ISACA CSX Fundamentals cheat sheet

CIA triad: confidentiality protects against unauthorized disclosure, integrity against unauthorized modification, availability against disruption of access; controls are evaluated by which leg they support.

Risk = likelihood × impact; risk treatment options are mitigate, transfer, avoid, and accept, and residual risk is the risk remaining after controls are applied.

Authentication proves identity, authorization grants permissions, and accounting (auditing) records activity; a control claiming authentication without a credential check is mislabeled.

Defense in depth layers preventive, detective, and corrective controls so a single failure does not expose the asset; no single control is assumed sufficient.

Least privilege and need-to-know limit access to the minimum required; separation of duties and job rotation reduce the chance and duration of insider abuse.

Threat vs vulnerability vs risk: a threat is a potential cause of harm, a vulnerability is a weakness, and risk exists only where a threat can exploit a vulnerability affecting an asset.

Symmetric algorithms (AES, 3DES) use one shared key and are fast for bulk data; asymmetric algorithms (RSA, ECC) use key pairs and also support digital signatures and key exchange.

Hashing (SHA-256) provides integrity but not confidentiality and is not encryption; a hash cannot be reversed to recover the original input.

Incident response phases in order: preparation, detection and analysis, containment, eradication, recovery, and lessons learned; containment precedes eradication to limit spread.

Phishing is deceptive email or messaging that induces credential theft or malware execution; spear phishing is targeted, whaling targets executives, and vishing uses voice calls.

Malware categories: virus needs a host and user action, worm self-propagates over networks, trojan disguises as legitimate software, ransomware denies access until payment, rootkit hides privileged persistence.

Social engineering exploits human trust rather than technical flaws; pretexting invents a scenario, tailgating follows an authorized person through a physical control.

Firewalls filter by address, port, and protocol; an IDS detects and alerts, an IPS detects and blocks inline, and a WAF inspects HTTP/HTTPS application traffic.

AAA in network access: authentication verifies the subject, authorization assigns privileges, and accounting logs sessions; RADIUS and TACACS+ are common implementations.

Backup types: full copies all data, incremental copies changes since the last backup of any type, differential copies changes since the last full backup; restore from incremental needs the full plus each increment.

Patch management reduces exposure to known vulnerabilities; zero-day exploits target flaws with no available fix, so compensating controls such as segmentation and monitoring apply.

Business continuity focuses on keeping critical operations running during disruption, while disaster recovery restores IT infrastructure afterward; RTO is maximum tolerable downtime and RPO is maximum tolerable data loss.

Access control models: DAC lets the owner set permissions, MAC enforces labels via a central policy, RBAC grants by role, and ABAC evaluates attributes of subject, object, and context.

Multi-factor authentication requires factors from different categories (knowledge, possession, inherence); two passwords are two instances of one factor, not MFA.

Encryption at rest protects stored data and encryption in transit protects data on the wire; TLS provides confidentiality, integrity, and server authentication for network sessions.

Digital signature: the sender hashes the message and encrypts the hash with the sender's private key; the receiver verifies with the sender's public key, giving integrity, authentication, and non-repudiation.

PKI trust depends on certificate authorities; a digital certificate binds a public key to an identity and is validated by signature chain, validity dates, and revocation status (CRL or OCSP).

Vulnerability scanning identifies known weaknesses and missing patches, while penetration testing simulates an adversary to chain exploits; scanning is broad and frequent, testing is deep and periodic.

Security awareness training targets phishing susceptibility and password hygiene; simulated phishing campaigns measure click and report rates as control-effectiveness metrics.

Data classification (public, internal, confidential, restricted) drives handling, retention, and encryption requirements; labeling without enforcement does not satisfy the control.

Security operations monitoring uses SIEM log aggregation and correlation to detect anomalies; log integrity depends on synchronized time (NTP) and protected retention.

Incident severity is set by business impact and scope, not by attacker tooling; escalation criteria are defined in advance in the incident response plan.

Forensics order of volatility: collect CPU registers and cache, then memory, then network state, then disk, then archival media; volatile evidence is captured first.

Chain of custody documents who handled evidence, when, and why; a break in the chain weakens admissibility and evidentiary value.

Change management requires documented approval, testing, and rollback plans; emergency changes are still recorded retrospectively to preserve auditability.

Physical controls include locks, badges, mantraps, and guards; environmental controls include fire suppression, UPS, and humidity and temperature monitoring for server rooms.

Cloud shared responsibility: the provider secures the underlying infrastructure, and the customer secures data, identities, configurations, and access according to the service model (IaaS, PaaS, SaaS).

Key management lifecycle covers generation, distribution, storage, rotation, and destruction; keys stored beside the encrypted data defeat the purpose of encryption.

Policy hierarchy: policy states management intent and is mandatory, standards specify mandatory requirements, procedures give step-by-step instructions, and guidelines are recommended practices.

Compliance drivers include laws, regulations, and contractual obligations (for example PCI DSS for card data); noncompliance risk is treated like any other business risk.

Due care is acting on identified risk; due diligence is the ongoing verification that controls work. Audits and assessments supply the evidence for due diligence.

Security metrics should be measurable and tied to objectives, such as mean time to detect, patch latency, and percentage of assets covered by monitoring.

Third-party risk management assesses vendor security posture before contracting and monitors it during the relationship; data processing agreements define handling obligations.

Privacy principles: collect only necessary data (minimization), state the purpose, limit retention, and honor data subject rights such as access and deletion where applicable.

Business impact analysis identifies critical processes and their dependencies and produces RTO and RPO values used to select recovery strategies.

Asset inventory is the foundation of risk management; an unrecorded asset cannot be patched, monitored, or assessed, so unknown assets represent unmanaged risk.

Cryptographic key length and algorithm choice determine strength; deprecated algorithms such as MD5 and SHA-1 are unsuitable for integrity or signature use where collision resistance matters.

Network segmentation and DMZs limit lateral movement; a flat network lets a single compromised host reach critical systems directly.

Secure coding defenses: input validation and parameterized queries prevent injection, output encoding prevents cross-site scripting, and least-privilege service accounts limit blast radius.

OWASP-style web risks include broken access control, injection, and misconfiguration; access control failures are tested by attempting actions outside the user's role.

Wireless security: WPA2/WPA3 with strong encryption replaces WEP; open networks expose traffic to interception, so VPN or TLS is required for confidentiality.

Denial-of-service attacks target availability; volumetric attacks saturate bandwidth, while application-layer attacks exhaust server resources, requiring different mitigations.

Security control types: preventive stops an event, detective identifies it, corrective repairs after it, compensating substitutes for a primary control, and deterrent discourages attempts.

Audit logging must capture who, what, when, and outcome for sensitive actions; logs without review or alerting provide little detective value.

Threat modeling identifies assets, entry points, and threats early in design; STRIDE classifies spoofing, tampering, repudiation, information disclosure, denial of service, and elevation of privilege.

Vulnerability management cycle: discover assets, scan, prioritize by severity and exploitability, remediate or mitigate, then verify and report.

CVSS scores convey severity but prioritization also weighs asset criticality and known exploitation; a high score on an isolated test host may rank below a medium score on an internet-facing server.

Patch latency measures time from vendor release to deployment; exceptions require documented risk acceptance with an expiry date.

Configuration baselines (hardening standards) reduce attack surface; default credentials and unnecessary services are common findings in misconfiguration assessments.

Security architecture principles: fail secure, least common mechanism, open design (no security through obscurity), and complete mediation of every access request.

Incident containment strategies include isolating the host, blocking indicators at the perimeter, and disabling compromised accounts; eradication removes the root cause before recovery.

Awareness of legal and regulatory reporting duties: breaches may require notification to regulators or affected individuals within defined timeframes.

Identity lifecycle: provisioning, periodic access review, role change, and timely deprovisioning; orphaned accounts from failed deprovisioning are a frequent audit finding.

Privileged access management controls administrative accounts through vaulting, session recording, and just-in-time elevation rather than standing admin rights.

Single sign-on improves usability but concentrates risk; compromise of the primary identity provider can grant broad access, so it requires strong MFA and monitoring.

Password storage uses salted, slow hashes (bcrypt, Argon2, PBKDF2); fast general-purpose hashes and unsalted storage enable offline cracking and rainbow-table attacks.

Zero trust removes implicit trust based on network location and verifies every request through identity, device posture, and policy evaluation.

Endpoint detection and response monitors process behavior and enables containment; signature antivirus alone misses novel or fileless malware.

Email security controls include SPF, DKIM, and DMARC to authenticate sending domains and reduce spoofing and phishing delivery.

Incident response testing through tabletop exercises validates roles, communications, and decision-making without disrupting production systems.

Data loss prevention inspects content and context to block exfiltration; effectiveness depends on accurate classification and coverage of egress channels.

Encryption in transit uses TLS with valid certificates; certificate expiry and weak protocol versions are common causes of outages and downgrade attacks.

Network monitoring baselines normal traffic so anomalies stand out; without a baseline, alerting produces noise and missed detections.

Backup protection includes offline or immutable copies to resist ransomware; a backup reachable with the same credentials as production can be encrypted too.

Recovery testing proves restores work; an untested backup is an assumption, not a control, and restore time must be measured against the RTO.

Mobile and remote work risk increases with unmanaged devices; endpoint compliance checks and full-disk encryption reduce exposure of data outside the perimeter.

Supply chain risk includes compromised software updates and third-party libraries; integrity verification and vendor assessment are the corresponding controls.

Security governance assigns accountability: senior management owns risk decisions, and the security function advises and implements rather than unilaterally accepting business risk.

Log retention periods are set by legal, regulatory, and investigative needs; short retention can destroy evidence needed for incident reconstruction.

Event triage distinguishes true positives from false positives; tuning rules reduces alert fatigue, which is a leading cause of missed incidents.

Indicators of compromise include unusual outbound connections, unexpected privilege changes, and anomalous login geography or timing.

Honeypots and deception technology detect adversaries with low false-positive rates because legitimate users have no reason to interact with them.

Vulnerability disclosure and bug bounty programs provide a channel for external researchers; a published policy reduces uncoordinated disclosure risk.

Secure deletion and media sanitization follow standards appropriate to data sensitivity; overwriting or cryptographic erasure is used before reuse or disposal.

Security awareness of insider threat includes monitoring for unusual bulk data access and departure-period activity, balanced against privacy obligations.

Metrics for program maturity include coverage of asset inventory, percentage of critical patches within SLA, and time to contain incidents.

Risk assessment approaches: qualitative uses ranked scales and judgment, quantitative assigns monetary values such as annualized loss expectancy (ALE = SLE × ARO).

Single loss expectancy (SLE) = asset value × exposure factor; these figures support cost-benefit comparison of candidate controls.

Control cost justification compares the annualized cost of the control against the reduction in expected loss; a control costing more than the risk it removes is hard to justify.

Threat intelligence feeds inform detection and prioritization; relevance to the organization's sector and technology stack determines value.

Regulatory frameworks and standards (ISO/IEC 27001, NIST CSF) provide structure for programs; certification demonstrates process conformity, not absence of risk.

Security awareness metrics include phishing simulation click rate and report rate; falling click rates with rising report rates indicate improving culture.

Incident communications require pre-approved templates and defined spokespeople; uncontrolled disclosure can increase legal and reputational harm.

Continuous improvement closes the loop: lessons learned from incidents feed back into policy, controls, and training rather than remaining a report only.

Authentication assurance depends on factor strength; SMS one-time codes are vulnerable to interception and SIM swapping, so higher-risk systems should prefer app-based or hardware tokens.

Session management controls include idle timeout, absolute timeout, secure cookie flags, and session invalidation on logout or privilege change.

Cross-site request forgery is mitigated by anti-CSRF tokens and SameSite cookies; it exploits ambient credentials rather than stealing them.

Encryption key rotation limits the impact of key compromise; retiring a key requires re-encryption or re-wrapping of data protected by it.

Data remanence is residual data left after deletion; it motivates sanitization before media reuse and disposal.

Security testing types: SAST analyzes source code, DAST tests running applications, and SCA identifies vulnerable third-party components.

Incident response roles include incident commander, communications lead, and technical leads; unclear roles delay containment.

Business email compromise often avoids malware and relies on social engineering and payment fraud; verification of payment changes out of band is the key control.

Firewall rule hygiene: default deny inbound, explicit allow rules, and periodic review to remove stale rules that widen exposure.

Intrusion detection placement matters; network sensors see lateral traffic, while host-based sensors see encrypted and local activity.

Endpoint hardening removes unnecessary services and restricts local admin rights; unmanaged local admin is a common path to privilege escalation.

Security information sharing through sector ISACs provides timely threat data; sharing must respect confidentiality and legal constraints.

Incident severity classification drives notification timelines; misclassifying an incident can breach regulatory reporting deadlines.

Data subject access and deletion requests require the ability to locate personal data across systems, which depends on accurate data mapping.

Security awareness training content should reflect current attack patterns such as phishing, business email compromise, and ransomware delivery.

Program effectiveness is judged by outcomes such as reduced incident frequency, faster detection, and audit findings closed on time.

Cryptographic modes matter: ECB reveals patterns and should be avoided for data with structure; CBC and GCM provide better confidentiality, and GCM adds integrity.

Non-repudiation requires a digital signature with a private key the signer controls; symmetric MACs prove integrity between parties but not which party sent the message.

Certificate pinning reduces man-in-the-middle risk in mobile apps but complicates certificate rotation.

Access review frequency should match risk; privileged and regulated-data access is reviewed more often than general access.

Segregation of environments (development, test, production) prevents test data and test credentials from reaching production systems.

Incident response playbooks specify triggers, steps, and contacts for common scenarios such as ransomware, phishing, and lost devices.

Vendor incident notification clauses require third parties to report breaches affecting the organization's data within agreed timeframes.

Security awareness of physical risk includes clean desk and screen lock policies, which reduce exposure of sensitive information to visitors.

Vulnerability prioritization uses exploitability signals such as known exploited vulnerability catalogs and public exploit availability, not severity alone.

Patch management exceptions require compensating controls such as network isolation, enhanced monitoring, or virtual patching at the WAF.

Asset criticality classification determines control strength; critical systems warrant stronger monitoring, segmentation, and recovery testing.

Incident response communication with legal and privacy teams is triggered when personal data may be affected, to meet notification obligations.

Security architecture reviews at design stage are cheaper than remediation after deployment; retrofitting controls into production is costly and risky.

Threat hunting proactively searches for undetected adversary activity using hypotheses derived from threat intelligence and environment knowledge.

Metrics should avoid vanity measures; counts of blocked attacks say little without context on coverage and detection efficacy.

Continuous monitoring requires alert triage capacity; unstaffed alerting provides no detective value regardless of tool quality.

Risk register records identified risks with owner, likelihood, impact, treatment, and status; a risk without an owner is unlikely to be treated.

Risk appetite states how much risk the organization accepts; risk tolerance defines acceptable variation around that appetite.

Control testing verifies design and operating effectiveness; a control that exists but is not performed consistently is not effective.

Business continuity plans require alternate sites or remote capability, contact lists, and defined activation authority.

Crisis communication planning includes internal escalation, customer notification, and media handling with designated spokespeople.

Third-party assessment depth should match data sensitivity and access level; low-risk vendors need lighter review than those with privileged access.

Audit evidence should be retained and traceable to the control it supports; undocumented controls are difficult to defend in an audit.

Security program reporting to leadership should connect control status to business risk, not only technical findings.

Data encryption scope includes backups, archives, and copies; encrypting production only leaves copies exposed.

Access control enforcement should be centralized where possible; scattered permissions across systems increase the chance of inconsistent policy.

Logging of privileged actions and authentication events supports detection of account misuse and is a common compliance requirement.

Incident containment should preserve evidence; wiping or rebuilding before collection destroys forensic value.

Security awareness of social media risk includes limiting disclosed organizational details that enable pretexting.

Mobile device management enforces encryption, screen lock, and remote wipe for devices holding organizational data.

Cloud misconfiguration risks include public storage buckets and overly permissive identity policies; posture management tools detect these drift conditions.

Program governance requires defined roles, documented policies, and periodic review to remain current as threats and business change.

Authentication failure handling includes account lockout or throttling to resist brute force, balanced against denial-of-service risk to legitimate users.

Passwordless and FIDO-based authentication resist phishing because credentials are bound to the origin and never shared with the relying party.

Encryption of data in use (confidential computing) protects memory-resident data from privileged access; traditional encryption covers only rest and transit.

Security testing scope should include APIs and mobile clients, which are frequently less monitored than web front ends.

Incident response after-action review identifies root cause, control gaps, and assigned corrective actions with due dates.

Business impact analysis should be refreshed when systems or dependencies change; stale RTO and RPO values misdirect recovery investment.

Vendor concentration risk arises when many critical services depend on one provider; continuity planning should consider provider failure.

Security awareness program effectiveness depends on repetition and relevance; one-time annual training produces limited behavior change.

Access control testing includes verifying that terminated users lose access promptly and that role changes remove prior entitlements.

Segregation of duties conflicts occur when one person can both initiate and approve a transaction; detective review compensates where separation is impractical.

Encryption algorithm selection should follow current guidance and avoid deprecated ciphers; protocol configuration matters as much as cipher choice.

Incident response metrics include time to detect, time to contain, and time to recover; these expose gaps in monitoring and playbooks.

Security awareness of ransomware includes recognizing suspicious attachments, reporting quickly, and not paying without escalation.

Data retention schedules reduce legal exposure and storage cost; retaining data beyond need increases breach impact.

Cloud identity misconfiguration such as overly broad roles is a leading cause of cloud incidents; least privilege applies to service accounts too.

Program improvement should be prioritized by risk reduction per unit cost, not by tool novelty.

Vulnerability scanning credentials improve accuracy by detecting missing patches and configuration issues that unauthenticated scans miss.

False positives in scanning consume remediation effort; validation before ticketing preserves team credibility and focus.

Penetration test reports should include scope, methodology, findings with evidence, and remediation guidance; retesting verifies fixes.

Security architecture should assume breach and design detection and containment accordingly, rather than relying only on prevention.

Incident response legal hold requires preserving evidence when litigation is anticipated, overriding normal deletion schedules.

Employee offboarding controls include revoking credentials, recovering devices, and removing physical access on the last day.

Third-party access should be time-bound and monitored; standing vendor accounts are a common audit finding.

Security awareness should include reporting channels so employees know how to report suspected phishing or incidents quickly.

Data classification enforcement includes labeling, handling rules, and technical controls such as DLP and encryption matched to class.

Access control reviews should verify not only who has access but whether the access matches current job duties.

Encryption key custody should separate key management from data administration so administrators cannot read protected data.

Incident response plans require periodic testing; untested plans often fail at communication and decision points.

Security metrics should be reviewed at defined intervals with owners accountable for trends and corrective actions.

Regulatory change monitoring ensures controls remain aligned as laws and contractual requirements evolve.

Cloud logging should be enabled and centralized; default provider logs may be short-lived or incomplete without configuration.

Security awareness of insider risk includes encouraging reporting of unusual behavior while respecting privacy and employment law.

Threat modeling outputs should drive security requirements and test cases, otherwise the exercise has no effect on the delivered system.

Vulnerability remediation SLAs should be tiered by severity and asset criticality, with escalation for overdue critical items.

Incident response tabletop scenarios should reflect realistic threats for the sector, such as ransomware or supply chain compromise.

Security architecture documentation supports audits and onboarding; undocumented designs are hard to assess for control gaps.

Business continuity testing includes failover drills and communication tests, not only plan review.

Third-party contract clauses should cover breach notification, audit rights, data return, and secure deletion at termination.

Security awareness training should be measured by behavior indicators, not completion percentages alone.

Program governance should include an executive sponsor with authority to fund and enforce controls.

Access control should be reviewed after major organizational change such as mergers or restructuring, when entitlements often drift.

Encryption of backups should use keys managed separately from production systems to resist ransomware and insider misuse.

Incident response should include a decision authority for shutting down systems, balancing containment against business impact.

Security testing should include configuration review of cloud and network infrastructure, where misconfigurations are common.

Vulnerability data should be correlated with asset inventory to prioritize by exposure, not raw counts.

Security awareness should address remote work risks such as unsecured networks and device sharing.

Metrics should be compared over time and against targets to show program direction rather than isolated snapshots.

Governance should ensure policies are reviewed and approved at defined intervals and communicated to staff.

Risk treatment decisions should be documented with rationale and approval, so accountability is clear if the risk materializes.

Control frameworks map requirements to controls, which supports audit and gap analysis across multiple obligations.

Incident response should define evidence preservation steps before remediation actions that alter system state.

Security architecture should include segmentation for critical assets and monitoring points at trust boundaries.

Vulnerability management should include third-party and open-source components, not only internally developed code.

Security awareness should be reinforced with timely alerts after real incidents or campaigns affecting the organization.

Third-party risk should include fourth parties, since providers may subcontract processing to other vendors.

Program effectiveness should be reported in business terms, connecting control status to operational and financial risk.

Access control should include periodic review of service and system accounts, which often retain excessive privileges.

Encryption should cover data in transit between internal systems, since flat internal networks expose traffic to interception.

Incident response should define escalation thresholds so severe events reach leadership quickly.

Security testing should include social engineering assessments where policy permits, to measure human-layer controls.

Vulnerability prioritization should consider internet exposure, data sensitivity, and known exploitation activity.

Security awareness should include password manager use and avoidance of credential reuse across services.

Metrics should include coverage of monitoring and logging across critical assets, not only incident counts.

Governance should ensure risk acceptance is time-bound and revisited when circumstances change.

Risk assessment should be repeated at planned intervals and after significant change to systems, threats, or business model.

Control selection should consider cost, effectiveness, and operational impact, not only technical strength.

Incident response should include communication with customers and regulators when obligations are triggered.

Security architecture should design for recovery, including tested backups and documented rebuild procedures.

Vulnerability management should track remediation verification, not only ticket closure.

Security awareness should be localized to the organization's systems and processes to be actionable.

Third-party risk should include monitoring for vendor breaches that may affect the organization's data.

Program reporting should highlight trends and unresolved risks requiring management decision.

Access control should be tested through simulated unauthorized attempts to confirm enforcement, not only policy review.

Encryption should be verified in practice, including configuration of protocols and certificate validity.

Incident response should include a lessons-learned phase with tracked corrective actions and owners.

Security testing should be scoped to include authentication, authorization, session management, and input handling.

Vulnerability data should be deduplicated and validated to avoid inflated counts and wasted effort.

Security awareness should include reporting metrics and follow-up on reported phishing to reinforce behavior.

Metrics should be actionable and tied to decisions such as resource allocation or control changes.

Governance should ensure security requirements are included in project and procurement processes from the start.

Risk register reviews should confirm treatment status and update likelihood and impact as conditions change.

Control testing should sample across time and systems to detect inconsistent operation.

Incident response should include defined communication channels that remain available if primary systems are compromised.

Security architecture should limit trust between internal segments and verify identity for each access request.

Vulnerability management should include configuration weaknesses as well as software flaws.

Security awareness should address phishing reporting speed, since early reporting reduces incident impact.

Third-party risk should include assessment of the vendor's incident history and response capability.

Program governance should ensure security objectives align with business objectives and are reviewed annually.

Access control should include monitoring for anomalous access patterns such as bulk downloads or off-hours privileged use.

Encryption should be validated after changes to infrastructure, since misconfiguration can silently disable it.

Incident response should include preservation of logs and volatile data before containment actions that may destroy evidence.

Security testing should be repeated after significant changes and at defined intervals to catch regressions.

Vulnerability prioritization should weigh exploit availability and attacker interest alongside severity scores.

Security awareness should include clear guidance on handling sensitive data and reporting loss or theft of devices.

Metrics should be reviewed with trend analysis to distinguish noise from sustained change.

Governance should ensure policies are enforced through technical controls where feasible, not only stated intent.

Risk treatment should consider transferring risk through insurance or contracts, while recognizing reputational risk remains.

Control frameworks should be tailored to the organization rather than adopted wholesale without gap analysis.

Incident response should include a communication plan for internal stakeholders to reduce rumor and confusion.

Security architecture should include redundancy for critical services to support availability objectives.

Vulnerability management should include patch testing where stability risk is high, with compensating controls in the interim.

Security awareness should include recognition of business email compromise indicators such as urgency and payment changes.

Third-party risk should include contractual requirements for security controls and breach notification timelines.

Program reporting should include resource needs and gaps that require management action.

Access control should be reviewed when employees change roles to remove entitlements no longer needed.

Encryption should be applied to portable media and endpoints to reduce loss impact.

Incident response should define criteria for declaring an incident and for standing down after recovery.

Security testing should include verification of logging and alerting for tested attack paths.

Vulnerability management should track aging of open findings to expose backlog risk.

Security awareness should be reinforced through short, frequent communications rather than annual sessions only.

Metrics should include detection coverage and response times to reflect operational readiness.

Governance should ensure security risk is included in enterprise risk reporting to leadership.

Risk assessment should consider insider threat and supply chain scenarios alongside external attacks.

Control selection should include detective and corrective controls, since prevention alone will eventually fail.

Incident response should include contact and escalation lists that are tested and kept current.

Security architecture should apply least privilege to service accounts and automation credentials.

Vulnerability management should include network devices and appliances, which are often overlooked.

Security awareness should include physical security awareness such as challenging unescorted visitors.

Third-party risk should include review of vendor subcontractors and data location.

Program reporting should show progress against planned improvements and remaining gaps.

Access control should be enforced at the data layer where possible to protect against application bypass.

Encryption should be verified for backups and archives, which are frequent targets in ransomware incidents.

Incident response should include a forensic image process to preserve evidence for investigation.

Security testing should include review of error handling to avoid information leakage.

Vulnerability prioritization should consider compensating controls already in place.

Security awareness should include guidance on verifying requests for sensitive information through a second channel.

Metrics should include coverage of security controls across asset inventory to expose blind spots.

Governance should ensure security policies are accessible and acknowledged by staff.

Risk treatment should be revisited when threat landscape or business context changes materially.

Control testing should include verification that alerts are reviewed and acted upon, not only generated.

Incident response should include post-incident communication to affected parties where required.

Security architecture should include monitoring at identity, endpoint, network, and cloud layers.

Vulnerability management should include verification scans after remediation to confirm closure.

Security awareness should include reporting suspicious emails without clicking or forwarding attachments.

Third-party risk should include periodic reassessment based on vendor criticality.

Program reporting should connect security metrics to business outcomes such as uptime and customer trust.

Access control should include strong authentication for remote and administrative access.

Encryption should include certificate lifecycle management to avoid outages from expiry.

Incident response should include defined roles for legal, communications, and technical teams.

Security testing should include cloud configuration review against established baselines.

Vulnerability management should include tracking of exceptions with expiry and compensating controls.

Security awareness should include training on recognizing social engineering beyond email, such as phone and in-person attempts.

Metrics should be reviewed against targets and used to adjust priorities.

Governance should ensure security requirements are included in contracts and vendor selection.

Risk assessment should document assumptions and data sources so results can be reviewed and repeated.

Control selection should consider operational feasibility and staff capability to sustain the control.

Incident response should include a plan for restoring from backups with verification of integrity.

Security architecture should include logging and monitoring for cloud control planes and identity systems.

Vulnerability management should include asset discovery to find unknown or shadow systems.

Security awareness should include guidance on secure use of personal devices for work where permitted.

Third-party risk should include review of vendor access to systems and data.

Program reporting should include decisions needed from leadership and associated risk trade-offs.

Access control should include periodic review of privileged group membership and administrative rights.

Encryption should be validated for data at rest in databases and object storage, not only on endpoints.

Incident response should include criteria for engaging external forensic or legal support.

Security testing should include verification of access control enforcement across user roles.

Vulnerability management should include prioritization based on business criticality of affected systems.

Security awareness should include phishing indicators such as mismatched sender domains and urgent requests.

Metrics should include time to remediate critical vulnerabilities and percentage within SLA.

Governance should ensure security policies are reviewed after incidents and audit findings.

Risk register should include third-party and cloud risks alongside internal system risks.

Control testing should include review of configuration baselines against actual system settings.

Incident response should include a process for notifying customers and partners when required.

Security architecture should include segmentation of OT and IoT environments where applicable.

Vulnerability management should include firmware and embedded systems in scope.

Security awareness should include safe browsing and download practices for remote workers.

Third-party risk should include assessment of vendor security certifications and audit reports.

Program reporting should include trend data on incidents and control effectiveness.

Access control should be reviewed after departures to confirm account disablement and device recovery.

Encryption should include key rotation schedules and documented recovery procedures.

Incident response should include evidence handling procedures that maintain chain of custody.

Security testing should include verification of input validation and output encoding to resist injection and scripting attacks.

Vulnerability management should include remediation verification and reporting to management.

Security awareness should include training on recognizing and reporting insider risk indicators.

Metrics should include detection and response times segmented by severity.

Governance should ensure security risk decisions are documented and approved at the appropriate level.

Risk treatment should include monitoring to confirm controls remain effective over time.

Control frameworks should be mapped to regulatory obligations to avoid duplicate effort.

Incident response should include a communication plan for regulators where reporting is mandatory.

Security architecture should include defense in depth across identity, endpoint, network, data, and cloud.

Vulnerability management should include tracking of remediation ownership and due dates.

Security awareness should include training on secure handling of credentials and MFA prompts.

Third-party risk should include review of vendor incident response and notification capabilities.

Program reporting should include a summary of top risks and treatment status for leadership.

Access control should include monitoring for failed authentication spikes that may indicate brute force or credential stuffing.

Encryption should be verified for data in transit between cloud services and on-premises systems.

Incident response should include a plan for communicating with employees during a disruption.

Security testing should include verification of rate limiting and anti-automation controls.

Vulnerability management should include prioritization of internet-facing assets with known exploited vulnerabilities.

Security awareness should include training on identifying and reporting business email compromise attempts.

Metrics should include coverage of logging and monitoring across critical systems.

Governance should ensure security policies are supported by technical enforcement where possible.

Risk assessment should include scenario analysis for high-impact events such as ransomware.

Control testing should include verification of backup restoration and integrity.

Incident response should include a process for preserving logs and evidence during recovery.

Security architecture should include monitoring for anomalous identity behavior such as impossible travel.

Vulnerability management should include tracking of vendor patch availability for third-party components.

Security awareness should include training on recognizing fake login pages and credential harvesting.

Third-party risk should include review of vendor data handling and retention practices.

Program reporting should include progress on closing audit findings and control gaps.

Access control should include review of API keys and tokens for excessive scope or long lifetime.

Encryption should include protection of secrets in code repositories and configuration files.

Incident response should include a process for rotating credentials after compromise.

Security testing should include verification of authentication and session management controls.

Vulnerability management should include scanning of containers and images for vulnerable components.

Security awareness should include training on secure use of collaboration tools and file sharing.

Metrics should include percentage of critical assets covered by vulnerability scanning.

Governance should ensure security requirements are included in software development lifecycle processes.

Risk treatment should include monitoring of third-party risk and supply chain dependencies.

Control testing should include verification of access reviews and timely deprovisioning.

Incident response should include a process for engaging law enforcement where appropriate.

Security architecture should include logging of administrative actions for accountability.

Vulnerability management should include tracking of mean time to remediate by severity.

Security awareness should include training on recognizing and reporting lost or stolen devices.

Third-party risk should include review of vendor security incident history and response times.

Program reporting should include a summary of security posture and improvement plans.

Access control should include review of cloud identity policies for overly permissive roles.

Encryption should include protection of data in backups and snapshots.

Incident response should include a process for restoring services in priority order based on business impact.

Security testing should include verification of logging and monitoring for cloud control planes.

Vulnerability management should include tracking of configuration drift against baselines.

Security awareness should include training on recognizing phishing via SMS and messaging apps.

Metrics should include percentage of incidents detected by monitoring versus reported by users.

Governance should ensure security policies are reviewed and updated after significant changes.

Risk assessment should include consideration of insider threat and third-party access.

Control testing should include verification of incident response plan testing and updates.

Incident response should include a process for communicating with customers during outages.

Security architecture should include monitoring for data exfiltration patterns.

Vulnerability management should include tracking of exceptions and compensating controls.

Security awareness should include training on secure remote access and VPN use.

Third-party risk should include review of vendor access controls and monitoring.

Program reporting should include metrics on control effectiveness and risk reduction.

Access control should include review of service account permissions and rotation of credentials.

Encryption should include protection of data in transit for internal service communication.

Incident response should include a process for documenting decisions and actions during an incident.

Security testing should include verification of authorization checks across all endpoints.

Vulnerability management should include tracking of remediation timelines against SLAs.

Security awareness should include training on recognizing social engineering via phone and in person.

Metrics should include time to detect and contain incidents by severity.

Governance should ensure security risk is included in business continuity and disaster recovery planning.

Risk treatment should include monitoring of control effectiveness over time.

Control testing should include verification of logging and alerting for critical events.

Incident response should include a process for preserving evidence and maintaining chain of custody.

Security architecture should include segmentation and monitoring at trust boundaries.

Vulnerability management should include scanning of cloud and on-premises assets.

Security awareness should include training on recognizing and reporting suspicious activity.

Third-party risk should include review of vendor security controls and certifications.

Program reporting should include a summary of top risks and treatment status.

Access control should include review of privileged access and session monitoring.

Encryption should include protection of data at rest in databases and file shares.

Incident response should include a process for communicating with regulators and customers.

Security testing should include verification of input validation and error handling.

Vulnerability management should include tracking of patch latency and exceptions.

Security awareness should include training on secure password practices and MFA.

Metrics should include coverage of security monitoring across critical assets.

Governance should ensure security policies are enforced and reviewed periodically.