-
Notifications
You must be signed in to change notification settings - Fork 293
/
Copy pathadobe-ccf-v5.yaml
9770 lines (9108 loc) · 504 KB
/
adobe-ccf-v5.yaml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
urn: urn:intuitem:risk:library:adobe-ccf-v5
locale: en
ref_id: adobe-ccf-v5
name: Adobe CCF v5
description: 'Adobe Common Controls Framework (CCF) version 5
https://www.adobe.com/trust/compliance/adobe-ccf.html
'
copyright: Creative Commons
version: 2
publication_date: 2024-09-28
provider: Adobe
packager: intuitem
objects:
framework:
urn: urn:intuitem:risk:framework:adobe-ccf-v5
ref_id: adobe-ccf-v5
name: Adobe CCF v5
description: 'Adobe Common Controls Framework (CCF) version 5
https://www.adobe.com/trust/compliance/adobe-ccf.html
'
requirement_nodes:
- urn: urn:intuitem:risk:req_node:adobe-ccf-v5:node2
assessable: false
depth: 1
name: Asset Management
- urn: urn:intuitem:risk:req_node:adobe-ccf-v5:am-01
assessable: true
depth: 2
parent_urn: urn:intuitem:risk:req_node:adobe-ccf-v5:node2
ref_id: AM-01
name: Inventory Management
description: Organization maintains an inventory of information systems, which
is reconciled on a periodic basis.
annotation: '1. Design and document a process for maintaining an inventory of
information systems for management of assets within an organization.
2. Perform inventory reconciliation on a periodic basis.
3. Create and maintain periodic reconciliation documentation.'
typical_evidence: 'E-AM-01 - Asset Management Policy
E-AM-02 - Asset Inventory
E-AM-03 - Asset Reconciliation Records'
question:
question_type: unique_choice
question_choices: &id001
- 'Yes'
- 'No'
- N/A
questions:
- urn: urn:intuitem:risk:req_node:adobe-ccf-v5:am-01:question:1
text: 1. Inspect the policy and standard to determine whether requirements
for maintaining and reconciling a system of inventory for information
systems are defined.
- urn: urn:intuitem:risk:req_node:adobe-ccf-v5:am-01:question:2
text: 2. Observe the inventory of system devices to determine whether the
organization maintains the inventory in a system of record.
- urn: urn:intuitem:risk:req_node:adobe-ccf-v5:am-01:question:3
text: 3. Inspect periodic reconciliation documentation to determine whether
reconciliation was performed.
- urn: urn:intuitem:risk:req_node:adobe-ccf-v5:am-02
assessable: true
depth: 2
parent_urn: urn:intuitem:risk:req_node:adobe-ccf-v5:node2
ref_id: AM-02
name: 'Inventory Management: Applications'
description: Organization maintains an inventory of application assets, which
is reconciled on a periodic basis.
annotation: '1. Design and document a process for maintaining an inventory of
application assets for management of assets within an organization.
2. Perform inventory reconciliation on a periodic basis.
3. Create and maintain periodic reconciliation documentation.'
typical_evidence: 'E-AM-01 - Asset Management Policy
E-AM-02 - Asset Inventory
E-AM-03 - Asset Reconciliation Records'
question:
question_type: unique_choice
question_choices: *id001
questions:
- urn: urn:intuitem:risk:req_node:adobe-ccf-v5:am-02:question:1
text: 1. Inspect the policy and standard to determine whether requirements
for maintaining and reconciling a system of inventory for application
assets are defined.
- urn: urn:intuitem:risk:req_node:adobe-ccf-v5:am-02:question:2
text: 2. Observe the inventory of system devices to determine whether the
organization maintains the inventory in a system of record.
- urn: urn:intuitem:risk:req_node:adobe-ccf-v5:am-02:question:3
text: 3. Inspect periodic reconciliation documentation to determine whether
reconciliation was performed.
- urn: urn:intuitem:risk:req_node:adobe-ccf-v5:am-03
assessable: true
depth: 2
parent_urn: urn:intuitem:risk:req_node:adobe-ccf-v5:node2
ref_id: AM-03
name: 'Inventory Reconciliation: ARP Table'
description: Organization reconciles network discovery scans against the established
device inventory on a quarterly basis; non-inventoried devices are assigned
an owner.
annotation: '1. Design and document a process for conducting network discovery
scans on a periodic basis.
2. Ensure the results of the scans are reconciled with the system asset inventory
at least quarterly.
3. Ensure necessary actions are taken to include non-inventoried assets in
the inventory with appropriate ownership details.'
typical_evidence: 'E-AM-04 - Network Discovery Scan Records
E-AM-03 - Asset Reconciliation Records
E-AM-02 - Asset Inventory'
question:
question_type: unique_choice
question_choices: *id001
questions:
- urn: urn:intuitem:risk:req_node:adobe-ccf-v5:am-03:question:1
text: '1. Inspect network discovery scans result to ensure periodic scans
were conducted. '
- urn: urn:intuitem:risk:req_node:adobe-ccf-v5:am-03:question:2
text: 2. Observe the reconciliation report of network discovery scans against
the established device inventory to determine that the inventories are
reconciled on a quarterly basis.
- urn: urn:intuitem:risk:req_node:adobe-ccf-v5:am-03:question:3
text: 3. Inspect the device inventory to ensure non-inventoried devices
have been added and have a designed owner.
- urn: urn:intuitem:risk:req_node:adobe-ccf-v5:am-04
assessable: true
depth: 2
parent_urn: urn:intuitem:risk:req_node:adobe-ccf-v5:node2
ref_id: AM-04
name: 'Inventory Reconciliation: Logging'
description: Organization reconciles the enterprise log repository against the
established device inventory on a quarterly basis; non-inventoried devices
are assigned an owner.
annotation: '1. Ensure logs from enterprise logging solutions are reconciled
with the system device asset inventory on a quarterly basis.
2. Ensure necessary actions are taken to include non-inventoried assets in
the inventory with appropriate ownership details'
typical_evidence: 'E-AM-03 - Asset Reconciliation Records
E-AM-02 - Asset Inventory'
question:
question_type: unique_choice
question_choices: *id001
questions:
- urn: urn:intuitem:risk:req_node:adobe-ccf-v5:am-04:question:1
text: 1. Inspect the reconciliation report of enterprise log repository
against the established device inventory to determine that the inventories
are reconciled on a quarterly basis.
- urn: urn:intuitem:risk:req_node:adobe-ccf-v5:am-04:question:2
text: 2. Inspect the non-inventoried devices to determine that the assets
have a designed owner.
- urn: urn:intuitem:risk:req_node:adobe-ccf-v5:am-05
assessable: true
depth: 2
parent_urn: urn:intuitem:risk:req_node:adobe-ccf-v5:node2
ref_id: AM-05
name: Inventory Labels
description: Organization assets are labeled and have designated owners.
annotation: '1. Ensure all assets in the system device asset inventory are assigned
appropriate labels as per the organization''s labelling procedures.
2. Ensure each asset has an assigned owner and accuracy is maintained.'
typical_evidence: 'E-AM-02 - Asset Inventory
E-AM-01 - Asset Management Policy'
question:
question_type: unique_choice
question_choices: *id001
questions:
- urn: urn:intuitem:risk:req_node:adobe-ccf-v5:am-05:question:1
text: 1. Inspect documentation to determine whether requirements for asset
labelling ownership assessment are defined.
- urn: urn:intuitem:risk:req_node:adobe-ccf-v5:am-05:question:2
text: 2. Inspect the asset listings to determine whether the assets are
labelled and have a designated owner.
- urn: urn:intuitem:risk:req_node:adobe-ccf-v5:am-05:question:3
text: 3. For a sample of services, inspect the asset reports to determine
asset are labelled and have a designated owner.
- urn: urn:intuitem:risk:req_node:adobe-ccf-v5:am-05:question:4
text: 4. Observe and compare physical assets at an organization's data center
to determine whether the assets were labelled according to in-scope asset
listings.
- urn: urn:intuitem:risk:req_node:adobe-ccf-v5:am-06
assessable: true
depth: 2
parent_urn: urn:intuitem:risk:req_node:adobe-ccf-v5:node2
ref_id: AM-06
name: Media Marking
description: Where applicable, Organization marks information system media indicating
the distribution limitations, handling caveats, and applicable security markings
(if any) of the information. Exemptions must be approved by management and
remain in a specific controlled area.
annotation: '1. Ensure that a process is established and documented for media
marking and handling, including distribution limitation.
2. Ensure that sensitive information containing media is marked as per the
organization''s media marking requirements as applicable.
3. Ensure that any exceptions are approved by management, documented and retained
by authorized personnel.'
typical_evidence: 'E-AM-01 - Asset Management Policy
E-AM-05 - Evidence of Media Snapshots'
question:
question_type: unique_choice
question_choices: *id001
questions:
- urn: urn:intuitem:risk:req_node:adobe-ccf-v5:am-06:question:1
text: 1. Inspect information system media marking to indicate the distribution
limitations, handling caveats, and applicable security markings (if any)
of the information.
- urn: urn:intuitem:risk:req_node:adobe-ccf-v5:am-06:question:2
text: 2. Inspect exemption cases to validate that it must be approved by
management and remain in a specific area.
- urn: urn:intuitem:risk:req_node:adobe-ccf-v5:am-07
assessable: true
depth: 2
parent_urn: urn:intuitem:risk:req_node:adobe-ccf-v5:node2
ref_id: AM-07
name: Asset Transportation Authorization
description: Organization authorizes and records the entry and exit of systems
at datacenter locations.
annotation: '1. Ensure a process is established and documented to control the
transport of assets in and out of data center locations.
2. Ensure appropriate records and approvals are obtained and maintained against
entry and exit of each asset.'
typical_evidence: 'E-AM-01 - Asset Management Policy
E-AM-06 - Asset Movement Records'
question:
question_type: unique_choice
question_choices: *id001
questions:
- urn: urn:intuitem:risk:req_node:adobe-ccf-v5:am-07:question:1
text: 1. Inspect the policy and/or standard to determine whether requirements
have been established to authorize and record the entry and exit of systems
at datacenter locations.
- urn: urn:intuitem:risk:req_node:adobe-ccf-v5:am-07:question:2
text: 2. Inspect evidence of asset movement from a sample of data centers
and colocations.
- urn: urn:intuitem:risk:req_node:adobe-ccf-v5:am-08
assessable: true
depth: 2
parent_urn: urn:intuitem:risk:req_node:adobe-ccf-v5:node2
ref_id: AM-08
name: Asset Transportation Documentation
description: Organization documents the transportation of physical media outside
of datacenters. Physical media is packaged securely and transported in a secure,
traceable manner.
annotation: '1. Ensure appropriate records and approvals are obtained and documented
against entry and exit of each asset.
2. Ensure all assets being transported are secured as per the organization''s
policy and can be tracked when offsite.'
typical_evidence: 'E-AM-01 - Asset Management Policy
E-AM-06 - Asset Movement Records'
question:
question_type: unique_choice
question_choices: *id001
questions:
- urn: urn:intuitem:risk:req_node:adobe-ccf-v5:am-08:question:1
text: 1. Inspect the policy and/or standard to determine whether the transportation
of physical media outside of datacenters are defined.
- urn: urn:intuitem:risk:req_node:adobe-ccf-v5:am-08:question:2
text: 2. Inspect the logs of physical media evidence that have been transported
to determine that physical media is packed securely and transported in
a secure, traceable manner.
- urn: urn:intuitem:risk:req_node:adobe-ccf-v5:am-09
assessable: true
depth: 2
parent_urn: urn:intuitem:risk:req_node:adobe-ccf-v5:node2
ref_id: AM-09
name: Use of Portable Media
description: The use of portable media in Organization datacenters is prohibited
unless explicitly authorized by management.
annotation: '1. Ensure policy and procedures are established and communicated
prohibiting the use of portable media.
2. Ensure necessary controls are in place to detect the usage of portable
media inside the organization''s network.
3. Ensure any exceptions are documented based on business justification and
need and are approved appropriately.'
typical_evidence: 'E-AM-01 - Asset Management Policy
E-AM-07 - Portable Media Configuration Evidence'
question:
question_type: unique_choice
question_choices: *id001
questions:
- urn: urn:intuitem:risk:req_node:adobe-ccf-v5:am-09:question:1
text: 1. Inspect the policy and/or standard to determine that the use of
portable media in the datacenters is prohibited unless explicitly authorized
by management.
- urn: urn:intuitem:risk:req_node:adobe-ccf-v5:am-09:question:2
text: 2. Inspect Configurations to detect the use of portable media.
- urn: urn:intuitem:risk:req_node:adobe-ccf-v5:am-10
assessable: true
depth: 2
parent_urn: urn:intuitem:risk:req_node:adobe-ccf-v5:node2
ref_id: AM-10
name: Maintenance of Assets
description: Equipment maintenance is documented and approved according to management
requirements.
annotation: '1. Ensure a process is established and documented for maintenance
of assets.
2. Ensure all maintenance is approved by the management and is carried out
through approved vendors.
3. Ensure proper testing of equipment is conducted post maintenance before
use.'
typical_evidence: 'E-AM-01 - Asset Management Policy
E-AM-08 - Asset Maintenance Records'
question:
question_type: unique_choice
question_choices: *id001
questions:
- urn: urn:intuitem:risk:req_node:adobe-ccf-v5:am-10:question:1
text: 1. Inspect the policy and/or standard to determine whether management
requirements have been established for the documentation and approval
of equipment maintenance.
- urn: urn:intuitem:risk:req_node:adobe-ccf-v5:am-10:question:2
text: 2. Inspect equipment maintenance requests to determine whether equipment
maintenance is documented and approved according to management requirements.
- urn: urn:intuitem:risk:req_node:adobe-ccf-v5:am-11
assessable: true
depth: 2
parent_urn: urn:intuitem:risk:req_node:adobe-ccf-v5:node2
ref_id: AM-11
name: Tampering of Payment Card Capture Devices
description: Devices that physically capture payment card data are inspected
for evidence of tampering on a semi-annual basis.
annotation: '1. Ensure all payment card devices are inspected on semiannual
basis to check for tampering.
2. Ensure that appropriate documentation is maintained regarding maintenance
activities of these devices'
typical_evidence: E-AM-09 - Payment Card Device Verification Records
question:
question_type: unique_choice
question_choices: *id001
questions:
- urn: urn:intuitem:risk:req_node:adobe-ccf-v5:am-11:question:1
text: 1. Inspect devices verification records for tampering check.
- urn: urn:intuitem:risk:req_node:adobe-ccf-v5:am-11:question:2
text: 2. Inspect and validate whether these verification were done at least
semi-annually.
- urn: urn:intuitem:risk:req_node:adobe-ccf-v5:am-12
assessable: true
depth: 2
parent_urn: urn:intuitem:risk:req_node:adobe-ccf-v5:node2
ref_id: AM-12
name: 'Component Installation: Inspection and Approval'
description: Prior to installation in a production network, hardware components
are inspected for improper or unauthorized modifications.
annotation: '1. Ensure a process is established and documented for approval
of hardware prior to installation on production.
2. Ensure each asset is inspected with agreed on procedures before being enabled
on production.'
typical_evidence: 'E-AM-01 - Asset Management Policy
E-AM-10 - Hardware Installation Records'
question:
question_type: unique_choice
question_choices: *id001
questions:
- urn: urn:intuitem:risk:req_node:adobe-ccf-v5:am-12:question:1
text: 1. Validate if a process exists for the approval and verification
of hardware prior to production installation.
- urn: urn:intuitem:risk:req_node:adobe-ccf-v5:am-12:question:2
text: 2. Inspect hardware components installation records in a production
network to determine that modifications were validated before installation.
- urn: urn:intuitem:risk:req_node:adobe-ccf-v5:am-13
assessable: true
depth: 2
parent_urn: urn:intuitem:risk:req_node:adobe-ccf-v5:node2
ref_id: AM-13
name: Software bill of Material
description: Organization maintains a comprehensive software bill of materials
annotation: '1. Ensure a Software bill of material is established.
2. Ensure that a process has been established and documented for the addition,
removal, and update of components from SBOM.'
typical_evidence: 'E-AM-01 - Asset Management Policy
E-AM-11 - Software Bill of Materials'
question:
question_type: unique_choice
question_choices: *id001
questions:
- urn: urn:intuitem:risk:req_node:adobe-ccf-v5:am-13:question:1
text: 1. Inspect and validate that a Software bill of material is established.
- urn: urn:intuitem:risk:req_node:adobe-ccf-v5:am-13:question:2
text: 2. Validate that a process has been established and documented for
addition, removal, and update of components from SBOM.
- urn: urn:intuitem:risk:req_node:adobe-ccf-v5:node16
assessable: false
depth: 1
name: Business Continuity
- urn: urn:intuitem:risk:req_node:adobe-ccf-v5:bc-01
assessable: true
depth: 2
parent_urn: urn:intuitem:risk:req_node:adobe-ccf-v5:node16
ref_id: BC-01
name: Business Continuity Plan
description: Organization's business contingency plan is periodically reviewed,
approved by management and communicated to relevant team members.
annotation: '1. Design and document a process for Business Continuity and Disaster
Recovery.
2. Define steps for recovery with all roles and responsibilities in the Business
Continuity Plan.
3. Ensure that the Business Continuity Plan is approved by the process owners,
and is communicated to all the relevant team members.'
typical_evidence: 'E-BC-01 - Business Continuity Policy
E-BC-02 - Business Continuity Plan'
question:
question_type: unique_choice
question_choices: *id001
questions:
- urn: urn:intuitem:risk:req_node:adobe-ccf-v5:bc-01:question:1
text: 1. Inspect and validate whether the Business Continuity and Disaster
Recovery Processes are designed and documented.
- urn: urn:intuitem:risk:req_node:adobe-ccf-v5:bc-01:question:2
text: "2. Inspect Organization's Business Continuity Plan (\u201CBCP\u201D\
) to determine whether Organization has established recovery steps and\
\ phases, recovery capabilities, and identified personnel responsible\
\ to execute recovery procedures."
- urn: urn:intuitem:risk:req_node:adobe-ccf-v5:bc-01:question:3
text: "3. Inspect the most recent version of Organization\u2019s BCP to\
\ determine whether it is periodically reviewed and approved."
- urn: urn:intuitem:risk:req_node:adobe-ccf-v5:bc-01:question:4
text: "4. Inspect the corporate intranet to determine whether Organization\u2019\
s BCP is communicated to relevant team members."
- urn: urn:intuitem:risk:req_node:adobe-ccf-v5:bc-02
assessable: true
depth: 2
parent_urn: urn:intuitem:risk:req_node:adobe-ccf-v5:node16
ref_id: BC-02
name: 'Business Continuity Plan: Personal Health Information'
description: Organization's Business Contingency Plan addresses how to access
facilities and obtain data during an emergency.
annotation: 1. Ensure that steps to be followed in case of an emergency are
clearly mentioned in the Business Continuity Plan so that access to the facilities
and data is facilitated during an emergency.
typical_evidence: E-BC-02 - Business Continuity Plan
question:
question_type: unique_choice
question_choices: *id001
questions:
- urn: urn:intuitem:risk:req_node:adobe-ccf-v5:bc-02:question:1
text: 1. Inspect an organization's Business Contingency Plan to determine
whether Organization has addresses how to access facilities and obtain
data during an emergency.
- urn: urn:intuitem:risk:req_node:adobe-ccf-v5:bc-03
assessable: true
depth: 2
parent_urn: urn:intuitem:risk:req_node:adobe-ccf-v5:node16
ref_id: BC-03
name: 'Business Continuity Plan: Roles and Responsibilities'
description: Business contingency roles and responsibilities are assigned to
individuals and their contact information is communicated to authorized personnel.
annotation: '1. Check that roles and responsibilities are clearly defined in
the Business Continuity Plan. There should be proper demarcation of responsibilities
during each phase of the crisis.
2. Ensure that the contact information for all the stakeholders is defined
within Business Continuity Plan and should be up to date, documented, and
communicated to all authorized personnel.
3. Ensure that people with roles and responsibilities within Business Continuity
Plans are well aware of their responsibilities.'
typical_evidence: E-BC-02 - Business Continuity Plan
question:
question_type: unique_choice
question_choices: *id001
questions:
- urn: urn:intuitem:risk:req_node:adobe-ccf-v5:bc-03:question:1
text: 1. Inspect documentation consisting of business contingency roles
and responsibilities. .
- urn: urn:intuitem:risk:req_node:adobe-ccf-v5:bc-03:question:2
text: 2. Inspect whether the contact information of personnel with business
continuity responsibilities are documented within the Business Continuity
Plan.
- urn: urn:intuitem:risk:req_node:adobe-ccf-v5:bc-03:question:3
text: 3. Inspect evidence to check whether roles and responsibilities are
communicated to all applicable stakeholders and audience
- urn: urn:intuitem:risk:req_node:adobe-ccf-v5:bc-04
assessable: true
depth: 2
parent_urn: urn:intuitem:risk:req_node:adobe-ccf-v5:node16
ref_id: BC-04
name: Continuity Testing
description: "Organization performs business contingency and disaster recovery\
\ tests on a periodic basis and ensures the following: \n\u2022 tests are\
\ executed with relevant contingency teams\n\u2022 test results are documented\n\
\u2022 corrective actions are taken for exceptions noted\n\u2022 plans are\
\ updated based on results"
annotation: '1. Ensure that Business Continuity testing should be performed
on a periodic basis as per the organization policy.
2. The business continuity testing should emulate the Business Continuity
Plan and should check the coverage and efficiency of the plan. All the relevant
team preparedness should be assessed in this testing.
3. Ensure that the test results are documented, and any exceptions are noted
and appropriate corrective action is undertaken.'
typical_evidence: E-BC-03 - Business Continuity/Disaster Recovery Test Results
question:
question_type: unique_choice
question_choices: *id001
questions:
- urn: urn:intuitem:risk:req_node:adobe-ccf-v5:bc-04:question:1
text: 1. Inspect whether Business Continuity Testing was performed on a
periodic basis as per the organization's policy.
- urn: urn:intuitem:risk:req_node:adobe-ccf-v5:bc-04:question:2
text: 2. Inspect the most recent BCP test and inspect DR tests results to
determine whether tests were executed and results were documented.
- urn: urn:intuitem:risk:req_node:adobe-ccf-v5:bc-04:question:3
text: 3. Validate whether the results of the testing exercises were tracked
to remediation.
- urn: urn:intuitem:risk:req_node:adobe-ccf-v5:bc-05
assessable: true
depth: 2
parent_urn: urn:intuitem:risk:req_node:adobe-ccf-v5:node16
ref_id: BC-05
name: Business Impact Analysis
description: Organization identifies the business impact of relevant threats
to assets, infrastructure, and resources that support critical business functions.
Recovery objectives are established for critical business functions.
annotation: "1. Design and document a process for conducting Business Impact\
\ Analysis to determine the criticality of business activities and associated\
\ resource requirements.\n2. Ensure that BIA is conducted for all processes\
\ and assets to identify criticality.\n3. Ensure that recovery objectives\
\ are established for critical processes.\n "
typical_evidence: 'E-BC-01 - Business Continuity Policy
E-BC-02 - Business Continuity Plan'
question:
question_type: unique_choice
question_choices: *id001
questions:
- urn: urn:intuitem:risk:req_node:adobe-ccf-v5:bc-05:question:1
text: 1. Inspect and validate whether a documented process exists for conducting
Business Impact Analysis.
- urn: urn:intuitem:risk:req_node:adobe-ccf-v5:bc-05:question:2
text: 2. Inspect Business Impact Analysis to determine whether the threats
to assets, infrastructure, and resources are identified and the recovery
objectives are established.
- urn: urn:intuitem:risk:req_node:adobe-ccf-v5:bc-06
assessable: true
depth: 2
parent_urn: urn:intuitem:risk:req_node:adobe-ccf-v5:node16
ref_id: BC-06
name: Capacity Forecasting
description: Budgets for infrastructure capacity are established based on analysis
of historical business activity and growth projections; purchases are made
against the established budget and plans are updated on a quarterly basis.
annotation: "1. Ensure that capacity forecasts are created based on the business\
\ forecasts, growth projections and analysis of historic business activity.\n\
\ \n2. Ensure that budget allocation is done for infrastructure and resources\
\ basis Capacity forecasts."
typical_evidence: E-BC-05 - Capacity Planning Meeting Minutes
question:
question_type: unique_choice
question_choices: *id001
questions:
- urn: urn:intuitem:risk:req_node:adobe-ccf-v5:bc-06:question:1
text: 1. Inspect and validate whether capacity planning was done and forecasts
were created.
- urn: urn:intuitem:risk:req_node:adobe-ccf-v5:bc-06:question:2
text: 2. Validate whether budgets were established and capacity forecasts
were taken into the account for the same.
- urn: urn:intuitem:risk:req_node:adobe-ccf-v5:node23
assessable: false
depth: 1
name: Backup Management
- urn: urn:intuitem:risk:req_node:adobe-ccf-v5:bm-01
assessable: true
depth: 2
parent_urn: urn:intuitem:risk:req_node:adobe-ccf-v5:node23
ref_id: BM-01
name: Backup Configuration
description: Organization configures redundant systems or performs periodic
backups of data to resume system operations in the event of a system failure.
annotation: '1. Ensure that Backup and Restoration process is established, documented
and communicated to all the relevant stakeholders.
2. Ensure that all the information systems have redundancy or should be backed
up periodically. Periodicity of the backup should be defined basis the criticality
of the information system and data.
3. Check the backup configuration for all the storage/database resources whether
on-prem or on cloud.
4. Ensure that alert are in place for backup failures and all backup failures
are handled appropriately.'
typical_evidence: 'E-BM-01 - Backup Management Policy
E-BM-07 - Backup Configuration Evidence'
question:
question_type: unique_choice
question_choices: *id001
questions:
- urn: urn:intuitem:risk:req_node:adobe-ccf-v5:bm-01:question:1
text: 1. Inspect documentation to determine whether requirements for the
configuration of redundant systems or performance of periodic backups
of data to resume system operations are defined.
- urn: urn:intuitem:risk:req_node:adobe-ccf-v5:bm-01:question:2
text: 2.Inspect redundancy or system backup configurations for production
systems to determine type, frequency, and storage of backups.
- urn: urn:intuitem:risk:req_node:adobe-ccf-v5:bm-01:question:3
text: 3. Inspect sample alerts for failed backups and validate the remediation
steps.
- urn: urn:intuitem:risk:req_node:adobe-ccf-v5:bm-02
assessable: true
depth: 2
parent_urn: urn:intuitem:risk:req_node:adobe-ccf-v5:node23
ref_id: BM-02
name: Resilience Testing
description: Organization performs annual backup restoration or data replication
tests to confirm the reliability and integrity of system backups or recovery
operations.
annotation: "1. Ensure that the requirement for backup restoration testing is\
\ defined and documented appropriately. \n2. Ensure that backup restoration\
\ testing is performed on an annual basis and ensure that the integrity of\
\ backup restores are maintained. "
typical_evidence: 'E-BM-01 - Backup Management Policy
E-BM-02 - Backup Restoration Test Results'
question:
question_type: unique_choice
question_choices: *id001
questions:
- urn: urn:intuitem:risk:req_node:adobe-ccf-v5:bm-02:question:1
text: 1. Inspect relevant documentation to determine whether requirements
for annual backup restoration or failover and failback tests have been
defined.
- urn: urn:intuitem:risk:req_node:adobe-ccf-v5:bm-02:question:2
text: 2. Inspect annual backup restoration, or failover and failback tests
to determine whether Organization has tested the reliability and integrity
of system backups.
- urn: urn:intuitem:risk:req_node:adobe-ccf-v5:bm-03
assessable: true
depth: 2
parent_urn: urn:intuitem:risk:req_node:adobe-ccf-v5:node23
ref_id: BM-03
name: Backup Failure Review
description: Failed backup jobs are periodically reviewed and resolved in a
timely manner.
annotation: "1. Ensure that alert are sent to the system administrators in case\
\ of backup failures.\n 2. All backup failures should be handled appropriately\
\ and resolved in a timely manner."
typical_evidence: 'E-BM-03 - Evidence of Failed Backup Review
E-BM-06 - Sample Alerts for Backup Failure'
question:
question_type: unique_choice
question_choices: *id001
questions:
- urn: urn:intuitem:risk:req_node:adobe-ccf-v5:bm-03:question:1
text: 1. Inspect whether failed backup jobs are being reviewed periodically.
- urn: urn:intuitem:risk:req_node:adobe-ccf-v5:bm-03:question:2
text: 2. Inspect alerts are configured to notify administrators if backup
fails.
- urn: urn:intuitem:risk:req_node:adobe-ccf-v5:bm-03:question:3
text: 3. Inspect and validate the remediation process for failed backups.
- urn: urn:intuitem:risk:req_node:adobe-ccf-v5:bm-04
assessable: true
depth: 2
parent_urn: urn:intuitem:risk:req_node:adobe-ccf-v5:node23
ref_id: BM-04
name: Alternate Storage
description: Organization backups are securely stored in an alternate location
from source data.
annotation: '1. Ensure that the backups are stored in an alternate location
than the source data.
2. Ensure that access to the backups is restricted and backups are stored
securely.'
typical_evidence: E-BM-04 - Backup Configuration Evidence
question:
question_type: unique_choice
question_choices: *id001
questions:
- urn: urn:intuitem:risk:req_node:adobe-ccf-v5:bm-04:question:1
text: 1. Inspect whether backups are stored in a different location than
the source data.
- urn: urn:intuitem:risk:req_node:adobe-ccf-v5:bm-04:question:2
text: 2. Inspect evidence showing that backups are secured and access in
restricted.
- urn: urn:intuitem:risk:req_node:adobe-ccf-v5:bm-05
assessable: true
depth: 2
parent_urn: urn:intuitem:risk:req_node:adobe-ccf-v5:node23
ref_id: BM-05
name: Alternate Telecommunication
description: Alternate telecommunication service agreements have been established
to resume business when the primary service gets disrupted. Service agreements
contain priority of service provisions.
annotation: '1. Ensure that alternate telecommunication service agreements are
defined to resume business when the primary service gets disrupted.
2. The priority of the service provisions should be defined in the service
agreements.'
typical_evidence: E-BM-05 - Alternate Telecommunications Agreement
question:
question_type: unique_choice
question_choices: *id001
questions:
- urn: urn:intuitem:risk:req_node:adobe-ccf-v5:bm-05:question:1
text: 1. Inspect whether alternate telecommunication service agreements
are defined to resume business when the primary service gets disrupted.
- urn: urn:intuitem:risk:req_node:adobe-ccf-v5:bm-05:question:2
text: 2. Inspect documentation to determine that the Service agreements
contain priority of service provisions.
- urn: urn:intuitem:risk:req_node:adobe-ccf-v5:node29
assessable: false
depth: 1
name: Configuration Management
- urn: urn:intuitem:risk:req_node:adobe-ccf-v5:cfm-01
assessable: true
depth: 2
parent_urn: urn:intuitem:risk:req_node:adobe-ccf-v5:node29
ref_id: CFM-01
name: Baseline Configuration Standard
description: Organization ensures security hardening and baseline configuration
standards have been established according to industry standards and are reviewed
and updated periodically.
annotation: "1. Prepare and maintain Security hardening and Baseline configuration\
\ standards shall be established.\n2. Configuration of systems (systems can\
\ include AWS, Azure, GCP, and more) shall be configured with the baseline\
\ configuration.\n3. Configure required permissions for the configuration\
\ management server. \n4. Configuration of Security Groups, NACLs, and virtual\
\ firewall appliances shall be in place.\n5. Configuration of VPC Firewall\
\ Rules and virtual firewall appliances to allow traffic from the configuration\
\ management server to the other system servers.\n6. All production systems\
\ shall be able to demonstrate consistent system configurations via version\
\ control number, last update date, settings, or other.\n7. Process shall\
\ be established to ensure that latest version patch (hardened as per industry\
\ practices) is applied wherever possible.\n8. Ensure that security hardening\
\ and configuration baselines are monitored are flagged wherever deviation\
\ is observed.\n9. Establish a process ensuring regular rule set reviews are\
\ conducted by relevant teams for network devices."
typical_evidence: "Log Management - \nE-CFM-01 - Firewall standard\nE-CFM-02\
\ - Configuration Management Standard\nE-CFM-03 - Periodic Rule review documentation\n\
E-CFM-04 - System generated Latest patch versioning documentation\nE-CFM-05\
\ - Configuration deviation samples"
question:
question_type: unique_choice
question_choices: *id001
questions:
- urn: urn:intuitem:risk:req_node:adobe-ccf-v5:cfm-01:question:1
text: 1. Validate whether Security hardening and Baseline configuration
standards are established.
- urn: urn:intuitem:risk:req_node:adobe-ccf-v5:cfm-01:question:2
text: 2. Inspect baseline configuration of systems (systems can include
AWS, Azure, GCP, and more) shall be configured with the baseline configuration.
- urn: urn:intuitem:risk:req_node:adobe-ccf-v5:cfm-01:question:3
text: '3. Validate whether the required permissions are present for the
configuration management server. '
- urn: urn:intuitem:risk:req_node:adobe-ccf-v5:cfm-01:question:4
text: 4. Inspect Security Groups, NACLs, and virtual firewall appliances
configurations.
- urn: urn:intuitem:risk:req_node:adobe-ccf-v5:cfm-01:question:5
text: 5. Validate whether VPC Firewall Rules and virtual firewall appliances
are configured to allow traffic from the configuration management server
to the other system servers.
- urn: urn:intuitem:risk:req_node:adobe-ccf-v5:cfm-01:question:6
text: '6. Inspect production systems to determine whether they demonstrate
consistent system configurations via version control #, last update date,
settings, or other.'
- urn: urn:intuitem:risk:req_node:adobe-ccf-v5:cfm-01:question:7
text: 7. For a sample of in scope servers validate whether latest version
patch (hardened as per industry practices) is applied wherever possible.
- urn: urn:intuitem:risk:req_node:adobe-ccf-v5:cfm-01:question:8
text: 8. Validate that security hardening and configuration baselines are
monitored are flagged wherever deviation is observed.
- urn: urn:intuitem:risk:req_node:adobe-ccf-v5:cfm-01:question:9
text: 9. Validate that regular rule set reviews are conducted by relevant
teams for network devices.
- urn: urn:intuitem:risk:req_node:adobe-ccf-v5:cfm-02
assessable: true
depth: 2
parent_urn: urn:intuitem:risk:req_node:adobe-ccf-v5:node29
ref_id: CFM-02
name: Default "Deny-all" Settings
description: Where applicable, the information system default access configurations
are set to "deny-all."
annotation: '1. Prepare a list of in-scope network devices and production accounts
and ensure that default deny-all rules are configured
2. Ensure that deny-all rule precedes all other applied rules in terms of
priority.'
typical_evidence: "E-AM-02 - \nE-CFM-03 - Periodic Rule review documentation"
question:
question_type: unique_choice
question_choices: *id001
questions:
- urn: urn:intuitem:risk:req_node:adobe-ccf-v5:cfm-02:question:1
text: 1. For a list of in-scope network devices and production accounts,
validate that default deny-all rules are configured
- urn: urn:intuitem:risk:req_node:adobe-ccf-v5:cfm-02:question:2
text: 2. Validate that deny-all rule precedes all other applied rules in
terms of priority.
- urn: urn:intuitem:risk:req_node:adobe-ccf-v5:cfm-03
assessable: true
depth: 2
parent_urn: urn:intuitem:risk:req_node:adobe-ccf-v5:node29
ref_id: CFM-03
name: 'Remote Access: Prohibited Protocols and Commands'
description: Organization defines a listing of prohibited user commands and
prohibited protocols that can be used in a remote session.
annotation: 1. Prepare and maintain the listing of prohibited user commands
and prohibited protocols that can be used in a remote session.
typical_evidence: 'E-CFM-06 - Security hardening standard '
question:
question_type: unique_choice
question_choices: *id001
questions:
- urn: urn:intuitem:risk:req_node:adobe-ccf-v5:cfm-03:question:1
text: 1. Inspect security hardening standard to determine the listing of
prohibited user commands and prohibited protocols that can be used in
a remote session.
- urn: urn:intuitem:risk:req_node:adobe-ccf-v5:cfm-04
assessable: true
depth: 2
parent_urn: urn:intuitem:risk:req_node:adobe-ccf-v5:node29
ref_id: CFM-04
name: Data Execution Prevention
description: Organization ensures data execution prevention (DEP) security features
are enabled on production hosts to restrict code execution within memory.
annotation: '1. Ensure that configuration setting includes data execution prevention
(DEP) security features enabled on production hosts to restrict code execution
within memory. '
typical_evidence: 'E-CFM-02 - Configuration Management Standard
E-CFM-03 - Periodic Rule review documentation'
question:
question_type: unique_choice
question_choices: *id001
questions:
- urn: urn:intuitem:risk:req_node:adobe-ccf-v5:cfm-04:question:1
text: '1. Check configuration setting to ensure data execution prevention
(DEP) security features are enabled on production hosts to restrict code
execution within memory. '
- urn: urn:intuitem:risk:req_node:adobe-ccf-v5:cfm-05
assessable: true
depth: 2
parent_urn: urn:intuitem:risk:req_node:adobe-ccf-v5:node29
ref_id: CFM-05
name: Client Run Time Technologies
description: Organization disables prohibited client run time technologies on
information systems.
annotation: 1. Establish a process to ensure no prohibited application/software
is installed on the machine.
typical_evidence: E-CFM-07 - Authorized application/software listing
question:
question_type: unique_choice
question_choices: *id001
questions:
- urn: urn:intuitem:risk:req_node:adobe-ccf-v5:cfm-05:question:1
text: 1. Inspect Organization's software compliance dashboard, to ensure
no prohibited application/software is installed on the machine.
- urn: urn:intuitem:risk:req_node:adobe-ccf-v5:cfm-06
assessable: true
depth: 2
parent_urn: urn:intuitem:risk:req_node:adobe-ccf-v5:node29
ref_id: CFM-06
name: Prohibited Activity Monitoring
description: Organization information systems are configured to explicitly deny
a predefined list of activities.
annotation: '1. Prepare a list of activities that shall be denied on Information
Systems, e.g., removable media restriction.
2. Ensure that the denied activities are enforced on the Information systems.
3. Ensure that the logs are being maintained for monitoring.
4. The list shall be reviewed periodically.'
typical_evidence: 'E-CFM-08 - List of denied activities on information systems
E-CFM-09 - Review history documentation
E-CFM-10 - Information systems activity logs'
question:
question_type: unique_choice
question_choices: *id001
questions:
- urn: urn:intuitem:risk:req_node:adobe-ccf-v5:cfm-06:question:1
text: 1. Validate whether a list is being maintained that has the activities
that shall be denied on Information Systems.
- urn: urn:intuitem:risk:req_node:adobe-ccf-v5:cfm-06:question:2
text: 2. Inspect the activity logs to validate whether the denied activities
are enforced and monitored on the Information systems.
- urn: urn:intuitem:risk:req_node:adobe-ccf-v5:cfm-06:question:3
text: 3. Validate whether the periodic review history documentation is present.
- urn: urn:intuitem:risk:req_node:adobe-ccf-v5:cfm-07
assessable: true
depth: 2
parent_urn: urn:intuitem:risk:req_node:adobe-ccf-v5:node29
ref_id: CFM-07
name: Configuration Checks
description: Organization uses mechanisms to detect deviations from baseline
configurations on production environments.
annotation: '1. Ensure that security hardening and configuration baselines are
being monitored for in-scope servers.
2. Deviations shall be generated for in-scope servers for which remediations
shall be tracked to closure.
3. Design a process for security hardening and configuration baselines checks
being accurate and updated at least annually.'
typical_evidence: 'E-CFM-11 - Security hardening and configuration baselines
checks review documentation
E-CFM-05 - Configuration deviation samples'
question:
question_type: unique_choice
question_choices: *id001
questions:
- urn: urn:intuitem:risk:req_node:adobe-ccf-v5:cfm-07:question:1
text: 1. Validate that security hardening and configuration baselines are
being monitored for in-scope servers.
- urn: urn:intuitem:risk:req_node:adobe-ccf-v5:cfm-07:question:2
text: 2. Validate that deviations are being generated for in-scope servers
and remediations are tracked to closure.
- urn: urn:intuitem:risk:req_node:adobe-ccf-v5:cfm-07:question:3
text: 3. Validate that the security hardening and configuration baselines
checks are accurate and updated at least annually.
- urn: urn:intuitem:risk:req_node:adobe-ccf-v5:cfm-08
assessable: true
depth: 2
parent_urn: urn:intuitem:risk:req_node:adobe-ccf-v5:node29
ref_id: CFM-08
name: 'Configuration Check Reconciliation: Logging'
description: Organization reconciles the established device inventory against
the enterprise log repository on a quarterly basis; devices which do not forward
security configurations are remediated.
annotation: '1. Prepare an asset register to ensure asset life cycle is maintained
as per the defined policy and/or standard of asset management.
2. Establish a process through which the device configuration logs can be
fetched and reconciled with asset register quarterly.
3. Ensure that a process is established that tracks the deviations to remediation.'
typical_evidence: "E-AM-02 - Asset Inventory\nE-CFM-12 with E-AM-02 - \nE-CFM-05\
\ - Configuration deviation samples"
question:
question_type: unique_choice
question_choices: *id001
questions:
- urn: urn:intuitem:risk:req_node:adobe-ccf-v5:cfm-08:question:1
text: 1. Inspects Organization asset register to ensure asset life cycle
is maintained as per the defined policy and/or standard of asset management.
- urn: urn:intuitem:risk:req_node:adobe-ccf-v5:cfm-08:question:2
text: 2. Validate whether the device configuration logs are being reconciled
with asset register quarterly.
- urn: urn:intuitem:risk:req_node:adobe-ccf-v5:cfm-08:question:3
text: 3. Validate for a sample of deviations whether the remediation is
done in a timely manner.
- urn: urn:intuitem:risk:req_node:adobe-ccf-v5:cfm-09
assessable: true
depth: 2
parent_urn: urn:intuitem:risk:req_node:adobe-ccf-v5:node29
ref_id: CFM-09
name: Time Clock Synchronization
description: Systems are configured to synchronize information system time clocks
based on International Atomic Time or Coordinated Universal Time (UTC).
annotation: '1. Ensure that the inventory includes all the ICT devices such
as firewalls, routers and servers.
2. Ensure that a process has been established to use only hardened images
for the servers.
3. Ensure that the NTP configuration (primary & secondary NTP servers) for
these devices is configured.
4. Ensure that the time sync is enabled and stratums are defined.'
typical_evidence: 'E-CFM-02 - Configuration Management Standard
E-CFM-14 - Sample server configuration