Assessment evidence guide for enterprise IT

Purpose

This document is intended to provide assessors with a series of supporting statements that can be used, alongside expert judgement, to determine how effectively an organisation is addressing the intent of the actions and overarching principles outlined in the Essentials for enterprise IT framework.

How to use this document

Indicators of Good Practice

Indicators of Good Practice (IGP) statements are included for each of the Essentials for enterprise IT actions. The IGP statements are optional indicators intended to aid assessors to evaluate the Action outcomes for an applicable Domain. The IGPs do not replace expert judgement, nor are they intended to serve as a checklist.

Each action is presented with three columns of statements, and each column includes a series of statements to consider when assessing the effectiveness of an action. An assessor can use the statements to assist in determining the observed implementation state for the assets in scope. Assessors rate the effectiveness of an action on the lowest level reached:

• If any not effective statement is true, the action is rated not effective.
• If all applicable fully effective statements are true, and no partially effective or not effective statement is true, the action is rated fully effective.
• In all other cases, including where some fully effective statements are true and others are not, the action is rated partially effective.

The not assessed status is not represented by IGP statements. It is applied where the action has not yet been assessed, or where there was insufficient visibility to determine whether risk was meaningfully reduced.

Each action is allocated a unique identifier, and each distinct statement for an action is identified to assist with record keeping purposes (for example IT.GOV-01.1.FE-1 can be used to reference the first fully effective statement for the first Govern principle).

Potential evidence sources

Organisations may choose to leverage controls from a variety of sources when addressing the Essentials principles. The effectiveness of a mitigation must also be considered in context of each individual domain, rather than organisation wide; a set of controls that may be effective for one domain does not automatically guarantee effectiveness for another domain.

References to independent cyber security frameworks have been included for each action, which indicate where supporting evidence of that action's effectiveness may exist (if an organisation has adopted that framework already). The list is not intended to define the controls required to meet the intent of the actions.

The frameworks referenced include:

Govern principles

GOV-01 - Executive cyber security accountability

Principle: The board of directors or executive committee is accountable for cyber security.

IT.GOV-01.1

Action: Formally define and establish executive and board-level accountabilities for cyber security, including setting, monitoring and adjusting organisational risk appetite, and review these accountabilities at a defined cadence.

Domains: Governance and culture; Mitigated Techniques: N/A;

GOV-08 - Executive artificial intelligence accountability

Principle: The board of directors or executive committee is accountable for ensuring that artificial intelligence is secure, controllable, human-supervised and used in an ethical and accountable manner.

IT.GOV-08.1

Action: Establish and maintain executive accountability for the use, governance and risk management of artificial intelligence within the organisation.

Domains: Governance and culture; Mitigated Techniques: N/A;

GOV-04 - Cyber security resourcing

Principle: Suitable and sufficient personnel and resources are identified, acquired and maintained in support of cyber security activities.

IT.GOV-04.1

Action: Assign sufficient cyber security personnel and resources with the required skills to operate, monitor, maintain and manage the lifecycle of security controls and define cyber security responsibilities within role descriptions.

Domains: Governance and culture; Mitigated Techniques: N/A;

IT.GOV-04.2

Action: Periodically review cyber security resourcing against cyber threat trends, cyber security incident outcomes and organisational changes.

Domains: Governance and culture; Mitigated Techniques: N/A;

GOV-03 - Security risk management assurance

Principle: Security risk management activities for an organisation and their systems (infrastructure, operating systems, applications and data) are embedded into organisational risk management frameworks and subject to ongoing monitoring and assurance activities by the board of directors or executive committee.

IT.GOV-03.1

Action: Establish and maintain an approved risk management methodology and plan that is used to assess and treat cyber security risks.

Domains: Governance and culture; Mitigated Techniques: N/A;

GOV-11 - Supplier cyber security assurance

Principle: Systems (infrastructure, operating systems, applications and data) are delivered and supported by trustworthy suppliers whose cyber security practices are regularly verified or otherwise risk-assessed.

IT.GOV-11.1

Action: Select and engage suppliers of software, hardware and services on the basis of a cyber supply chain risk assessment proportionate to the risk the supplier introduces, and retain appropriate assurance evidence to support the decision.

Domains: Governance and culture; Mitigated Techniques: Supply Chain Compromise;

IT.GOV-11.2

Action: Maintain current assurance that suppliers continue to meet their cyber security commitments, and act when that assurance lapses or the supplier’s risk changes.

Domains: Governance and culture; Mitigated Techniques: Supply Chain Compromise;

GOV-14 - Legacy system management

Principle: Systems (infrastructure, operating systems, applications and data) that are not capable of meeting cyber security requirements are managed using compensating security controls, along with enhanced monitoring and assurance activities, to maintain an acceptable level of residual risk until they can be decommissioned or replaced.

IT.GOV-14.1

Action: Establish and maintain a process for identifying, assessing and treating cyber security risks associated with legacy systems and unsupported technologies through compensating controls, enhanced monitoring and assurance until the systems can be removed or replaced.

Domains: Governance and culture; Mitigated Techniques: N/A;

Identify principles

IDE-01 - Asset identification

Principle: Systems (infrastructure, operating systems, applications, identities, credentials and data) are continually and centrally identified and documented.

IT.IDE-01.1

Action: Use an approved asset inventory mechanism that supports automated discovery to detect new and changed physical and non-physical assets

Domains: Visibility and response; Mitigated Techniques: N/A;

IT.IDE-01.2

Action: Maintain current records of infrastructure, operating systems, applications, identities, credentials and data assets.

Domains: Boundary services, Identity services, Critical processes and services, Privileged environments, Business systems, User devices; Mitigated Techniques: N/A;

IDE-04 - Security risk identification

Principle: Security risks for an organisation and their systems (infrastructure, operating systems, applications and data) are identified, including by using current strategic and sector-specific cyber threat intelligence and threat modelling, and are documented along with any associated risk management decisions.

IT.IDE-04.1

Action: Identify relevant weaknesses, malicious actor techniques and cyber threat behaviours when undertaking risk assessments and review these inputs on a continuous basis.

Domains: Visibility and response; Mitigated Techniques: N/A;

Protect principles

PRO-01 - Secure system lifecycle

Principle: Systems (infrastructure, operating systems and applications) are planned, designed, developed, tested, deployed, maintained and decommissioned according to their business criticality ratings and security and resilience requirements using Secure by Design and Secure by Default principles and practices.

IT.PRO-01.1

Action: Design systems securely to provide visibility, enforce authorised access, protect data, minimise required and default privileges, limit exposed services and remove unnecessary functionality.

Domains: Boundary services, Identity services, Critical processes and services, Privileged environments, Business systems, User devices; Mitigated Techniques: Exploit Public-Facing Application, Valid Accounts, Remote Services, Exploitation for Privilege Escalation;

IT.PRO-01.2

Action: Secure build and deployment processes to enforce controls consistently across systems.

Domains: Boundary services, Identity services, Critical processes and services, Privileged environments, Business systems, User devices; Mitigated Techniques: N/A;

PRO-16 - Cyber supply chain security

Principle: Cyber supply chains supporting systems (infrastructure, operating systems, applications and data) are secure, resilient and support effective and coordinated cyber security incident response.

IT.PRO-16.1

Action: Assess the integrity and authenticity of software, components and updates before use, and verify provenance where suitable supplier evidence is available.

Domains: Boundary services, Identity services, Critical processes and services, Privileged environments, Business systems, User devices; Mitigated Techniques: Supply Chain Compromise, Server Software Component;

IT.PRO-16.2

Action: Use vendor advisories and threat intelligence to maintain awareness of supplier, product and component exposure to compromise, and act within timeframes proportionate to the risk.

Domains: Boundary services, Identity services, Critical processes and services, Privileged environments; Mitigated Techniques: Supply Chain Compromise, Server Software Component;

PRO-13 - Identity, credential and access management

Principle: Robust and secure identity, credential and access management is used to establish, maintain and control access to systems (infrastructure, operating systems, applications and data) and to support effective detection of identity and credential misuse.

IT.PRO-13.1

Action: Identify and disable or remove default and unused accounts regularly, permitting exceptions only where the account is documented, justified, hardened and monitored.

Domains: Boundary services, Identity services, Critical processes and services, Privileged environments, Business systems, User devices; Mitigated Techniques: Valid Accounts, Brute Force;

IT.PRO-13.2

Action: Store authentication keys, secrets and tokens in approved secure repositories with access controls, including MFA.

Domains: Boundary services, Identity services, Critical processes and services, Privileged environments, Business systems; Mitigated Techniques: Unsecured Credentials, Credentials from Password Stores;

IT.PRO-13.3

Action: Identify and remediate unsecured keys, secrets and credentials by regularly scanning codebases, configuration files, file shares and user collaboration platforms.

Domains: Visibility and response; Mitigated Techniques: Valid Accounts, Unsecured Credentials;

IT.PRO-13.4

Action: Use phishing-resistant MFA for users authenticating to systems, including from untrusted, external or high-risk locations.

Domains: Boundary services, Identity services, Critical processes and services, Privileged environments, Business systems, User devices; Mitigated Techniques: Valid Accounts, Account Manipulation, Brute Force, Remote Services, Multi-Factor Authentication Request Generation, Adversary-in-the-Middle;

IT.PRO-13.5

Action: Disable legacy authentication protocols or, where this is not feasible, restrict and monitor their use, apply compensating controls and establish a time-bound decommissioning plan.

Domains: Boundary services, Identity services, Critical processes and services, Privileged environments, Business systems, User devices; Mitigated Techniques: Brute Force, Valid Accounts, Adversary-in-the-Middle;

IT.PRO-13.6

Action: Ensure that user, machine, system and service account credentials are unique per system or account, particularly in high-privilege contexts.

Domains: Boundary services, Identity services, Critical processes and services, Privileged environments, Business systems, User devices; Mitigated Techniques: Brute Force, Valid Accounts;

PRO-12 - Least privilege access

Principle: Users are granted the minimum access to systems (infrastructure, operating systems, applications and data) required to undertake their duties or functions.

IT.PRO-12.1

Action: Periodically review and update access privileges in alignment with current roles, duties and business requirements.

Domains: Boundary services, Identity services, Critical processes and services, Privileged environments, Business systems, User devices; Mitigated Techniques: Account Manipulation;

IT.PRO-12.2

Action: Grant only authorised administrative roles permissions to create, modify or delete accounts and roles, and access privileged functions or applications.

Domains: Boundary services, Identity services, Critical processes and services, Privileged environments; Mitigated Techniques: Create Account, Account Manipulation;

IT.PRO-12.3

Action: Provision user, administrative and non-person accounts with only the minimum access and privileges required to perform defined operational functions.

Domains: Boundary services, Identity services, Critical processes and services, Privileged environments; Mitigated Techniques: Create Account, Account Manipulation;

PRO-05 - Secure administration

Principle: Systems (infrastructure, operating systems, applications and data) are administered in a secure, accountable and auditable manner.

IT.PRO-05.1

Action: Ensure administrative activities can only be performed from dedicated and hardened environments that are isolated from unprivileged user workloads.

Domains: Boundary services, Identity services, Critical processes and services, Privileged environments; Mitigated Techniques: Exploitation for Privilege Escalation, OS Credential Dumping;

IT.PRO-05.2

Action: Enforce explicit session establishment controls before privileged actions are permitted, including the use of time-bound privilege grants.

Domains: Boundary services, Identity services, Critical processes and services, Privileged environments; Mitigated Techniques: OS Credential Dumping, Use Alternate Authentication Material, Steal or Forge Kerberos Tickets;

IT.PRO-05.3

Action: Record all administrative or management actions that modify systems, configurations or controls, including the details of the associated user, timestamp and target.

Domains: Boundary services, Identity services, Critical processes and services, Privileged environments; Mitigated Techniques: Disable or Modify Tools, Modify Registry, Create Account, Create or Modify System Process;

PRO-04 - Secure configuration management

Principle: Systems (infrastructure, operating systems and applications) are securely configured to approved and maintained baselines, including by reducing attack surfaces and attack paths, with configurations continually monitored and consistently enforced.

IT.PRO-04.1

Action: Define approved configuration baselines, informed by vendor and industry hardening guidance, that disable or remove unnecessary services, insecure settings, and unsupported or weak communication protocols.

Domains: Boundary services, Identity services, Critical processes and services, Privileged environments, Business systems, User devices; Mitigated Techniques: Server Software Component, Windows Management Instrumentation, Network Service Discovery, OS Credential Dumping;

IT.PRO-04.2

Action: Deploy approved configuration baselines on systems, including infrastructure, operating systems and applications.

Domains: Boundary services, Identity services, Critical processes and services, Privileged environments, Business systems, User devices; Mitigated Techniques: Exploit Public-Facing Application, External Remote Services, User Execution, Command and Scripting Interpreter;

IT.PRO-04.3

Action: Detect and respond to configuration drift using scheduled technical assessments and, where supported, automated monitoring, based on system criticality and change rate.

Domains: Boundary services, Identity services, Critical processes and services, Privileged environments, Business systems, User devices; Mitigated Techniques: Disable or Modify Tools, Modify Registry;

PRO-06 - Vulnerability management

Principle: Vulnerabilities in systems (infrastructure, operating systems, applications and data) are identified, documented, validated and prioritised for remediation or mitigation in a timely manner, with all remediation and mitigation actions verified for effectiveness.

IT.PRO-06.1

Action: Identify known software and configuration weaknesses of assets through continuous and repeatable assessment activities, including vulnerability scanning activities.

Domains: Boundary services, Identity services, Critical processes and services, Privileged environments, Business systems, User devices; Mitigated Techniques: Exploit Public-Facing Application, Exploitation for Privilege Escalation, Exploitation of Remote Services, Exploitation for Client Execution;

IT.PRO-06.2

Action: Apply security patches or updates within defined risk-based timeframes  or automatically where operational impact is low.

Domains: Boundary services, Identity services, Critical processes and services, Privileged environments, Business systems, User devices; Mitigated Techniques: Exploit Public-Facing Application, Exploitation for Privilege Escalation, Exploitation of Remote Services, Exploitation for Client Execution;

IT.PRO-06.3

Action: Remediate or mitigate vulnerabilities exceeding defined risk thresholds within defined timeframes based on exploitation, exposure, criticality, impact and compensating controls, and verify treatment effectiveness.

Domains: Boundary services, Identity services, Critical processes and services, Privileged environments, Business systems, User devices; Mitigated Techniques: Exploit Public-Facing Application, Exploitation for Privilege Escalation, Exploitation of Remote Services, Exploitation for Client Execution;

PRO-07 - Trustworthy software

Principle: Systems (operating systems and applications) only permit the execution of software that is supported, verified and authorised.

IT.PRO-07.1

Action: Permit only supported, verified and organisation-authorised software to execute on systems, with exceptions minimised, formally risk accepted, time-bound, monitored and regularly reviewed.

Domains: Boundary services, Identity services, Critical processes and services, Privileged environments, Business systems, User devices; Mitigated Techniques: Disable or Modify Tools, User Execution, Command and Scripting Interpreter, Windows Management Instrumentation, Process Injection, System Binary Proxy Execution;

IT.PRO-07.2

Action: Restrict administrative and management tooling to approved software sets and executed from only authorised, known locations.

Domains: Boundary services, Identity services, Critical processes and services, Privileged environments, Business systems, User devices; Mitigated Techniques: Disable or Modify Tools, User Execution, Command and Scripting Interpreter, Windows Management Instrumentation, Process Injection, System Binary Proxy Execution;

PRO-10 - Regular and proven backups

Principle: Systems (infrastructure, operating systems, applications and data) are regularly backed up in a secure and proven manner, including through the validation of restoration capabilities.

IT.PRO-10.1

Action: Back up important data, applications and settings on a defined schedule to secure, resilient storage protected by encryption and immutable, offline, logically isolated or equivalent controls.

Domains: Boundary services, Identity services, Critical processes and services, Privileged environments, Business systems; Mitigated Techniques: Data Encrypted for Impact, Inhibit System Recovery;

IT.PRO-10.2

Action: Isolate backup repositories from general user environments and production workloads, ensuring they are separated from primary systems to prevent unauthorised access, modification or deletion.

Domains: Boundary services, Identity services, Critical processes and services, Privileged environments, Business systems; Mitigated Techniques: Data Encrypted for Impact, Data from Local System, Inhibit System Recovery;

IT.PRO-10.3

Action: Conduct regular testing of backup and restoration procedures to ensure that backups are reliable and capable of meeting defined recovery time objectives and recovery point objectives.

Domains: Boundary services, Identity services, Critical processes and services, Privileged environments, Business systems; Mitigated Techniques: Data Encrypted for Impact, Inhibit System Recovery;

PRO-18 - Network segmentation and segregation

Principle: Systems (infrastructure, operating systems and applications) are segmented into network zones based on business criticality and trust levels, with only authorised, controlled and monitored inbound and outbound communication paths between network zones permitted.

IT.PRO-18.1

Action: Isolate systems within network zones based on business criticality and trust level, and restrict and monitor inbound and outbound access to explicitly approved pathways and services.

Domains: Boundary services, Identity services, Critical processes and services, Privileged environments, Business systems; Mitigated Techniques: Exploit Public-Facing Application, External Remote Services;

IT.PRO-18.2

Action: Limit lateral movement between, and within, network segments to explicitly approved pathways and services, based on business requirements and trust levels.

Domains: Boundary services, Identity services, Critical processes and services, Privileged environments, Business systems; Mitigated Techniques: Remote Services, Lateral Tool Transfer;

PRO-09 - Content filtering

Principle: Data communicated between different security domains for systems (infrastructure and applications) is controlled and subject to inspection and verification.

IT.PRO-09.1

Action: Inspect outbound content flows to detect unauthorised transfer of sensitive or high-value data.

Domains: Boundary services, Identity services, Critical processes and services, Privileged environments, Business systems; Mitigated Techniques: Exfiltration Over C2 Channel, Exfiltration Over Alternative Protocol, Proxy;

IT.PRO-09.2

Action: Block outbound network connections to known malicious or untrusted destinations.

Domains: Boundary services, Critical processes and services; Mitigated Techniques: Phishing, User Execution, Exfiltration Over C2 Channel, Exfiltration Over Alternative Protocol, Proxy;

IT.PRO-09.3

Action: Inspect inbound content from external or untrusted sources to prevent delivery of malicious or unsafe content.

Domains: Boundary services, Critical processes and services; Mitigated Techniques: Phishing, Remote Services, Ingress Tool Transfer;

PRO-14 - Cyber security awareness training

Principle: Personnel are provided with ongoing cyber security awareness training, including operational security considerations, tailored to their duties, access levels and current cyber threats.

IT.PRO-14.1

Action: Ensure all personnel receive cyber security awareness training, that is tailored to how they will interact with systems, applications and data in their assigned roles, before being granted access to organisational systems and data.

Domains: Boundary services, Identity services, Critical processes and services, Privileged environments; Mitigated Techniques: Phishing, Valid Accounts;

IT.PRO-14.2

Action: Update and provide cyber security awareness training on a regular basis to reflect current threats and operational considerations.

Domains: Governance and culture; Mitigated Techniques: N/A;

Detect principles

DET-01 - Centralised event logging

Principle: Security-relevant event logs and configuration changes for systems (infrastructure, operating systems, applications and data) are centrally collected, protected against unauthorised modification or deletion, and retained to support effective cyber security event detection and investigation.

IT.DET-01.1

Action: Protect event logs from unauthorised access, modification or deletion, including by encrypting them during transit and at rest and securing the systems and accounts used to store, manage and analyse them.

Domains: Boundary services, Identity services, Critical processes and services, Privileged environments, Business systems, User devices; Mitigated Techniques: Indicator Removal, Disable or Modify Tools;

IT.DET-01.2

Action: Forward high-value, security-relevant event logs and configuration changes from infrastructure, operating systems and applications to a central log storage capability.

Domains: Boundary services, Identity services, Critical processes and services, Privileged environments, Business systems, User devices; Mitigated Techniques: Indicator Removal, Disable or Modify Tools;

IT.DET-01.3

Action: Establish a centralised event log storage capability that protects logs from unauthorised access or modification.

Domains: Visibility and response; Mitigated Techniques: Indicator Removal, Disable or Modify Tools;

DET-04 - Baseline high-risk access activities

Principle: Baseline patterns of identity and credential access activities, privileged access activities, and remote access activities are established and maintained for systems (infrastructure, operating systems, applications and data) to enable the detection of anomalous or unexpected behaviour.

IT.DET-04.1

Action: Continuously monitor and analyse software execution behaviour on systems to detect where legitimate tools and utilities are being used for malicious purposes.

Domains: Boundary services, Identity services, Critical processes and services, Privileged environments; Mitigated Techniques: Valid Accounts, System Binary Proxy Execution, Command and Scripting Interpreter;

DET-02 - Cyber security event detection

Principle: Anomalous or unexpected events and behaviours for systems (infrastructure, operating systems, applications and data) are analysed in a timely manner to detect cyber security events.

IT.DET-02.1

Action: Ensure event logs are normalised, time-synchronised and enriched to support correlation across systems and environments.

Domains: Boundary services, Identity services, Critical processes and services, Privileged environments, Business systems, User devices; Mitigated Techniques: N/A;

IT.DET-02.2

Action: Ensure detection logic identifies unauthorised changes, anomalous authentication& activity and suspicious software execution.

Domains: Visibility and response; Mitigated Techniques: N/A;

DET-03 - Cyber security incident identification

Principle: Cyber security events are analysed in a timely manner to identify cyber security incidents.

IT.DET-03.1

Action: Triage alerts and events in a timely manner to determine whether cyber security incident thresholds have been met.

Domains: Visibility and response; Mitigated Techniques: N/A;

IT.DET-03.2

Action: Use indicators from across identities, applications, data and infrastructure activity rather than isolated signals when identifying cyber security incidents.

Domains: Visibility and response; Mitigated Techniques: N/A;

DET-05 - Detection capability efficacy

Principle: Cyber security event detection capabilities are regularly evaluated for effectiveness and continuously refined, including by using current strategic and sector-specific cyber threat intelligence, to improve the detection of cyber security events.

IT.DET-05.1

Action: Review detection coverage periodically to identify gaps arising from new assets, services or architectural changes.

Domains: Visibility and response; Mitigated Techniques: N/A;

Respond principles

RES-05 - Cyber security incident coordination

Principle: Cyber security incident roles and responsibilities are defined, documented and exercised to support the internal and external coordination and management of cyber security incidents, including responsibilities for declaring cyber security incidents and undertaking pre-approved response and recovery activities.

IT.RES-05.1

Action: Integrate external coordination obligations into cyber security incident response activities where required.

Domains: Visibility and response; Mitigated Techniques: N/A;

RES-03 - Cyber security incident response

Principle: Cyber security incidents are contained, eradicated and recovered from in a timely manner.

IT.RES-03.1

Action: Use documented, tested and approved cyber security incident response procedures when responding to cyber security incidents.

Domains: Visibility and response; Mitigated Techniques: N/A;

RES-04 - Cyber security incident insights

Principle: Lessons learnt from cyber security incidents are captured, and areas for improvement are identified, prioritised and actioned in a timely manner.

IT.RES-04.1

Action: Perform post-cyber security incident reviews to identify the security gaps that enabled each stage of the cyber security incident.

Domains: Visibility and response; Mitigated Techniques: N/A;

IT.RES-04.2

Action: Evaluate the monitoring coverage and cyber security incident response procedures following cyber security incidents.

Domains: Visibility and response; Mitigated Techniques: N/A;

Annex A - Domains