Consumers of this file should refer to the Essentials OSCAL NS 1.0 page for information regarding the Essentials specific representation used in this OSCAL file.
Systems (infrastructure, operating systems, applications, identities, credentials and data) are continually and centrally identified and documented.
Use an approved asset inventory mechanism that supports automated discovery to detect new and changed physical and non-physical assets.
No approved asset inventory mechanism is in place.
Asset inventory records are maintained manually with no automated discovery capability.
An approved asset inventory mechanism is deployed but does not cover all network segments or asset types.
Automated discovery scans to detect new and changed physical and non-physical assets occur on a schedule but reconciliation with the approved inventory is manual or inconsistent.
An approved asset inventory mechanism which supports automated discovery is deployed to cover all applicable assets and network segments.
Discovery runs on a regular schedule defined by the organisation and new or changed physical or non-physical assets that are detected are reconciled with the approved inventory.
Security risks for an organisation and their systems (infrastructure, operating systems, applications and data) are identified, including by using current strategic and sector-specific cyber threat intelligence and threat modelling, and are documented along with any associated risk management decisions.
Identify relevant weaknesses, malicious actor techniques and cyber threat behaviours when undertaking risk assessments and review these inputs on a continuous basis.
Risk assessments do not reference relevant weaknesses, malicious actor techniques and cyber threat behaviours.
No process exists to incorporate threat information into risk assessment activities.
Current weaknesses, malicious actor techniques and cyber threat behaviours that are relevant to the organisation are not reviewed or updated.
Risk assessments reference threat intelligence but coverage is limited to well-known or generic threats.
Threat information is considered but not systematically mapped to organisational assets or detection gaps.
Current weaknesses, malicious actor techniques and cyber threat behaviours that are relevant to the organisation are reviewed or updated, but are not used to inform risk assessments or are reviewed only on an ad hoc basis.
Risk assessments incorporate and reference relevant weaknesses, malicious actor techniques relevant to the sector, and cyber threat behaviours.
Relevant weaknesses, malicious actor techniques and cyber threat behaviours are systematically related to applicable assets and used to inform risk treatment decisions.
Current weaknesses, malicious actor techniques and cyber threat behaviours relevant to the organisation are reviewed or updated on a continuous basis at a frequency that enables noted changes to inform risk assessments.
Robust and secure identity, credential and access management is used to establish, maintain and control access to systems (infrastructure, operating systems, applications and data) and to support effective detection of identity and credential misuse.
Identify and remediate unsecured keys, secrets and credentials by regularly scanning codebases, configuration files, file shares and user collaboration platforms.
No secret scanning capability is deployed.
No process exists to identify credentials exposed in codebases, configuration files, file shares or user collaboration platforms.
Unsecured keys, secrets and credentials found exposed in codebases, configuration files, scripts, file shares or user collaboration platforms are left in place with no action taken.
Secret scanning is deployed but does not cover all repositories, pipelines or user collaboration platforms.
Scanning runs but discovered credentials are not assessed in a timely manner.
Unsecured keys, secrets and credentials that are discovered are assessed, but are not rotated or revoked in a timely manner.
Secret scanning tooling is deployed across codebases, configuration files, file shares and user collaboration platforms.
Scans to identify unsecured keys, secrets and credentials run on a regular schedule defined by the organisation.
Unsecured keys, secrets and credentials that are discovered are assessed, then rotated and/or revoked within timeframes defined by the organisation.
Security-relevant event logs and configuration changes for systems (infrastructure, operating systems, applications and data) are centrally collected, protected against unauthorised modification or deletion, and retained to support effective cyber security event detection and investigation.
Establish a centralised event log storage capability that protects logs from unauthorised access or modification.
No centralised capability exists for storing event logs collected from systems across the environment.
Stored logs have no protection against modification or deletion by administrators of the systems generating them.
Access to the centralised capability is not restricted, or access is granted to roles without a documented need.
Log retention requirements are not defined.
A centralised capability exists but does not receive logs from in-scope systems, or coverage is inconsistent.
Stored logs are protected from modification, but the controls do not consistently prevent deletion, or controls are not applied to all log types.
Access is restricted to a defined set of roles but access is not logged or monitored.
A retention period is defined but is inconsistently applied, or some log types are retained for shorter periods than required.
A centralised event log storage capability is in place for logs collected from in-scope systems.
Stored logs are protected against unauthorised access, modification and deletion through technical controls including access restrictions, encryption at rest and integrity protection.
Access to the centralised capability is restricted to security operations personnel and other roles with a documented need, with access logged and monitored.
Log retention requirements are defined and aligned to investigative, regulatory and contractual obligations, with retention applied consistently across log types.
Anomalous or unexpected events and behaviours for systems (infrastructure, operating systems, applications and data) are analysed in a timely manner to detect cyber security events.
Ensure detection logic identifies unauthorised changes, anomalous authentication activity and suspicious software execution.
No detection logic is deployed to identify unauthorised changes, anomalous authentication activity or suspicious software execution events originating from assets.
Detection relies entirely on manual log review with no automated rules or alerting.
Detection logic exists but does not cover all three categories (unauthorised changes, anomalous authentication, suspicious execution).
Rules are deployed but are not tested or tuned on a regular cycle defined by the organisation.
Detection logic is deployed, and unauthorised configuration changes, anomalous authentication patterns and suspicious process execution events are captured and produce alerts.
Detection logic is tested and tuned on a regular cycle defined by the organisation to maintain effectiveness.
Detection coverage is reviewed following cyber security incidents or significant environmental changes.
Cyber security events are analysed in a timely manner to identify cyber security incidents.
Triage alerts and events in a timely manner to determine whether cyber security incident thresholds have been met.
No documented triage process exists.
Alerts are routinely ignored or left unreviewed.
No incident severity thresholds are defined.
A triage process exists but response times are not defined or consistently met.
Severity thresholds are defined but escalation procedures are informal.
A documented triage process with defined severity thresholds and response timeframes is in place.
Alerts are triaged within the timeframes defined by the organisation and escalated where cyber security incident thresholds are met.
Triage performance is tracked and reported.
Use indicators from across identities, applications, data and infrastructure activity rather than isolated signals when identifying cyber security incidents.
Investigation relies on single-source alerts with no cross-source correlation.
Correlation rules do not consider signals from multiple data sources.
Some correlation exists but is limited to specific data source pairs.
Cross-source investigation is performed manually but not supported by automated correlation.
Correlation rules and investigation procedures consider signals across identities, applications, data and infrastructure.
Automated correlation supports detection of multi-stage adversary activity.
Cyber security event detection capabilities are regularly evaluated for effectiveness and continuously refined, including by using current strategic and sector-specific cyber threat intelligence, to improve the detection of cyber security events.
Review detection coverage periodically to identify gaps arising from new assets, services or architectural changes.
No review of detection coverage has been conducted within the period defined by the organisation.
No process exists to assess new assets and services for log coverage or detection applicability.
A review of detection coverage has been conducted but does not cover all recently deployed assets or services.
Detection gaps have been identified and remediation is planned, but remediation has not been executed within timeframes defined by the organisation.
A detection coverage review has been completed within the cycle defined by the organisation.
New assets and services are assessed for log coverage and detection rule applicability.
Identified detection gaps are remediated within risk-based timeframes defined by the organisation.
Cyber security incident roles and responsibilities are defined, documented and exercised to support the internal and external coordination and management of cyber security incidents, including responsibilities for declaring cyber security incidents and undertaking pre-approved response and recovery activities.
Integrate external coordination obligations into cyber security incident response activities where required.
External coordination requirements for Cyber security incident response activities are neither identified nor documented.
No defined triggers, contacts or timeframes exist for external reporting.
External coordination requirements are documented but are not integrated into operational response procedures.
Contacts and triggers are defined for some but not all required external parties.
Cyber security incident response procedures include documented external coordination requirements with defined triggers, contacts and timeframes.
Requirements cover all relevant external parties identified by applicable legal, regulatory, contractual and organisational obligations.
Coordination procedures have been exercised or invoked and lessons learnt have been incorporated.
Cyber security incidents are contained, eradicated and recovered from in a timely manner.
Use documented, tested and approved cyber security incident response procedures when responding to cyber security incidents.
No documented cyber security incident response plan or procedures exist.
Incident response activities are conducted on an ad hoc basis without any defined roles, escalation paths, procedures or response objectives.
Available incident records demonstrate systemic failures to contain, eradicate or recover from cyber security incidents within organisationally defined timeframes, and the causes of these failures are not addressed.
A cyber security incident response plan exists but has not been exercised or invoked within the organisationally defined test cycle.
The cyber security incident response plan defines roles, escalation paths, and response procedures, but target timeframes or intended response outcomes are not clearly defined.
Incident records or exercise results demonstrate that response activities do not consistently meet organisationally defined timeframes or intended outcomes, but identified deficiencies are documented and subject to improvement actions.
An approved cyber security incident response plan is in place and defines roles, escalation paths, response procedures, target timeframes and intended containment, eradication and recovery outcomes.
The incident response plan and associated procedures have been exercised or invoked within the organisationally defined test cycle.
Incident records demonstrate that cyber security incidents are contained, eradicated and recovered from within organisationally defined target timeframes and achieve the intended response outcomes, taking into account incident severity, complexity and business impact.
Where target timeframes or intended outcomes are not achieved, the causes are analysed, improvement actions are assigned and tracked, and relevant plans, procedures and controls are updated.
Where no relevant cyber security incident has occurred during the assessment period, appropriately scoped exercises demonstrate the organisation’s capability to achieve its target timeframes and intended response outcomes.
Lessons learnt from cyber security incidents are captured, and areas for improvement are identified, prioritised and actioned in a timely manner.
Perform post-cyber security incident reviews to identify the security gaps that enabled each stage of the cyber security incident.
Post-incident reviews are not conducted.
Post-incident reviews are conducted for some incidents but not all that meet the severity threshold defined by the organisation.
Reviews are conducted but findings are not documented or actioned.
Post-incident reviews are conducted for all incidents meeting the severity threshold defined by the organisation.
Findings identify the specific gaps that enabled each stage of the incident.
Remediation actions arising from findings are implemented and tracked to closure.
Evaluate the monitoring coverage and cyber security incident response procedures following cyber security incidents.
Detection rules, monitoring coverage and response procedures are not reviewed following incidents.
Reviews are conducted but do not result in documented changes to detection or response capabilities.
Some improvements are made but not systematically tracked or validated.
Detection rules, monitoring coverage and cyber security incident response procedures are reviewed following incidents, with identified lessons incorporated into updates.
Changes are documented, tested and validated for effectiveness.