From 15c6902c136fec64eed6ffe3e16c6e484f93e8ee Mon Sep 17 00:00:00 2001 From: gearnode Date: Tue, 14 Jan 2025 11:34:46 +0100 Subject: [PATCH] Remap categories Signed-off-by: gearnode --- .../comms/PER.COM.001.sender_policy_framework.md} | 7 +++++-- .../comms/PER.COM.002.dkim_implementation.md} | 7 +++++-- ...ER.COM.003.domain_based_message_authentication.md} | 11 +++++++---- ...PER.COM.004.email_filtering_and_warning_system.md} | 7 +++++-- .../lifecycle/PER.LIF.001_onboarding.md} | 10 +++++++--- .../lifecycle/PER.LIF.002_offboarding.md} | 11 +++++++++-- .../PER.LIF.003_pre-employment-screening-process.md} | 7 +++++-- ...PER.LIF.004_confidential_whistleblower_process.md} | 7 +++++-- .../lifecycle/PER.LIF.005_performance_reviews.md} | 7 +++++-- ...ER.LIF.006_security_roles_and_responsibilities.md} | 7 +++++-- .../PER.LIF.007_security_awareness_training.md} | 5 ++++- .../templates/offboarding-admin-checklist.md | 0 .../lifecycle}/templates/onboarding-for-new-joiner.md | 0 .../templates/performance-review-process.md | 0 .../lifecycle}/templates/recruitment-process.md | 0 15 files changed, 62 insertions(+), 24 deletions(-) rename controls/{platform/email-security/PLT.EMAIL.001.sender_policy_framework.md => personnel/comms/PER.COM.001.sender_policy_framework.md} (91%) rename controls/{platform/email-security/PLT.EMAIL.002.dkim_implementation.md => personnel/comms/PER.COM.002.dkim_implementation.md} (88%) rename controls/{platform/email-security/PLT.EMAIL.003.domain_based_message_authentication.md => personnel/comms/PER.COM.003.domain_based_message_authentication.md} (86%) rename controls/{platform/email-security/PLT.EMAIL.004.email_filtering_and_warning_system.md => personnel/comms/PER.COM.004.email_filtering_and_warning_system.md} (90%) rename controls/{access/identity-management/ACC.IDM.001_onboarding.md => personnel/lifecycle/PER.LIF.001_onboarding.md} (79%) rename controls/{access/identity-management/ACC.IDM.002_offboarding.md => personnel/lifecycle/PER.LIF.002_offboarding.md} (82%) rename controls/{access/identity-management/ACC.IDM.003_pre-employment-screening-process.md => personnel/lifecycle/PER.LIF.003_pre-employment-screening-process.md} (90%) rename controls/{operations/reporting/OPS.REP.001_confidential_whistleblower_process.md => personnel/lifecycle/PER.LIF.004_confidential_whistleblower_process.md} (84%) rename controls/{operations/reporting/OPS.REP.002_performance_reviews.md => personnel/lifecycle/PER.LIF.005_performance_reviews.md} (88%) rename controls/{operations/reporting/OPS.REP.003_security_roles_and_responsibilities.md => personnel/lifecycle/PER.LIF.006_security_roles_and_responsibilities.md} (97%) rename controls/{operations/training/OPS.TRN.001_security_awareness_training.md => personnel/lifecycle/PER.LIF.007_security_awareness_training.md} (95%) rename controls/{access/identity-management => personnel/lifecycle}/templates/offboarding-admin-checklist.md (100%) rename controls/{access/identity-management => personnel/lifecycle}/templates/onboarding-for-new-joiner.md (100%) rename controls/{operations/reporting => personnel/lifecycle}/templates/performance-review-process.md (100%) rename controls/{access/identity-management => personnel/lifecycle}/templates/recruitment-process.md (100%) diff --git a/controls/platform/email-security/PLT.EMAIL.001.sender_policy_framework.md b/controls/personnel/comms/PER.COM.001.sender_policy_framework.md similarity index 91% rename from controls/platform/email-security/PLT.EMAIL.001.sender_policy_framework.md rename to controls/personnel/comms/PER.COM.001.sender_policy_framework.md index 4a42a2f72..2a1286590 100644 --- a/controls/platform/email-security/PLT.EMAIL.001.sender_policy_framework.md +++ b/controls/personnel/comms/PER.COM.001.sender_policy_framework.md @@ -1,14 +1,17 @@ --- -id: "PLT-EMAIL-001" -category: "platform/email-security" +id: "PER.COM.001" +category: "personnel/comms" revision-version: 1 revision-date: "2024-01-07" estimate-time: "30m" +necessity: "mandatory" frameworks: - name: "soc2" sections: ["CC6.1", "CC6.8"] --- +# Configure SPF for Email Authentication + ## Purpose SPF (Sender Policy Framework) prevents email spoofing by defining which mail diff --git a/controls/platform/email-security/PLT.EMAIL.002.dkim_implementation.md b/controls/personnel/comms/PER.COM.002.dkim_implementation.md similarity index 88% rename from controls/platform/email-security/PLT.EMAIL.002.dkim_implementation.md rename to controls/personnel/comms/PER.COM.002.dkim_implementation.md index 59903a243..5a626de1a 100644 --- a/controls/platform/email-security/PLT.EMAIL.002.dkim_implementation.md +++ b/controls/personnel/comms/PER.COM.002.dkim_implementation.md @@ -1,14 +1,17 @@ --- -id: "PLT-EMAIL-002" -category: "platform/email-security" +id: "PER.COM.002" +category: "personnel/comms" revision-version: 1 revision-date: "2024-01-07" estimate-time: "30m" +necessity: "mandatory" frameworks: - name: "soc2" sections: ["CC6.1", "CC6.8"] --- +# Configure DKIM for Email Authentication + ## Purpose DKIM (DomainKeys Identified Mail) helps prevent email spoofing by adding a diff --git a/controls/platform/email-security/PLT.EMAIL.003.domain_based_message_authentication.md b/controls/personnel/comms/PER.COM.003.domain_based_message_authentication.md similarity index 86% rename from controls/platform/email-security/PLT.EMAIL.003.domain_based_message_authentication.md rename to controls/personnel/comms/PER.COM.003.domain_based_message_authentication.md index 18124c6b9..3ba77e0ca 100644 --- a/controls/platform/email-security/PLT.EMAIL.003.domain_based_message_authentication.md +++ b/controls/personnel/comms/PER.COM.003.domain_based_message_authentication.md @@ -1,19 +1,22 @@ --- -id: "PLT-EMAIL-003" -category: "platform/email-security" +id: "PER.COM.003" +category: "personnel/comms" revision-version: 1 revision-date: "2024-01-07" estimate-time: "30m" +necessity: "mandatory" related: - - id: "COM-EMAIL-001" + - id: "PER.COM.001" required: true - - id: "COM-EMAIL-002" + - id: "PER.COM.002" required: true frameworks: - name: "soc2" sections: ["CC6.1", "CC6.8"] --- +# Configure DMARC for Email Authentication + ## Purpose DMARC (Domain-based Message Authentication, Reporting, and Conformance) is a diff --git a/controls/platform/email-security/PLT.EMAIL.004.email_filtering_and_warning_system.md b/controls/personnel/comms/PER.COM.004.email_filtering_and_warning_system.md similarity index 90% rename from controls/platform/email-security/PLT.EMAIL.004.email_filtering_and_warning_system.md rename to controls/personnel/comms/PER.COM.004.email_filtering_and_warning_system.md index 06ba70533..590d1ee25 100644 --- a/controls/platform/email-security/PLT.EMAIL.004.email_filtering_and_warning_system.md +++ b/controls/personnel/comms/PER.COM.004.email_filtering_and_warning_system.md @@ -1,14 +1,17 @@ --- -id: "PLT-EMAIL-004" -category: "platform/email-security" +id: "PER.COM.004" +category: "personnel/comms" revision-version: 1 revision-date: "2024-01-07" estimate-time: "15m" +necessity: "mandatory" frameworks: - name: "soc2" sections: ["CC6.8", "CC7.2"] --- +# Configure Email Security Filters + ## Purpose Implement email filtering and warning systems to reduce phishing risks and diff --git a/controls/access/identity-management/ACC.IDM.001_onboarding.md b/controls/personnel/lifecycle/PER.LIF.001_onboarding.md similarity index 79% rename from controls/access/identity-management/ACC.IDM.001_onboarding.md rename to controls/personnel/lifecycle/PER.LIF.001_onboarding.md index 50e3444b6..98461a9d8 100644 --- a/controls/access/identity-management/ACC.IDM.001_onboarding.md +++ b/controls/personnel/lifecycle/PER.LIF.001_onboarding.md @@ -1,14 +1,17 @@ --- -id: "ACC-IDM-001" -category: "access/identity-management" +id: "PER.LIF.001" +category: "personnel/lifecycle" revision-version: 1 revision-date: "2024-01-10" estimate-time: "30m" +necessity: "mandatory" frameworks: - name: "soc2" sections: ["CC1.4", "CC5.3"] --- +# Integrate security checklist in your onboarding process + ## Purpose It is the perfect timing to ensure that every employees has: @@ -20,7 +23,7 @@ It is the perfect timing to ensure that every employees has: ## Implementation In theory, you already have an onboarding plan for your new employees (if not, -Onboarding for new joiner](data/onboarding-for-new-joiner.md)) and a to-do for +[Onboarding for new joiner](data/onboarding-for-new-joiner.md)) and a to-do for your admin running the onboarding (if not, [Onboarding admin checklist](templates/onboarding-admin-checklist.md)). @@ -41,3 +44,4 @@ On your admin to-do, be sure to include: ## Evidence - Screenshots of a completed onboarding checklists. +- Screenshots of a completed admin checklist for new joiner. diff --git a/controls/access/identity-management/ACC.IDM.002_offboarding.md b/controls/personnel/lifecycle/PER.LIF.002_offboarding.md similarity index 82% rename from controls/access/identity-management/ACC.IDM.002_offboarding.md rename to controls/personnel/lifecycle/PER.LIF.002_offboarding.md index a2282d9a3..c641ae2d7 100644 --- a/controls/access/identity-management/ACC.IDM.002_offboarding.md +++ b/controls/personnel/lifecycle/PER.LIF.002_offboarding.md @@ -1,14 +1,17 @@ --- -id: "ACC-IDM-002" -category: "access/identity-management" +id: "PER.LIF.002" +category: "personnel/lifecycle" revision-version: 1 revision-date: "2024-01-10" estimate-time: "30m" +necessity: "mandatory" frameworks: - name: "soc2" sections: ["CC5.3", "CC6.2", "CC6.5"] --- +# Properly off-board your employees + ## Purpose Yes, people will leave your company (either by your decision or theirs). And you @@ -30,3 +33,7 @@ they left! [Offboarding admin checklist](templates/offboarding-admin-checklist.md)) 2. Upload a screenshot of your checklist that contains those bullet points below + +## Evidence + +- Screenshot of a completed admin checklist for offboarding diff --git a/controls/access/identity-management/ACC.IDM.003_pre-employment-screening-process.md b/controls/personnel/lifecycle/PER.LIF.003_pre-employment-screening-process.md similarity index 90% rename from controls/access/identity-management/ACC.IDM.003_pre-employment-screening-process.md rename to controls/personnel/lifecycle/PER.LIF.003_pre-employment-screening-process.md index 262020999..7dae24f38 100644 --- a/controls/access/identity-management/ACC.IDM.003_pre-employment-screening-process.md +++ b/controls/personnel/lifecycle/PER.LIF.003_pre-employment-screening-process.md @@ -1,14 +1,17 @@ --- -id: "ACC-IDM-003" -category: "access/identity-management" +id: "PER.LIF.003" +category: "personnel/lifecycle" revision-version: 1 revision-date: "2024-01-10" estimate-time: "30m" +necessity: "mandatory" frameworks: - name: "soc2" sections: ["CC1.4", "CC5.3"] --- +# Know your recruits + ## Purpose When recruiting someone, you want to be sure of who you are hiring: by diff --git a/controls/operations/reporting/OPS.REP.001_confidential_whistleblower_process.md b/controls/personnel/lifecycle/PER.LIF.004_confidential_whistleblower_process.md similarity index 84% rename from controls/operations/reporting/OPS.REP.001_confidential_whistleblower_process.md rename to controls/personnel/lifecycle/PER.LIF.004_confidential_whistleblower_process.md index 414ad4085..1a8d8d5ac 100644 --- a/controls/operations/reporting/OPS.REP.001_confidential_whistleblower_process.md +++ b/controls/personnel/lifecycle/PER.LIF.004_confidential_whistleblower_process.md @@ -1,14 +1,17 @@ --- -id: "OPS-REP-001" -category: "operations/reporting" +id: "PER.LIF.004" +category: "personnel/lifecycle" revision-version: 1 revision-date: "2024-01-13" estimate-time: "15m" +necessity: "mandatory" frameworks: - name: "soc2" sections: ["CC2.2"] --- +# Implement confidential whistleblower process + ## Purpose It encourages and enables employees to raise serious concerns (violations of diff --git a/controls/operations/reporting/OPS.REP.002_performance_reviews.md b/controls/personnel/lifecycle/PER.LIF.005_performance_reviews.md similarity index 88% rename from controls/operations/reporting/OPS.REP.002_performance_reviews.md rename to controls/personnel/lifecycle/PER.LIF.005_performance_reviews.md index 84d389185..7d879e4c7 100644 --- a/controls/operations/reporting/OPS.REP.002_performance_reviews.md +++ b/controls/personnel/lifecycle/PER.LIF.005_performance_reviews.md @@ -1,14 +1,17 @@ --- -id: "OPS-REP-002" -category: "operations/reporting" +id: "PER.LIF.005" +category: "personnel/lifecycle" revision-version: 1 revision-date: "2024-01-13" estimate-time: "30m" +necessity: "optional" frameworks: - name: "soc2" sections: ["CC1.3", "CC1.4", "CC1.5", "CC4.2", "CC5.3"] --- +# Run performance reviews + ## Purpose Makes sure your team has the skills and focus needed to protect what matters diff --git a/controls/operations/reporting/OPS.REP.003_security_roles_and_responsibilities.md b/controls/personnel/lifecycle/PER.LIF.006_security_roles_and_responsibilities.md similarity index 97% rename from controls/operations/reporting/OPS.REP.003_security_roles_and_responsibilities.md rename to controls/personnel/lifecycle/PER.LIF.006_security_roles_and_responsibilities.md index 1977dafc3..6c06fc8b0 100644 --- a/controls/operations/reporting/OPS.REP.003_security_roles_and_responsibilities.md +++ b/controls/personnel/lifecycle/PER.LIF.006_security_roles_and_responsibilities.md @@ -1,14 +1,17 @@ --- -id: "OPS-REP-003" -category: "operations/reporting" +id: "PER.LIF.006" +category: "personnel/lifecycle" revision-version: 1 revision-date: "2024-01-13" estimate-time: "15m" +necessity: "mandatory" frameworks: - name: "soc2" sections: ["CC1.2", "CC1.3", "CC1.5", "CC2.2", "CC4.3"] --- +# Specify security responsabilities + ## Purpose Having clear ownership improve accountability, it helps employees figure out diff --git a/controls/operations/training/OPS.TRN.001_security_awareness_training.md b/controls/personnel/lifecycle/PER.LIF.007_security_awareness_training.md similarity index 95% rename from controls/operations/training/OPS.TRN.001_security_awareness_training.md rename to controls/personnel/lifecycle/PER.LIF.007_security_awareness_training.md index c83761365..a34dce705 100644 --- a/controls/operations/training/OPS.TRN.001_security_awareness_training.md +++ b/controls/personnel/lifecycle/PER.LIF.007_security_awareness_training.md @@ -1,14 +1,17 @@ --- -id: "OPS.TRN-001" +id: "PER.LIF.007" category: "operations/training" revision-version: 1 revision-date: "2024-01-13" estimate-time: "30m" +necessity: "optional" frameworks: - name: "soc2" sections: ["CC1.4", "CC2.2"] --- +# Train your employees on security + ## Purpose Your employees are the main target of cyber threats (especially phishing and diff --git a/controls/access/identity-management/templates/offboarding-admin-checklist.md b/controls/personnel/lifecycle/templates/offboarding-admin-checklist.md similarity index 100% rename from controls/access/identity-management/templates/offboarding-admin-checklist.md rename to controls/personnel/lifecycle/templates/offboarding-admin-checklist.md diff --git a/controls/access/identity-management/templates/onboarding-for-new-joiner.md b/controls/personnel/lifecycle/templates/onboarding-for-new-joiner.md similarity index 100% rename from controls/access/identity-management/templates/onboarding-for-new-joiner.md rename to controls/personnel/lifecycle/templates/onboarding-for-new-joiner.md diff --git a/controls/operations/reporting/templates/performance-review-process.md b/controls/personnel/lifecycle/templates/performance-review-process.md similarity index 100% rename from controls/operations/reporting/templates/performance-review-process.md rename to controls/personnel/lifecycle/templates/performance-review-process.md diff --git a/controls/access/identity-management/templates/recruitment-process.md b/controls/personnel/lifecycle/templates/recruitment-process.md similarity index 100% rename from controls/access/identity-management/templates/recruitment-process.md rename to controls/personnel/lifecycle/templates/recruitment-process.md