Consumers of this file should refer to the Essentials OSCAL NS 1.0 page for information regarding the Essentials specific representation used in this OSCAL file.
The board of directors or executive committee is accountable for cyber security.
Formally define and establish executive and board-level accountabilities for cyber security, including setting, monitoring and adjusting organisational risk appetite, and review these accountabilities at a defined cadence.
No named executive or board member is accountable for cyber security.
Cyber security accountability exists only informally, or is assumed rather than documented.
No evidence of cyber security reporting to the executive board.
Organisational risk appetite is not set.
A named executive or board member is accountable for cyber security, but reporting obligations are not formally defined.
Board-level reporting on cyber security occurs but is ad hoc rather than on a defined schedule.
Accountability is documented but has not been reviewed within the organisationally defined cadence or following relevant organisational restructuring or leadership changes.
Organisational risk appetite is set but is not monitored or adjusted over time.
A named executive or board member has documented accountability for cyber security with defined reporting obligations.
Regular reporting to the board or executives occurs on a defined cadence with evidence of reporting artefacts.
Accountability arrangements are reviewed when organisational structures or leadership changes occur.
Organisational risk appetite is set and is monitored and adjusted over time as required.
The board of directors or executive committee is accountable for ensuring that artificial intelligence is secure, controllable, human-supervised and used in an ethical and accountable manner.
Establish and maintain executive accountability for the use, governance and risk management of artificial intelligence within the organisation.
No named executive is accountable for the use, governance or risk management of artificial intelligence.
Artificial intelligence is used within the organisation with no approval, risk assessment or oversight.
Artificial intelligence related risks are not reflected in the organisation’s risk register.
Artificial intelligence use and governance arrangements have not been reviewed within the schedule defined by the organisation.
A named executive is accountable for artificial intelligence but the governance process is informal or undocumented.
Approval and risk assessment occur for some artificial intelligence use cases but coverage is inconsistent across internally developed, third-party and embedded artificial intelligence.
Some artificial intelligence related risks are recorded but the organisation’s risk register does not capture all known artificial intelligence use cases.
Reviews occur within the schedule defined by the organisation, but do not consistently address changes in artificial intelligence capability, threat environment or organisational use.
A named executive has accountability for artificial intelligence, supported by an approved governance process that has evidence of being followed.
The governance process addresses approval, risk assessment and oversight for internally developed, third-party and embedded artificial intelligence use cases.
Artificial intelligence related risks are reflected in the organisation’s risk register and reported through standard governance channels.
Reviews of artificial intelligence use and governance arrangements are conducted on a schedule defined by the organisation and consistently address changes in artificial intelligence capability, threat environment or organisational use.
Suitable and sufficient personnel and resources are identified, acquired and maintained in support of cyber security activities.
Assign sufficient cyber security personnel and resources with the required skills to operate, monitor, maintain and manage the lifecycle of security controls and define cyber security responsibilities within role descriptions.
Cyber security functions are staffed on an ad hoc basis without reference to required skills or capacity.
Critical cyber security roles are unfilled with no approved recruitment plan.
No resourcing plan for cyber security personnel exists.
Some critical roles are filled but identified skills gaps have no plan for remediation.
While assigned personnel provide some capability, there are gaps in capacity, resources, or expertise that hinder the operation, monitoring, maintenance, and lifecycle management of controls.
A resourcing plan exists but does not cover all required cyber security functions.
Outstanding cyber security positions are being actively recruited, but capacity or skills gaps remain.
Sufficient cyber security personnel are assigned to operate, monitor, maintain and manage the lifecycle of controls across the organisation.
Skills gaps are identified and addressed through recruitment, training or contracted services.
A resourcing plan identifies all required cyber security personnel, roles, skills, resources and capacity.
Cyber security responsibilities are defined within applicable role descriptions.
Periodically review cyber security resourcing against cyber threat trends, cyber security incident outcomes and organisational changes.
No review of cyber security resourcing has been conducted.
Resourcing has not been reassessed following significant organisational or threat landscape changes.
A review has been conducted but did not reference current threat trends, cyber security incident outcomes, or organisational changes.
Review outcomes have identified required adjustments, but those adjustments have not been made.
A resourcing review has been completed within the review period defined by the organisation.
The review references current threat trends, cyber security incident outcomes and organisational changes.
Documented review outcomes include resourcing adjustments that are implemented within timeframes defined by the organisation, or formally risk accepted by an appropriate authority.
Security risk management activities for an organisation and their systems (infrastructure, operating systems, applications and data) are embedded into organisational risk management frameworks and subject to ongoing monitoring and assurance activities by the board of directors or executive committee.
Establish and maintain an approved risk management methodology and plan that is used to assess and treat cyber security risks.
No risk management methodology approved by the organisation is in place.
No current organisational risk register exists, or the register has not been reviewed within the cycle defined by the organisation.
Risk treatment decisions are not documented.
An approved risk management methodology exists but risk assessments have not been conducted within the defined cycle.
A risk register exists but treatment plans are incomplete or have not been actioned.
Risk assessments have been conducted but do not cover all in-scope assets.
An approved risk management methodology and plan are in place and used to assess and treat security risks.
A current risk register exists with documented and implemented treatment plans for all identified risks.
Risk assessments have been conducted or reviewed within the assessment cycle defined by the organisation.
Systems (infrastructure, operating systems, applications and data) are delivered and supported by trustworthy suppliers whose cyber security practices are regularly verified or otherwise risk-assessed.
Select and engage suppliers of software, hardware and services on the basis of a cyber supply chain risk assessment proportionate to the risk the supplier introduces, and retain appropriate assurance evidence to support the decision.
No documented or approved governance process exists for evaluating the cyber security trustworthiness of suppliers.
No cyber security evaluation is performed before suppliers are onboarded.
Evaluation outcomes are not documented.
Findings from supplier evaluation outcomes are not used to inform supplier approval, contractual requirements or risk treatment decisions where concerns are identified.
An evaluation process exists but is not consistently applied to all suppliers within scope.
Evaluation is performed for some suppliers, but criteria are not documented or are inconsistently applied.
Outcomes are documented but contractual arrangements do not reflect identified risks or required controls.
A documented and approved governance process is in place and consistently applied.
Cyber security trustworthiness evaluations are performed for all suppliers within scope prior to onboarding.
Evaluation criteria are documented, approved and proportionate to the criticality of what the supplier delivers.
Evaluation outcomes are documented, reflected in contractual arrangements and recorded in the organisation’s risk register where residual risk remains.
Maintain current assurance that suppliers continue to meet their cyber security commitments, and act when that assurance lapses or the supplier’s risk changes.
No process exists to obtain and risk-assess current supplier assurance evidence proportionate to supplier criticality and risk.
No documented and approved governance process exists for maintaining assurance that suppliers meet their cyber security commitments.
No actions are taken when supplier cyber security assurance lapses or supplier risk changes.
Supplier assurance evidence is obtained for some suppliers, but coverage is incomplete or the evidence is not reviewed and actioned.
Some findings are actioned but the response process is informal or inconsistent.
A process exists but acceptable forms and currency of assurance evidence are not defined or applied consistently.
Current assurance evidence is obtained from suppliers in proportion to their criticality and risk, and is reviewed for findings that affect the organisation.
Material concerns are addressed through contractual remediation, compensating controls or supplier substitution within defined timeframes.
A documented and approved governance process specifies the acceptable forms, scope and currency of supplier assurance evidence.
Systems (infrastructure, operating systems, applications and data) that are not capable of meeting cyber security requirements are managed using compensating security controls, along with enhanced monitoring and assurance activities, to maintain an acceptable level of residual risk until they can be decommissioned or replaced.
Establish and maintain a process for identifying, assessing and treating cyber security risks associated with legacy systems and unsupported technologies through compensating controls, enhanced monitoring and assurance until the systems can be removed or replaced.
No documented or approved governance process exists for identifying or managing legacy systems.
Legacy systems are not formally identified within the environment.
Cyber security risks associated with legacy systems are not assessed or are assessed informally.
There are no interim compensating controls to manage identified cyber security risks associated with legacy systems.
Legacy systems remain in operation indefinitely with no documented decommissioning, replacement or migration path.
A process exists but the criteria for classifying a system as legacy are not documented or are inconsistently applied.
Some legacy systems are identified but the inventory is incomplete or is not maintained.
Risk assessments are conducted for some legacy systems but treatment decisions are not documented or approved.
Some compensating controls are in place to address risks associated with legacy systems, but coverage is not complete.
A path exists for some legacy systems but is not tracked to completion.
A documented and approved governance process exists with clear criteria for classifying systems as legacy.
Legacy systems are formally identified, inventoried and reviewed on a cycle defined by the organisation.
Cyber security risks associated with legacy systems are assessed, treated and approved by an appropriate authority.
Compensating controls are applied to manage cyber security risks for legacy systems while decommissioning or migration efforts are in progress.
A documented decommissioning, replacement or migration path exists for retained legacy systems and is tracked to completion.
Personnel are provided with ongoing cyber security awareness training, including operational security considerations, tailored to their duties, access levels and current cyber threats.
Update and provide cyber security awareness training on a regular basis to reflect current threats and operational considerations.
No cyber security awareness training program exists.
Cyber security awareness training is not reviewed or updated after initial deployment.
Lessons learnt from cyber security incidents are not incorporated into training content.
The cadence of review is not defined.
Training is reviewed but updates do not reflect current threat intelligence, sector relevant adversary techniques or organisational changes.
Some lessons are incorporated but the process is informal, or coverage is limited to a small number of incidents.
Some changes are reflected, but training is not updated to address recently introduced systems or significant changes to working arrangements.
A review cadence exists, but is not consistently met, or is not proportionate to the rate of change.
Training content is reviewed and updated on a defined cycle, with updates reflecting current threat intelligence, adversary techniques relevant to the workforce and organisation’s operating context.
Lessons learnt from cyber security incidents within the organisation or its sector are systematically incorporated into training content.
Training reflects the systems, platforms and working arrangements that personnel currently interact with, including newly introduced platforms and changes to ways of working.
The cadence of review is defined, proportionate to the rate of change in the threat environment, and consistently met.