dance )ith the chang e contro l "roce ss to ensur e that the contin uity "lan is #e"t u" to date and contin ually reflect s actual %usine ss re,uir ement s. DSS04.0 Conduct continuity "lan training 6rovid  Cy%ersecurity resilience training e all %tain and revie) any relevant training and education materials used %y the  conce enter"rise. rned  Determine )hether training contents+ fre,uency and o"erational success are intern al and ade,uate. e/tern al "artie s )ith regula r trainin g sessio ns regard ing the "roce dures and their roles and res"o nsi%ilit ies in case of

©ISACA2014

Allrightsreserved

71


IT Audit and Assurance Program for European Cybersecurity Phase B—-nderstand Enab(ers4 etting uitab(e Assessment Criteria and Perform the Asses Processes disru" tion. DSS04.0>
DSS04.0= Conduct "ost-resum"tion revie)

Asses s the ade,u acy of the C6 follo)i ng the



*nsure that systems+ a""lications+ data and documentation maintained or "roc %y third "arties are ade,uately %ac#ed u" or other)ise secured. Consider re, return of %ac#u"s from third "arties. Consider escro) or de"osit arrangements



Define re,uirements for on-site and off-site storage of %ac#u" data that meet t %usiness re,uirements. Consider the accessi%ility re,uired to %ac# u" data.



oll out C6 a)areness and training.



6eriodically test and refresh archived and %ac#u" data.



6ost-resum"tion revie)s



8erify that for all invocations of resilience "lans and measures+ "ost-resum"tio revie)s have %een "erformed %y the enter"rise.



%tain and revie) sam"les of "ost-resum"tion revie) documents

succe ssful resum "tion of %usine ss "roce sses and servic es after a disru" tion. -:.e

11

Agree on the process .or' products in"uts and out"uts as defined in the "rocess "ractices descri"tion! that are e/"ected to %e "resent "rocess design!. Assess to )hat e/tent the "rocess )or# "roducts are availa%le. 6rocess D8= 6anage Continuityin"uts and out"uts. $he most relevant and not



©ISACA2014

Allrightsreserved

72



-:.>e

Phase B—-nderstand Enab(ers4 etting uitab(e Assessment Criteria and Perform the Asses Processes assessed as Information items in sco"e in section A-:.3! of these )or# "roducts are identified as follo)s+ as )ell as the criteria against )hich they )ill %e assessed+ i.e.+ e/istence and usage. Pr o ces sPr act ice ,o r ' P r o d u ct s As s es s m en t te G6rocess or 6ractice (ameH A""ly a""ro"riate audit  ?ist )or# "roducts no included in the information items techni,ues to determine t section. e/istence and a""ro"riat each )or# "roduct. Agree on the process capabi(ity (e!e(to

%e achieved %y the "rocess. This step is "arranted only if the process under re#ie" is a standard COBIT 5 go#ernance or management process to "hich the I1O/IEC 55.4 PA can be applied! Any other processes for "hich no reference practices "or) products or outcomes are appro#ed cannot use this assessment method6 therefore the concept capability le#el does not apply! D85 6anage ecurity er!ices -:.1f

-:.2f

-:.:f

-:.4f

5nderstand the Process conte0t# 6rotect enter"rise information to maintain the level of information security ris# acce"ta%le to the enter"rise in accordance )ith the security "olicy. *sta%lish and maintain information security roles and access "rivileges and "erform security monitoring. 5nderstand the Process purpose#

©ISACA2014

Allrightsreserved

73


IT Audit and Assurance Program for European Cybersecurity Phase B—-nderstand Enab(ers4 etting uitab(e Assessment Criteria and Perform the Asses Processes the effectiveness of the "rocess. $he 6rocess D85 6anage ecurity er!ices has 3 defined "rocess goals. Pr o ce s s$ o a(

-:.4f Cont.

(et)or#s and communications security meet %usiness needs.

$he follo)ing activities can %e "erformed to assess )hether the goals are achieved. " e ( a t e d 6 e tr i c s ( u m % e r o f v ul n e r a %i lit ie s di





s c o v e r e d ( u m % e r o f fi r e ) al l % r e a c

©ISACA2014

Allrightsreserved

74


IT Audit and Assurance Program for European Cybersecurity Phase B—-nderstand Enab(ers4 etting uitab(e Assessment Criteria and Perform the Asses Processes h e s Information "rocessed on+ stored on and Agree on the e+pected #alues for the In this step the related metrics for each go  transmitted %y end"oint devices is re#ie"ed and an assessment "ill be made 6e Process goal metrics i!e! the #alues "rotected. against "hich the assessment "ill ta)e the defined criteria are achie#ed! place! 

( 

( All users are uni,uely identifia%le and have access rights in accordance )ith their %usiness role.



Av 







( 6hysical measures have %een im"lemented to "rotect information from unauthorised access+ damage and interference )hen %eing "rocessed+ stored or transmitted.



6e 

Av 

( *lectronic information is "ro"erly secured )hen stored+ transmitted or destroyed.

( u m % e ro f in ci d e n ts r el a ti n g t o u n a u t h o ri s e

©ISACA2014

Allrightsreserved

75


IT Audit and Assurance Program for European Cybersecurity Phase B—-nderstand Enab(ers4 etting uitab(e Assessment Criteria and Perform the Asses Processes d a c c e s s t o in f o r m a ti o n -:.3f

-:.3f Cont.

Agree on suita%le criteria to evaluate all "rocesses in sco"e of the assurance engagement' Define and agree on the reference "rocess+ i.e.+ determine )hich %ase "ractices a "rocess should at least include. $his usually is &ust a confirmation of the CI$ 3 "rocesses already identified+ unless there is reason for using a different reference "rocess.! Agree on the "rocess "ractices that should %e in "lace "rocess design!. Assess the process design+ i.e.+ assess to )hat e/tent' */"ected "rocess "ractices are a""lied. Accounta%ility and res"onsi%ility are assigned and assumed.



COBIT 5 Processesare descri%ed in COBIT 5& Enabling Processes. *ach 6rocess re,uires a num%er of management "ractices to %e im"lemented+ as descri%ed in the "rocess descri"tion in the same guide. $hese are' 





"eference Process Practices DSS03.01 6rotect against mal)are

©ISACA2014


DSS0 3
Allrightsreserved

Criteria' Control activities to manage security services are "ro"erly im"lemented.

Assessment tep



%tain and revie) the methods+ tools and "rocesses that the enter"rise o"era "rotect against mal)are.

76


IT Audit and Assurance Program for European Cybersecurity Phase B—-nderstand Enab(ers4 etting uitab(e Assessment Criteria and Perform the Asses Processes nt  8erify that mal)are "rotection tools and solutions are u" to date and continuo cy%ers maintained. ecurity  8erify that any "revious mal)are infections )ere analyed and used as #ey le servic for organisational im"rovement. es

-:.3f Cont.

have %een im"le mente d and are "erfor med in a contro lled and ade,u ate mann er.



8erify that the enter"rise uses local o)ned and o"erated! as )ell as third-"art mal)are "rotection mechanisms to achieve inde"endent "rotection.



8erify that the enter"rise is "erforming the follo)ing "ractices'







Incidental user+ mail! traffic is filtered against mal)are



*/"erts and end users are trained and informed a%out mal)are on a regular %

$he enter" rise7s I$ enviro nment is ade,u ately "rotec ted agains t mal)a re.

-:.3f Cont.

©ISACA2014

Im"le ment and maint ain "reve ntive+ detecti ve and correc tive meas ures in "lace es"e cially u"-todate securit y "atch es

Allrightsreserved

77



Cy%ersecuritytesting

Phase B—-nderstand Enab(ers4 etting uitab(e Assessment Criteria and Perform the Asses Processes and virus contro l! across the enter" rise to "rotec t inform ation syste ms and techn ology from mal)a re e.g.+ viruse s+ )orms + s"y)a re+ s"am! . Cy%er  %tain and revie) the testing arrangements and o%&ectives as stated %y the e securit 8erify that e/ternal "enetration testing %lac# and )hite %o/! is "erformed at re  y intervals. arrang  8erify that internal "enetration testing %lac# and )hite %o/! is "erformed at re ement s are intervals+ including simulated collusion and slee"er attac#s. tested  Determine enter"rise is using "lanning on at techni,ues )hether includingthe im"ersonation+ social or engineering etc.using! social attac# regula  8erify that in testing+ the enter"rise adheres to *uro"ean la)s and regulations r re"resent constraints on test sco"e and methods. Consult a""ro"riate legal as interv )here a""ro"riate als

-:.3f Cont.

DSS03.02
©ISACA2014

and using ade,u ate metho ds and techni ,ues 5se securit y meas ures and relate d mana geme nt "roce

Allrightsreserved

Assess %y a""lying a""ro"riate audit techni,ues intervie)+ o%servation+ testing! the management "ractice is effectively im"lemented 1. ased on ris# assessments and %usiness re,uirements+ esta%lish and maintain for security of connectivity. 2. Allo) only authorised devices to have access to cor"orate information and the enter"rise net)or#. Configure these devices to force "ass)ord entry. :. Im"lement net)or# filtering mechanisms+ such as fire)alls and intrusion detecti soft)are+ )ith a""ro"riate "olicies to control in%ound and out%ound traffic. 4. *ncry"t information in transit according to its classification. 3. A""ly a""roved security "rotocols to net)or# connectivity. . Configure net)or# e,ui"ment in a secure manner.

78



DSS03.0:
-:.3f Cont.

Phase B—-nderstand Enab(ers4 etting uitab(e Assessment Criteria and Perform the Asses Processes dures >. *sta%lish trusted mechanisms to su""ort the secure transmission and recei"t of to information. "rotec =. Carry out "eriodic "enetration testing to determine ade,uacy of net)or# "rotecti t . Carry out "eriodic testing of system security to determine ade,uacy of system inform "rotection. ation over all metho ds of conne ctivity. *nsur  8erify that the enter"rise has a com"lete inventory of connected end "oints+ in e that ED. end"o  %tain and revie) methods+ techni,ues+ tools and solutions that the enter"ris ints control and manage end "oint devices. e.g.+  8erify that end "oint vendor+ soft)are and a""  service advisories are read+ la"to" internalied and im"lemented on a regular %asis. + des#to  8erify that ade,uate "rotection e/ists against' "+  6ro/imity attac#s+ e.g. (9C+ luetooth+ F?A( server  ?o)er level+ o"erating system attac#s SI<+ te/t-%ased service commands etc + and other  6hysical du"lication of media mo%ile  6hysical tam"ering or modification and net)o r# device s or soft)a re! are secur ed at a level that is e,ual to or greate r than the define d securit y re,uir ement s of the inform ation "roce ssed+ stored or trans mitted .



$heft or destruction



no)n a"" or mo%ile o"sys issues and remediation latency



?o) level mass attac#s+ e.g. hard)are-%ased disa%ling of )hole classes of de



Determine )hether the enter"rise "erforms end "oint hardening to the desired "rotection and in line )ith cy%ersecurity needs and re,uirements.



Determine )hether the enter"rise utilies s"ecialied  hardened end "oints fo e/"osed use cases or high-ris# users.



Determine )hether the enter"rise has im"lemented end-to-end encry"tion da



rest+ data in flo)! for end "oint devices. Determine )hether the enter"rise has identified sensitive out"uts in line )ith t information classification.



%tain and revie) the enter"rise7s "rotective arrangements for sensitive out"u devices+ including'



6rotection of "rinted out"ut against casual "hotogra"hy



6erimeter countermeasures against 8an *c# attac# vector screen out"ut!



(et)or#-attached "rinter vulnera%ilities o"erating system and "rinter firm)are including redirect attac#s



Control+ )i"ing and "urging of autonomous out"ut device cache memory+ e.g. sensitive document images tem" files! in "rinter ,ueue



Inventory+ control and containment of "o"ular virtual out"ut devices such as generators! )ith #no)n issues and side channel ris#

Sensit ive inform ation

©ISACA2014

Allrightsreserved

79



-:.3f Cont.

Phase B—-nderstand Enab(ers4 etting uitab(e Assessment Criteria and Perform the Asses Processes out"ut s and relate d device s are "rotec ted agains t attac# s and %reac hes.

DSS03.04
©ISACA2014

Inform ation "roce ssed on+ stored on and trans mitted %y end"o int device s is "rotec ted. *nsur e that all users have inform ation acces s rights in accor dance )ith their %usine ss re,uir ement s and coordina te )ith %usine ss units that mana ge their

Allrightsreserved



%tain and revie) the identity and logical access arrangements for critical info assets.



8erify that cy%ersecurity re,uirements+ "arameters and criteria are i ncor"orate



overall identity and access management "rocess. 8erify that the "rinci"les of least "rivilegeJ and need to #no)J have %een im"lemented and are enforced.



Determine )hether the enter"rise e/tends its identity and logical access mana regime to third "arties )ith access to critical information assets.



%tain and revie) social control and verification mechanisms that the enter"ri esta%lished e.g. verifying identities+ tele"hone %ehavior etc.!



8erify that logging and monitoring of logical access events and attem"ts is suf com"rehensive to meet the needs and re,uirements of cy%ersecurity

80


IT Audit and Assurance Program for European Cybersecurity Phase B—-nderstand Enab(ers4 etting uitab(e Assessment Criteria and Perform the Asses Processes o)n acces s rights )ithin %usine ss "roce sses. 5ser identiti es are mana ged in line )ith cy%ers ecurity needs and re,uir ement s. ?ogica l acces s is restric ted to afford the desire d level of "rotec tion agains t attac# s and %reac hes. Asym metric or uncon ventio nal attac# s are "reve nted or contai ned. All users are uni,u

©ISACA2014

Allrightsreserved

81


IT Audit and Assurance Program for European Cybersecurity Phase B—-nderstand Enab(ers4 etting uitab(e Assessment Criteria and Perform the Asses Processes ely identifi a%le and have acces s rights in accor dance )ith their %usine ss role. DSS03.03
©ISACA2014

Allrightsreserved



estricting data transmission %et)een 


A""lying restrictive access and user "rivileges to the I$ side and the 


Introducing a "articularly conservative configuration of the 


estricting vendor maintenance! remote access to 
82


IT Audit and Assurance Program for European Cybersecurity Phase B—-nderstand Enab(ers4 etting uitab(e Assessment Criteria and Perform the Asses Processes logge d and monit ored. $his should a""ly to all "erso ns enteri ng the "remi ses+ includi ng staff+ tem"o rary staff+ clients + vendo rs+ visitor s or any other third "arty. uildi ng and faciliti es mana geme nt syste ms and their I$ interfa ces are ade,u ately "rotec ted agains t attac# s and %reac hes. 6hysic al I$ assets are

©ISACA2014

Allrightsreserved

83


IT Audit and Assurance Program for European Cybersecurity Phase B—-nderstand Enab(ers4 etting uitab(e Assessment Criteria and Perform the Asses Processes ade,u ately "rotec ted agains t loss or hi&ac#i ng.

DSS03.0
©ISACA2014

6hysic al meas ures have %een im"le mente d to "rotec t inform ation from unaut horie d acces s+ dama ge and interfe rence )hen %eing "roce ssed+ stored or trans mitted . *sta%l ish a""ro "riate "hysic al safeg uards+ accou nting "ractic es and invent ory mana geme nt over

Allrightsreserved

Assess %y a""lying a""ro"riate audit techni,ues intervie)+ o%servation+ testing! the management "ractice is effectively im"lemented 1. *sta%lish "rocedures to govern the recei"t+ use+ removal and dis"osal of s"ecia and out"ut devices into+ )ithin and out of the enter"rise. 2. Assign access "rivileges to sensitive documents and out"ut devices %ased on t "rivilege "rinci"le+ %alancing ris# and %usiness re,uirements. :. *sta%lish an inventory of sensitive documents and out"ut devices+ and conduct reconciliations. 4. *sta%lish a""ro"riate "hysical safeguards over s"ecial forms and sensitive devi 3. Destroy sensitive information and "rotect out"ut devices e.g.+ degaussing of el media+ "hysical destruction of memory devices+ ma#ing shredders or loc#ed "a"er availa%le to destroy s"ecial forms and other confidential "a"ers!.

84


IT Audit and Assurance Program for European Cybersecurity Phase B—-nderstand Enab(ers4 etting uitab(e Assessment Criteria and Perform the Asses Processes sensiti ve I$ assets + such as s"ecia l forms+ negoti a%le instru ments + s"ecia l"ur"o se "rinter s or securit y to#ens . DSS03.0>
©ISACA2014

Allrightsreserved

85



9orcedCloud5tiliation

IndustrialControlSystems

©ISACA2014

Phase B—-nderstand Enab(ers4 etting uitab(e Assessment Criteria and Perform the Asses Processes the and that any e/ce"tions are su""orted %y a formal ris# acce"tance. third 8erify that contract and delivery &urisdictions "rovide an ade,uate level of "red  "arty and relia%ility )ith regard to cy%ersecurity and "otential litigation. Consult )ith clearly assistance )here a""ro"riate. state levels of cy%ers ecurity to %e deliver ed. Contr act &urisdi ction is #no)n and contro lled Fhere %tain and revie) the enter"rise7s list of cloud services and a""s that are man  cloud %y vendors or o"erating system distri%utors. use is  Determine )hether the enter"rise has ta#en ade,uate ste"s to mitigate the ris com" threats arising from forced cloud utiliation+ %oth at the enter"rise and at the e ulsory level. or enforc ed %y third "artie s+ ade,u ate "rotec tion mech anism s are in "lace to "reve nt attac# s or %reac hes Indust rial contro l syste ms and their I$ interfa ces are ade,u ately

Allrightsreserved



%tain and revie) the enter"rise7s inventory of #no)n and defined interfaces standard I$ and industrial control systems.



Determine )hether the enter"rise has ta#en ade,uate ste"s to "rotect industri control systems+ for instance through'



estricting access to ICS to read-only



estricting data transmission %et)een ICS and standard I$ to flat file formats+ ASCII+ CS8 etc.



Defining a restricted dataset field ma""ing! to %e made availa%le %y the ICS



A""lying restrictive access and no "rivileges )hen remotely accessing ICSL re full access to ICS to local ?A(! "ro/imity connections



estricting vendor maintenance! remote access to ICS

86



Critical A""lications in 6roduction

Phase B—-nderstand Enab(ers4 etting uitab(e Assessment Criteria and Perform the Asses Processes "rotec ted agains t attac# s and %reac hes. 6rodu  %tain and revie) the list of a""lications classified as critical )ith regard to ctive cy%ersecurity. critical  %tain and revie) the documented cy%ersecurity arrangements for critical a"" a""lic as stated %y the enter"rise. ations  Determine )hether the enter"rise has enca"sulated and segregated critical are ade,u a""lications+ for instance through' ately  Se"aration from non-critical net)or# to"ology "rotec  Se"aration from net)or# segments )ith e/ternal net)or# connectivity ted agains t attac# s and %reac hes Critica l a""lic ations develo "ment is ade,u ately design ed to

CriticalA""licationD evelo"ment

*lectronic information is "ro"erly secured )hen stored+ transmitted or destroyed.

-:.f

"rotec t agains t attac# s and %reac hes. (um% er of incide nts relatin g to unaut horie d acces s to inform ation



Dedicated  hardened server "latform



Inde"endent or non-standard o"erating systems )ith hardened security featur s"ecific 5ni/ distri%utions!



8irtualied sand%o/ed! runtime environment for a""lication+ segregated data facility



%tain and revie) the list of a""lications for )hich the enter"rise underta#es  contracts! develo"ment activities.



%tain and revie) the documented cy%ersecurity arrangements for critical a"" develo"ment as stated %y the enter"rise.



Determine )hether the enter"rise has im"lemented a""ro"riate controls over develo"ment+ for instance'



Secure develo"ment lifecycle



6eer-revie)ed and non-"ro"rietary coding



uilt-in monitoring and self-healingJ "rocesses

Assess %y a""lying a""ro"riate audit techni,ues intervie)+ o%servation+ testing! the management "ractice is effectively im"lemented.

19

Agree on the process .or' products in"uts and out"uts as defined in the "rocess "ractices descri"tion! that are

e/"ected to %e "resent "rocess design!. Assess to )hat e/tent the "rocess )or#


©ISACA2014

Allrightsreserved

87


IT Audit and Assurance Program for European Cybersecurity Phase B—-nderstand Enab(ers4 etting uitab(e Assessment Criteria and Perform the Asses Processes "roducts are availa%le. 6rocess D85 6anage ecurity er!ices in"uts and out"uts. $he most relevant and not assessed as Information items in sco"e in section A-:.3! of these )or# "roducts are identified as follo)s+ as )ell as the criteria against )hich they )ill %e assessed+ i.e.+ e/istence and usage. Pr o ces sPr act ice G6rocess or 6ractice (ameH





-:.>f

©ISACA2014

Agree on the process capabi(ity (e!e(to %e achieved %y the "rocess. This step is "arranted only if the process under re#ie" is a standard COBIT 5 go#ernance or management process to "hich the I1O/IEC 55.4 PA can be applied! Any other processes for "hich no reference practices "or) products or outcomes are appro#ed cannot use this assessment method6 therefore the concept capability le#el does not apply!

Allrightsreserved

88


IT Audit and Assurance Program for European Cybersecurity Phase B—-nderstand Enab(ers4 etting uitab(e Assessment Criteria and Perform the Asses Organisationa( tructures " ef #

As s u r a n c e t epasn$ d u i d a n ce

%tain understanding of each Organisationa( tructurein sco"e and set suita%le assessment criteria' 9or each Organisationa( tructurein sco"e as determined in ste" A-:.:!+ additional information is collected and assessment crite B%= defined. Assess the Organisationa( tructure# Organisationa( tructure:Cybersecurity team -4.1a 5nderstand the Organisationa( tructureconte/t. Identify and document all elements that can help to understand the conte+t in "hich the Cybersecurity teamorganisation has to op including& 

The o#erall organisation



anagement/process frame"or)



:istory of the role/structure

Contribution of the Organisational 1tructure to achie#ement of goals 5nderstand all sta'eho(dersof the Organisationa( tructure function. Determine through documentation re#ie" ;policies management communications etc!< the )ey sta)eholders of the Cybersecurity t organisation! 

-4.2a



Incumbent of the role and/or members of the Organisational 1tructure

Other )ey sta)eholders affected by the decisions of the Organisational 1tructure/role 5nderstand the goa(s of the Organisationa( tructure + the related metrics and agree on e/"ected values. 5nderstand ho) these contri%ute to the achievement of the enter"rise goals and I$-related goals. O rg an is a t io n a(t r u ctu r e$ o a ( As s e s s m e n tt ep Determine through intervie)s )ith #ey sta#eholders and documentation $his ste" only a""lies if s"ecific goals are defined. In th revie) the goals of the Cybersecurity team + i.e.+ the decisions for the assurance "rofessional )ill use a""ro"riate auditing 1 15 techni,ues to' .hich they are accountab(e4 . 

-4.:a

-4.4a



Identify the decisions made %y the rganisational St



Assess )hether decisions are a""ro"riately docume communicated.



*valuate the decisions %y+ assessing )hether' $hey have contri%uted to the achievement of the I$ and enter"rise goals as antici"ated.

Decisions are duly e/ecuted on a timely %asis. Agree on the e/"ected good "ractices for the Organisationa( tructureagainst )hich it )ill %e assessed. Assess the Organisationa( tructure design + i.e.+ assess the e/tent to )hich e/"ected good practicesare a""lied. $ ood P r a ct i c e C r it e r ia As s e s s m e nt te p "erating "rinci"les  "erating "rinci"les are  8erify )hether o"erating "rinci"les are a""ro"riately docum documented.

-4.4a Cont. Com"osition

S"an of control



egular meetings ta#e "lace as defined in o"erating "rinci"les.





$he rganisational Structure7s com"osition is %alanced and com"lete+ i.e.+ all re,uired sta#eholders are sufficiently re"resented.



Cy%ersecurity resources are ade,uate.



$he s"an of control of $he



8erify that regular meetings ta#e "lace as defined in the o"e "rinci"les.



8erify that meeting re"ortsminutes are availa%le and are m



Assess )hether the rganisational Structure7s com"osition i %alanced and com"lete+ i.e.+ all re,uired sta#eholders are s re"resented.



%tain and revie) a list of resources allocated to cy%ersecu "eo"le+ technology+ other!.



Determine )hether the general and s"ecific level of resourc allocation is sufficient to meet the needs and re,uirements o cy%ersecurity.



Assess the formal remit of resources )ithin the cy%ersecurit ACI+ s"an of control etc.! and its ade,uacy )ith regard to cy%ersecurity tas#s.



8erify )hether the s"an of control of the rganisational Stru

1 $he ACI charts in COBIT 5& Enabling Processes can %e leveraged as a starting "oint for the e/"ected goals of a role or rganisational Structure.

15 $he rganisational Structurerole as descri%ed may not e/ist under the same name in the enter"riseL in that case+ the closest rganisational Structure assuming the same res"onsi%ilities and accounta%ility should %e considered .

©ISACA2014

Allrightsreserved

89



As s u r a n c e t epasn$ d u i d a n ce rganisational Structure is defined.

?evel of authoritydecision rights



$he s"an of control is ade,uate+ i.e.+ the rganisational Structure has the right to ma#e all decisions it should.



$he s"an of control is in line )ith the overall enter"rise governance arrangements.



Cy%ersecurity is considered in %usiness continuity and resilience.



Decision rights of the rganisation Structure are defined and documented.



Decision rights of the rganisational Structure are res"ected and com"lied )ith also a culture%ehaviour issue!.

defined. 

Assess )hether the s"an of control is ade,uate+ i.e.+ the rganisational Structure has the right to ma#e all decisions i



8erify and assess )hether the s"an of control is in line )ith enter"rise governance arrangements.



%tain and revie) the organisational interfaces %et)een cy and %usiness continuity management or resilience manage including crisis management.



8erify that the organisational relationshi" %et)een these dis fully defined and ade,uate in terms of cy%ersecurity needs re,uirements.



Determine )hether the relationshi" %et)een i ncident manag and the cy%ersecurity function has clearly assigned ACI an inconsistencies.



Determine )hether the relationshi" %et)een crisis manage the cy%ersecurity function has clearly assigned ACI and no inconsistencies+ "articularly )here escalation and invocation mode are concerned.



Determine )hether the relationshi" %et)een resilience  %us continuity and the cy%ersecurity function has clearly assigne and no inconsistencies+ "articularly )here recovery  resum and solutions are concerned.



%tain and revie) the organisational interfaces %et)een cy and general information security.



%tain and revie) the organisational interfaces %et)een cy and cor"orate security.



8erify that the organisational interfaces and delivera%les are defined and ade,uate in terms of cy%ersecurity needs and



re,uirements. 8erify that decision rights of the rganisation Structure are and documented.



8erify )hether decision rights of the rganisational Structur com"lied )ith and res"ected.



Determine )hether the cy%ersecurity function is ade,uately to "erform its tas#s and discharge its res"onsi%ilities.

$he cy%ersecurity function is "ositioned at an a""ro"riate organisational level. Delegation of authority Delegation of authority is im"lemented 8erify )hether delegation of authority is im"lemented in a me in a meaningful )ay. )ay. *scalation "rocedures *scalation "rocedures are defined and 8erify the e/istence and a""lication of escalation "rocedures. a""lied. 5nderstand the life cycle and agree on e/"ected values. Assess the e/tent to )hich the Organisationa( tructure (ife cyc(e is managed. 

-4.3a -4.4a Cont.

9 if e %C yc(eE(em e n t
C r it e r ia $he rganisational Structure is formally esta%lished.



8erify through intervie)s and o%servations that the rganis Structure is formally esta%lished.



$he rganisational Structure has a



8erify through intervie)s and o%servations that the rganis



Structure has a clear+ documented and )ell understood ma %tain and revie) organisational charts and other relevant documentation for the cy%ersecurity function.

clear+ documented and )ellunderstood mandate. 



©ISACA2014

As s e s s m e n t te p



$here is a dedicated cy%ersecurity function )ith ade,uate resources and an a""ro"riate remit.



Defined interfaces e/ist %et)een cy%ersecurity and other rel organisational functions.

Cy%ersecurity is clearly delineated

Allrightsreserved

90



As s u r a n c e t epasn$ d u i d a n ce from other organisational functions.


$he "erformance of the rganisational Structure and its mem%ers should %e regularly monitored and evaluated %y com"etent and inde"endent assessors.



8erify )hether the "erformance of the rganisational Struct mem%ers is regularly monitored and evaluated %y com"eten inde"endent assessors.



8erify )hether the regular evaluations have resulted in im"r to the rganisational Structure+ in its com"osition+ mandate other "arameter.

$he regular evaluations should result in the re,uired continuous im"rovements to the rganisational Structure+ either in its com"osition+ mandate or any other "arameter. e"eat ste"s -4.1 through -4.3 for all remaining Organisationa( structures in sco"e. e"eat the ste"s descri%ed a%ove for the remaining rganisational structures' 

B%=#& to B%=#5

©ISACA2014



usiness e/ecutives



Service manager



Chief information officer CI!



usiness "rocess o)ners



Chief information security officer CIS!



Chief e/ecutive officer C*!



@ead I$ o"erations



is# function



6rivacy officer



Com"liance



Audit

Allrightsreserved

91


IT Audit and Assurance Program for European Cybersecurity Phase B—-nderstand Enab(ers4 etting uitab(e Assessment Criteria and Perform the Asse Cu(ture4 Ethics and Beha!iour Issue "e f # A s s u r a n ce  t e p a n d $ u i d a n c e Cross%reference %tain understanding of the Cu(ture4 Ethics and B%5 Beha!iourin sco"e. Assess Culture+ *thics and ehaviour. Cu(ture4 Ethics and Beha!iour:Integrity and "e(iabi(ity -3.1a

5nderstand the Cu(ture4 Ethics and Beha!iour conte0t. 

=hat the o#erall corporate Culture is li)e



-3.2a

-3.:a

-nderstand the interconnection "ith other enablers in scope& Identify roles and structures that could be affected by the Culture! Identify processes that could be affected by Culture Ethics and Beha#iour including any processes in scope of the re#ie"! 5nderstand the ma&or sta'eho(dersof the Cu(ture4 Ethics and Beha!iour ' Integrity and "e(iabi(ity -nderstand to "hom the beha#iour re0uirements "ill apply i!e! understand "ho embodies the roles/structures e+pected to demonstrate the correct set of Beha#iours! This is usually lin)ed to the roles and Organisational 1tructures identified in scope! 5nderstand the goa(s for the Cu(ture4 Ethics and Beha!iour+ and the related metrics and agree on e/"ected values. Assess )hether the Cu(ture4 Ethics and Beha!iour goa(s outcomes! are achieved+ i.e.+ assess the effectiveness of the Culture+ *thics and ehaviour. In the conte/t of Integrity and "e(iabi(ity the follo)ing Cu(ture4 Ethics and Beha!iour are desired'

Culture and es"ecially ehaviours are associated to individuals and the rganisational Structures of )hich they are a "art+ therefore+ %y using a""ro"riate auditing techni,ues+ the assurance "rofessional )ill'

-3.:a Cont.

Desired Beha!iour )Cu(ture4 Ethics and Beha!iour $oa(* rganisational Culture' $he "rocess of de"loying cy%ersecurity solutions is controlled and monitored in full com"liance )ith the relevant "olicy and "rocedures. rganisational 8alues and eliefs' 8alues and %eliefs )ithin the organisation are realistic and a""ro"riately reflect current cy%ersecurity facts and #no)ledge

©ISACA2014

Allrightsreserved



Identify individuals )ho must com"ly )ith the ehaviours under revie).



Identify the rganisational Structures involved.



Assess )hether desired ehaviours can %e o%served.



Assess )hether undesira%le ehaviours are a%sent.



9or a re"resentative sam"le of individuals+ "erform the follo)ing assessment ste"s.



%tain and revie) the organisation7s stated set of values that have an im"act on

Assessment tep



cy%ersecurity. Conduct randomised informal! intervie)s to gain an understanding of commonly held %eliefs and assum"tions regarding

92



"e f #

Phase B—-nderstand Enab(ers4 etting uitab(e Assessment Criteria and Perform the Asse Cu(ture4 Ethics and Beha!iour Issue A s s u r a n ce  t e p a n d $ u i d a n c e Cross%reference cy%ersecurity.

Cy%ersecurity $arget Culture' $he organisation has defined and im"lemented a target culture that is conducive to cy%ersecurity governance+ management and com"liance.

rganisational *thicsL Code of *thics' $he organisation has esta%lished cy%ersecurity good "ractice as "art of their code of ethics.



Identify and informally re"ort any inconsistencies %et)een formal values and actual %eliefs or assum"tions+ "articularly )here these inconsistencies might %e )ea# signalsJ indicating systemic )ea#nesses in cy%ersecurity.



%tain the organisation7s statement if any! and related materials on the desired cy%ersecurity culture.



Determine )hether the organisation has ado"ted cy%ersecurity as a sufficiently im"ortant element of cor"orate culture.



8erify that cy%ersecurity values and culture have %een included as "art of the general code of ethics+ including clear and unam%iguous guidance on cy%ercrime and other illegal acts.



8erify that any related issues such as ED! have %een fully incor"orated into the general code ofguidance ethics and any su%sidiary on cy%ersecurity.

*thical *nforcement' $he organisation follo)s u" on any and all instances of cy%ercrime or other illegal acts.

rganisational ehavior 6atternsL Desira%le ehaviours' $he organisation has clearly defined desira%le %ehaviours )ith regard to cy%ersecurity

-3.4a



*n,uire of management )hether any and all illegal acts are "rosecuted+ and note any e/ce"tions.



8erify that all *uro"ean "rovisions on cy%ercrime+ investigation and "rosecution are adhered to. Consult a""ro"riate legal assistance )here needed.



Determine )hether the organisation has formulated model  desira%le %ehaviours in terms of cy%ersecurity.



Determine )hether the organisation has introduced+ and is living %y+ guiding "rinci"les in cy%ersecurity.

5nderstand the life cycle stages of the Cu(ture4 Ethics and Beha!iour+ and agree on the relevant criteria. Assess to )hat e/tent the Culture+ *thics and ehaviour life cycle is managed. $his as"ect is already covered %y the assessment of the good "ractices+ hence no additional se"arate assurance ste"s are defined here.!

©ISACA2014

Allrightsreserved

93



"e f # -3.3a

Phase B—-nderstand Enab(ers4 etting uitab(e Assessment Criteria and Perform the Asse Cu(ture4 Ethics and Beha!iour Issue A s s u r a n ce  t e p a n d $ u i d a n c e Cross%reference 5nderstand good "ractice )hen dealing )ith Cu(ture4 Ethics and Beha!iour + and agree on relevant criteria. Assess the Culture+ *thics and ehaviour design+ i.e.+ assess to )hat e/tent e/"ected good "ractices are a""lied. $ood P r a ct i c e C r it e r i a As s e s s m e nt t ep Communication+ enforcement and rules */istence and ,uality of the A""ly a""ro"riate auditing techni,ues to as communication )hether the good "ractice is ade,uately a" assessment criteria are met. Incentivesandre)ards */istenceanda""licationof a""ro"riate re)ards and incentives A)areness of desired ehaviours

A)areness B%5#& to B%5#5

e"eat ste"s -3.1 through -3.3 for all remaining Cu(ture4 Ethics and Beha!iour in sco"e. e"eat the ste"s descri%ed a%ove for the remaining Culture+ *thics and ehaviour' 

©ISACA2014

6ersonal and 6rofessional elia%ility

Allrightsreserved

94

European Cybersecurity Audit/Assurance Program IT Audit and Assurance Program for European Cybersecurity Phase B—-nderstand Enab(ers4 etting uitab(e Assessment Criteria and Perform the Asses Information Items Issue "e f # A s s u r a n c e  t e p s a n d $ u i d a n ce Cross%reference %tain understanding of the Information B%> Items in sco"e. Assess Information Items. Information Item: orma( Cybersecurity Po(icy -.1a

-.2a

-.:a

-.:a Cont.

5nderstand the Information item conte0t' 

=here and "hen is it used>



,or "hat purpose is it used>



-nderstand the connection "ith other enablers in scope e!g!& -sed by "hich processes> =hich Organisational 1tructures are in#ol#ed> =hich ser#ices/applications are in#ol#ed>

5nderstand the ma&or sta'eho(dersof the Information item' orma( Cybersecurity Po(icy -nderstand the sta)eholders for the Information item i!e! identify the& 

Information producer



Information custodian



Information consumer

1ta)eholders should be at the appropriate organisational le#el! 5nderstand the ma&or ,uality criteria for the Information item+ the related metrics and agree on e/"ected values. Assess )hether the Information item ua(ity criteriaoutcomes! are achieved+ i.e.+ assess the effectiveness of the Information item. ?everage the CI$ 3 Information ena%ler 1% model focusing on the ,uality goals descri"tion to select the most relevant Information ,uality criteria for the Information item at hand. Document e/"ectations regarding information criteria. $he CI$ 3 Information ena%ler model identifies 13 different ,uality criteriaalthough all of them are relevant+ it is nonetheless "ossi%le and recommended to focus on a su%set of the most im"ortant criteria for the Information item at hand.

$he assurance "rofessional )ill+ %y using a""ro"riate auditing techni,ues+ verify all ,uality in sco"e and assess )hether the criteria are met.

?ua(ity Dimension

2e y Cri

D e s c r i p t io n


ter ia Accuracy %&ectivity

 

1% CI$ 3 frame)or#+ A""endi/ ;+ ".=1-=4

©ISACA2014

Allrightsreserved

95

European Cybersecurity Audit/Assurance Program IT Audit and Assurance Program for European Cybersecurity

"e f #

-.4a

Phase B—-nderstand Enab(ers4 etting uitab(e Assessment Criteria and Perform the Asses Information Items Issue A s s u r a n c e  t e p s a n d $ u i d a n ce Cross%reference elieva%ility  e"utation  elevancy  Com"leteness  Currency  Amount of information  Concise re"resentation  Consistent re"resentation Inter"reta%ility  5nderstanda%ility 
Fhen the Information item is internal to I$+ the "rocess revie) )ill have covered the life cycle as"ects sufficiently.



Fhen the Information item also involves other sta#eholders outside I$ or other non-I$ "rocesses+ some of the life cycle as"ects need to %e assessed.

-.3a

6lan Design uildac,uire 5seo"erate *valuatemonitor 5"datedis"ose 5nderstand im"ortant attri%utes of the Information item and e/"ected values. Assess the Information item design + i.e.+ assess the e/tent to )hich e/"ected good practicesare a""lied.

2e y Cri teri a

D e s cr i p t i o n

As s es s m en tt ep

     

;ood "ractices for Information are defined as a series of attri%utesitems for the 1: Information item . $he assurance "rofessional )ill+ %y using a""ro"riate audit

1: CI$ 3 frame)or#+ a""endi/ ;+ ". =1-=4

©ISACA2014

Allrightsreserved

96

European Cybersecurity Audit/Assurance Program IT Audit and Assurance Program for European Cybersecurity

"e f #

Phase B—-nderstand Enab(ers4 etting uitab(e Assessment Criteria and Perform the Asses Information Items Issue A s s u r a n c e  t e p s a n d $ u i d a n ce Cross%reference techni,ues+ verify all attri%utes in sco"e and assess )hether the attri%utes are ade,uately defined.
Attribute

B%>#& to B%>#5

6hysical *m"irical Syntactic Semantic 6ragmatic Social e"eat ste"s -.1 through -.3 for all remaining Information itemsin sco"e. e"eat the ste"s descri%ed a%ove for the remaining Information items' 

Code of Conduct



$hird-"arty access "olicies



8irtual architecture documentation



8irtualiation "olicies



Cy%ersecurity technical standards



$echnical guidelines and "rocedures at the I$ service level+ including services "artially or fully "rovided %y third "arties



$echnical guidelines and "rocedures at the I$ a""lication level



$echnical guidelines and "rocedures at the I$ "latform level+ including remotely controlled and administered "latforms rental virtual servers etc.!



$echnical guidelines and "rocedures at the autonomous I$ hard)are level including stand-alone servers and clusters+ end user 6C devices etc.!



$echnical guidelines and "rocedures for critical or "articularly e/"osed hard)are items+ nota%ly mo%ile devices such as smart"hones or ta%lets



$echnical and administrative guidelines and "rocedures around ED



$echnical and administrative guidelines and "rocedures for industrial control systems and I$ interfaces



$echnical and administrative guidelines and "rocedures for %uilding and facilities management systems



Incident management+ disaster recovery and service  %usiness continuity



©ISACA2014

Description

Assessment tep



"rocedures for critical I$ assets ;uidelines and "rocedures concerning the identification+ documentation and safeguarding of informational evidence+ e.g. logs

Allrightsreserved

97

European Cybersecurity Audit/Assurance Program IT Audit and Assurance Program for European Cybersecurity Phase B—-nderstand Enab(ers4 etting uitab(e Assessment Criteria and Perform the Asses Information Items Issue A s s u r a n c e  t e p s a n d $ u i d a n ce Cross%reference

"e f #

©ISACA2014



8irtualiation controls assessment results



$hird-"arty access controls assessment results



Cy%ersecurity attri%utes in data and information classification



*vidence of cy%ersecurity inclusion in data and information classification

Allrightsreserved

98


IT Audit and Assurance Program for European Cybersecurity Phase B—-nderstand Enab(ers4 etting uitab(e Assessment Criteria and Perform the Asses er!ices4 Infrastructures and App(ications "e f # B%@

As s u r an c e t e pa sn$ d u id a n c e %tain understanding of the er!ices4 Infrastructure and App(ications in sco"e. Assess Services+ Infrastructure and A""lications.

er!ices4 Infrastructure and App(ications: Cybersecurity training ->.1a

->.2a

->.:a

5nderstand the er!ices4 Infrastructure and App(ications conte/t. -nderstand the organisational and technological conte+t of this ser#ice! 3efer to step A$?!? and A$?!% and re$use that information to unders the significance of this 1er#ice Infrastructure and Application! 5nderstand the ma&or sta'eho(dersof the er!ices4 Infrastructure and App(ications ' Cybersecurity training -nderstand "ho "ill be the ma@or sta)eholders of the ser#ice i!e! the sponsor pro#ider and users! 1ta)eholders "ill include a number of organisational roles but could also lin) to Processes! 5nderstand the ma&or goa(s for the er!ices4 Infrastructure and App(ications + the related metrics and agree on e/"ected values. Assess )hether the Services+ Infrastructure and A""lications goals outcomes! are achieved+ i.e.+ assess the effectiveness of the Services+ Infrastructure and A""lications. $ o a( C r it e r ia As s e s s m e n tt e p Service descri"tion  $he Service is clearly  8erify that the Service e/ists and is clearly descri%ed. descri%ed. 

oles and res"onsi%ilities are clearly defined

$he Service is availa%le to all "otential sta#eholders Service levels are defined for '



8erify that roles and res"onsi%ilities are clearly defined.



Assess the ,uality of the Service descri"tion and of the Service offered.



8erify the accessi%ility of the Service to all "otential sta#eholders.



8erify that the follo)ing as"ects are dealt )ith in the Service level defini Buality of the Service delivera%les



Service level definition

Contri%ution to related ena%lers+ I$ and enter"rise goals

->.4a



Buality of the service delivera%les



*ase to re,uest the service



$imeliness

$he Service contri%utes to the achievement of related ena%ler and I$-related and enter"rise goals.

*ase to re,uest the service $imeliness 8erify to )hat e/tent Service levels are achieved. Assess to )hat e/tent the Service contri%utes to the achievement of the r ena%ler goals and to the overall I$-related and enter"rise goals.



5nderstand good "ractice related to theand Services+ Infrastructure ande/tent e/"ected values. Assess the er!ices4 Infrastructure App(ications design+and i.e.+ A""lications assess to )hat e/"ected good "ractices are a""lied. 18 'e#erage the description of 1er#ices Infrastructure and Applications in the COBIT 5 frame"or) to identify good practices related to 1er#ic Infrastructure And Applications! In general the follo"ing practices need to be implemented& Buy/build decision needs to be ta)en!



-se of the 1er#ice needs to be clear! $ ood P r a ct i ce C r it e r ia Sourcing %uy%uild! A formal decision%ased on a %usiness caseneeds to %e ta#en regarding the sourcing of the Service. 

->.4a Cont.

5se

$heuseoftheServiceneedsto %e clear' 

Fhen it needs to %e used and %y )hom

As s e s s m e nt t e p 

8erify that a formal decision%ased on a %usiness case)as ta#en re the sourcing of the Service.



8erify the validity and ,uality of the %usiness case.



8erify that the sourcing decision has %een duly e/ecuted.



8erify that the use of the Service is clear+ i.e.+ it is #no)n )hen and %y the service needs to %e used.



8erify that actual use is i n line )ith re,uirement a%ove.

 8erify that the actual Service out"ut is ade,uately used. $he re,uired com"liance  8erify that Service levels are monitored and achieved. levels )ith the Service7s out"ut e"eat ste"s ->.1 through ->.4 for all remaining er!ices4 Infrastructure and App(ications in sco"e. e"eat the ste"s descri%ed a%ove for the remaining Services+ Infrastructure and A""lications' 

B%@#& to B%@#=



Change management



@uman resources



@el" des#



Incident trac#ing system

18 CI$ 3 frame)or#+ a""endi/ ;+ ".=3-=

©ISACA2014

Allrightsreserved

99


©ISACA2014

Allrightsreserved

100

European Cybersecurity Audit/Assurance Program IT Audit and Assurance Program for European Cybersecurity Phase B—-nderstand Enab(ers4 etting uitab(e Assessment Criteria and Perform the Asses Peop(e4 'i((s and Competencies "e f #

As s u r an c e t e pa sn$ d u id a n c e

B%

%tain understanding of the Peop(e4 'i((s and Competencies in sco"e. Assess 6eo"le+ S#ills and Com"etencies. Peop(e4 'i(( and Competency: Cybersecurity Personne( 'i((s -=.1a

5nderstand the Peop(e4 'i((s and Competencies conte/t. -nderstand the conte+t of the 1)ill/Competency i!e!& 

=here and "hen is it used>



,or "hat purpose is it used>

-nderstand the connection "ith other enablers in scope e!g!& In "hich roles and structures is the 1)ill/Competency used> ;1ee also B$4!!< =hich beha#iours are associated "ith the 1)ill/Competency> 5nderstand the ma&or sta'eho(dersfor the Peop(e4 'i((s and Competencies:Cybersecurity Personne( 'i((s Identify to "hom in the organisation the s)ill re0uirement applies! 5nderstand the ma&or goa(s for the Peop(e4 'i((s and Competencies + the related metrics and agree on e/"ected values. Assess )hether the Peop(e4 'i((s and Competencies goa(s outcomes! are achieved+ i.e.+ assess the effectiveness of the 6eo"le+ S#ills Com"etencies. 

-=.2a -=.:a

9or the 6eo"le+ S#ills and Com"etencies' Cybersecurity Personne( 'i((s + the follo)ing goals and associated criteria can %e addressed. $ o a( C r it e r ia As s e s s m e n tt ep */"erience Allc y%ersecurity" ersonnel  Determine )hether the organisation has defined and documented mini "ossess the necessary s#ills and e/"erience re,uirements+ for instance in &o% descri"tions or &o e/"erience to meet the needs offers. and re,uirements of  8erify that these minimum re,uirements are in line )ith good "ractice a cy%ersecurity. cy%ersecurity needs and re,uirements of the organisation.

*ducation

Bualification no)ledge -=.:a Cont.

$echnical s#ills

ehavioural s#ills

S#ills and e/"erience re,uirements for ne) hires or side entries are aligned )ith the organisation7s cy%ersecurity needs and re,uirements. $he enter"rise ena%les+ o"erates and encourages ade,uate training+ education and a)areness measures for all em"loyees and relevant third "arties. S"ecifically+ em"loyees or third "arties )ith cy%ersecurity tas#s and res"onsi%ilities are su%&ect to com"ulsory training and a)areness. $he enter"rise ena%les+ o"erates and encourages ade,uate a)areness measures for all em"loyees and relevant third "arties. S"ecifically+ em"loyees or third "arties )ith cy%ersecurity tas#s and res"onsi%ilities are su%&ect to com"ulsory a)areness. All cy%ersecurity "ersonnel are ade,uately s#illed and su""orted in ac,uiring the re,uisite s#ills to "erform their tas#s. All "ersonnel )ith cy%ersecurity tas#s and res"onsi%ilities meet the re,uired standard of "ersonal and "rofessional integrity.

(um%er of "eo"le )ith a""ro"riate s#ill level

©ISACA2014

All "ersonnel )ith cy%ersecurity tas#s and res"onsi%ilities are

Allrightsreserved





$he organisation offers+ and mandates+ the a""ro"riate level of cy%erse training to cy%ersecurity "ractitioners as )ell as end users. $he organisation is fully a)are and informed a%out inde"endent cy%ers educational o""ortunities. $he organisation encourages+ and mandates+ a""ro"riate level of education to cy%ersecurity "ractitioners and end us

$he organisation creates and maintains an ade,uate level of cy%ersecurity a)areness among all em"loyees+ and s"ecifically high-ris# users.



%tain and revie) sam"le "rofessional s#ill sets for em"loyees )ith cy%ersecurity tas#s.



%tain and revie) lists of individual training needs and training re,uests



Determine )hether the organisation "erforms a""ro"riate %ac#ground c )hen hiring cy%ersecurity "ersonnel 8erify that %ac#ground chec#ing is conformant )ith la)s and regulation Consult legal assistance )here a""ro"riate.





Determine )hether the organisation "erforms re"eated and fre,uent %ac#ground chec#s on em"loyees )ith tas#s and res"onsi%ilities in

101


As s u r an c e t e pa sn$ d u id a n c e "ersonally and "rofessionally relia%le+ and a%le to continue their &o%.

cy%ersecurity. 

8erify that %ac#ground chec#ing is conformant )ith *uro"ean la)s and regulations. Consult legal assistance )here a""ro"riate.

8erify that em"loyees have given e/"licit consent to having their %ac#gr chec#ed. 5nderstand the (ife cyc(e stages of the Peop(e4 'i((s and Competencies + and agree the relevant criteria. Assess to )hat e/tent the 6eo"le+ S#ills and Com"etencies life cycle is managed. 9or the 6eo"le+ S#ills and Com"etencies at hand+ the life cycle "hases and associated 9or the 6eo"le+ S#ills and Com"etencies at han criteria can %e e/"ressed in function of the "rocess A60>. assurance "rofessional )ill "erform the follo)in assessment ste"s. 9 if C e yc(E e ( eme n t C r it e r ia As s e s s m ent t ep 6lan 6ractice A60>.0:+ activity 1 Define the re,uired and Assess )hether "ractice A60>.0: activity 1 is currently availa%le s#ills and com"etencies of internal and im"lemented in relation to this s#ill. e/ternal resources to achieve enter"rise+ I$ and "rocess goals.! is im"lemented in relation to this s#ill. Design 6ractice A60>.0: activity 2 6rovide formal career Assess )hether "ractice A60>.0: activity 2 is "lanning and "rofessional develo"ment to encourage im"lemented in relation to this s#ill. com"etency develo"ment+ o""ortunities for "ersonal 

-=.4a

advancement and reduced de"endence on #ey individuals.! is im"lemented in relation to this s#ill.

uild -=.4a Cont.

"erate

-=.3a

6ractice A60>.0: activity : 6rovide access to #no)ledge re"ositories to su""ort the develo"ment of s#ills and com"etencies.! is im"lemented in relation to this s#ill. 6ractice A60>.0: activity 4 Identify ga"s %et)een re,uired and availa%le s#ills and develo" action "lans to address them on an individual and collective %asis+ such as training Ntechnical and %ehavioural s#illsO+ recruitment+ rede"loyment and changed sourcing strategies.! is im"lemented in relation to this s#ill. 6ractice A60>.0: activity 3 Develo" and deliver training "rogrammes %ased on organisational and "rocess

Assess )hether "ractice A60>.0: activity : is im"lemented in relation to this s#ill. Assess )hether "ractice A60>.0: activity 4 is im"lemented in relation to this s#ill.

Assess )hether "ractice A60>.0: activity 3 is im"lemented in relation to this s#ill.

re,uirements+ including re,uirements for enter"rise #no)ledge+ internal control+ ethical conduct and security.! is im"lemented in relation to this s#ill. *valuate 6ractice A60>.0: activity  Conduct regular revie)s to Assess )hether "ractice A60>.0: activity  is assess the evolution of the s#ills and com"etencies of the im"lemented in relation to this s#ill. internal and e/ternal resources. evie) succession "lanning.! is im"lemented in relation to this s#ill. 5"datedis"ose 6ractice A60>.0: activity > evie) training materials and Assess )hether "ractice A60>.0: activity > is "rogrammes on a regular %asis to ensure ade,uacy )ith im"lemented in relation to this s#ill. res"ect to changing enter"rise re,uirements and their im"act on necessary #no)ledge+ s#ills and a%ilities.! is im"lemented in relation to this s#ill. 5nderstand good "ractice related to the Peop(e4 'i((s and Competencies and e/"ected values. Assess the 6eo"le+ S#ills and Com"etencies design+ i.e.+ assess to )hat e/tent e/"ected good "ractices are a""lied. $ o oP dr a ct ice C r it e r ia As s e s s m e ntt ep S#ill set and  Determine that an inventory of S#ills and Com"etencies are Com"etencies is maintained %y organisational unit+ &o% defined. function and individual. 

*valuate the relevance and the contri%ution of the S#ills and Com"etencies to the achievement of the goals of the rganisational Structure+ and %y conse,uence+ I$-related goals and enter"rise goals.



*valuate the Com"etencies ga" analysis %et)een necessary "ortfolio of S#ills and and current inventory of s#ills and ca"a%ilities. S#ill levels are defined.

©ISACA2014



Assess the fle/i%ility and "erformance of meeting S#ills develo"ment to address identified ga"s %et)een necessary and current S#ill levels.

Allrightsreserved

102


As s u r an c e t e pa sn$ d u id a n c e Assess the "rocess for :0-degree "erformance evaluations. e"eat ste"s -=.1 through -=.3 for all remaining Peop(e4 'i((s and Competencies in sco"e. e"eat the ste"s descri%ed a%ove for the remaining 6eo"le+ S#ills and Com"etencies' 

B%#& to B%#5



©ISACA2014

*nter"rise)ide Cy%ersecurity A)areness

Allrightsreserved

103


IT Audit and Assurance Program for European Cybersecurity Phase C—Communicate the "esu(ts of the Assessment "ef# C% & C-1.1

As s u r a n cet ep D o cu m e n t e 0 c e p t i o n s a n d g a p s # 5nderstand and document )ea#nesses and their im"act on the achievement of "rocess goals.

• •

C-1.2

5nderstand and document )ea#nesses and their im"act on enter"rise goals.

•

Illustrate the im"act of ena%ler failures or inefficiencies and misuse. Clarify vulnera%ilities+ threats and missed "erform effectively. Illustrate )hat the )ea#nesses )ould aff architecture elements+ ca"a%ilities+ resou actual cases in the same industry and lev

•

• •

C%1 C-2.1

Communicate the )or# "erformed and findings. Communicate the )or# "erformed.

C-2.2

Communicate "reliminary fi ndings to t he assurance engagement sta#eholders def ined in A-1.



Communicate regularly to the sta#eholde

•

•

Document the im"act i.e.+ customer and effective ena%lers.
•

5se %enchmar#ing and survey results to

•

5se e/tensive gra"hics to illustrate the is

•

Inform the "erson res"onsi%le for the ass hisher correct understanding of those fin

•

C-2.:

©ISACA2014

Document the im"act of actual ) financial re"orting+ hours lost inena%ler staff time customer and shareholder re,uirements+ 6oint out the conse,uence of non-com"li agreements.
Deliver a re "ort aligned )ith the terms of reference+ sco"e and agreed-on re"orting standards! that su""orts the results of the initiative and ena%les a clear focus on #ey issues and im"ortant actions.

Allrightsreserved

104


Appendi0 A# Other IACA ources The Business odel for Information 1ecurity CI$ 3 COBIT 5& Enabling Processes COBIT 5 for Assurance COBIT 5 for Information 1ecurity COBIT 5 for 3is) 3esponding to Targeted Cyberattac)s 1ecuring obile De#ices -sing COBIT 5 Transforming Cybersecurity -sing COBIT 5

©ISACA2014

Allrightsreserved

105

European Cybersecurity Audit Assurance Program Res Eng 0914

Recommend Documents