Evidence Guide

Per-control evidence requirements: required policies, procedures, technical evidence artifacts, and audit trail requirements.

Jump to Control

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18

1 Inventory and Control of Enterprise Assets

Required Policies

Enterprise Asset Management Policy
1.1 Establish and Maintain Detailed Enterprise Asset Inventory
Type Evidence Item Frequency
Document Current inventory or catalog documentation Maintained continuously, reviewed quarterly
Document Process/procedure documentation for identification activities Reviewed annually
Technical Asset/software inventory export with required fields populated Exported quarterly for review
Record Inventory review meeting minutes or sign-off Per review cycle
Document Governing policy document (current, approved, communicated) Reviewed annually
1.2 Address Unauthorized Assets
Type Evidence Item Frequency
Document Response procedure/playbook documentation Reviewed bi-annually
Record Response action logs showing procedure execution Per incident
Document Governing policy document (current, approved, communicated) Reviewed annually
1.3 Utilize an Active Discovery Tool
Type Evidence Item Frequency
Technical Detection tool deployment evidence (dashboard screenshots, agent status) Captured monthly
Technical Sample alert/detection output demonstrating capability Captured quarterly
Document Governing policy document (current, approved, communicated) Reviewed annually
1.4 Use Dynamic Host Configuration Protocol (DHCP) Logging to Update Enterprise Asset Inventory
Type Evidence Item Frequency
Document Current inventory or catalog documentation Maintained continuously, reviewed quarterly
Document Process/procedure documentation for identification activities Reviewed annually
Technical Asset/software inventory export with required fields populated Exported quarterly for review
Record Inventory review meeting minutes or sign-off Per review cycle
Technical SIEM dashboard showing log sources and collection status Captured monthly
Record Log review records and findings Per review cycle
Document Governing policy document (current, approved, communicated) Reviewed annually
1.5 Use a Passive Asset Discovery Tool
Type Evidence Item Frequency
Technical Detection tool deployment evidence (dashboard screenshots, agent status) Captured monthly
Technical Sample alert/detection output demonstrating capability Captured quarterly
Technical Asset/software inventory export with required fields populated Exported quarterly for review
Record Inventory review meeting minutes or sign-off Per review cycle
Technical Vulnerability scan reports showing scope and findings Per scan cycle
Record Vulnerability remediation tracking with SLA compliance metrics Monthly
Document Governing policy document (current, approved, communicated) Reviewed annually

2 Inventory and Control of Software Assets

Required Policies

Software Asset Management Policy
2.1 Establish and Maintain a Software Inventory
Type Evidence Item Frequency
Document Current inventory or catalog documentation Maintained continuously, reviewed quarterly
Document Process/procedure documentation for identification activities Reviewed annually
Technical Asset/software inventory export with required fields populated Exported quarterly for review
Record Inventory review meeting minutes or sign-off Per review cycle
Document Governing policy document (current, approved, communicated) Reviewed annually
2.2 Ensure Authorized Software is Currently Supported
Type Evidence Item Frequency
Document Current inventory or catalog documentation Maintained continuously, reviewed quarterly
Document Process/procedure documentation for identification activities Reviewed annually
Technical Asset/software inventory export with required fields populated Exported quarterly for review
Record Inventory review meeting minutes or sign-off Per review cycle
Document Governing policy document (current, approved, communicated) Reviewed annually
2.3 Address Unauthorized Software
Type Evidence Item Frequency
Document Response procedure/playbook documentation Reviewed bi-annually
Record Response action logs showing procedure execution Per incident
Document Governing policy document (current, approved, communicated) Reviewed annually
2.4 Utilize Automated Software Inventory Tools
Type Evidence Item Frequency
Technical Detection tool deployment evidence (dashboard screenshots, agent status) Captured monthly
Technical Sample alert/detection output demonstrating capability Captured quarterly
Technical Asset/software inventory export with required fields populated Exported quarterly for review
Record Inventory review meeting minutes or sign-off Per review cycle
Document Governing policy document (current, approved, communicated) Reviewed annually
2.5 Allowlist Authorized Software
Type Evidence Item Frequency
Technical Configuration screenshots or exports showing protection controls enabled Captured quarterly
Document Procedure documentation for protection measures Reviewed annually
Record Access review/recertification records with sign-off Quarterly
Technical Access control configuration evidence (RBAC settings, group memberships) Reviewed quarterly
Document Governing policy document (current, approved, communicated) Reviewed annually
2.6 Allowlist Authorized Libraries
Type Evidence Item Frequency
Technical Configuration screenshots or exports showing protection controls enabled Captured quarterly
Document Procedure documentation for protection measures Reviewed annually
Document Governing policy document (current, approved, communicated) Reviewed annually
2.7 Allowlist Authorized Scripts
Type Evidence Item Frequency
Technical Configuration screenshots or exports showing protection controls enabled Captured quarterly
Document Procedure documentation for protection measures Reviewed annually
Document Governing policy document (current, approved, communicated) Reviewed annually

3 Data Protection

Required Policies

Data Classification and Handling Policy Data Retention and Disposal Policy Encryption Policy Data Loss Prevention Policy Acceptable Encryption Standards
3.1 Establish and Maintain a Data Management Process
Type Evidence Item Frequency
Document Current inventory or catalog documentation Maintained continuously, reviewed quarterly
Document Process/procedure documentation for identification activities Reviewed annually
Document Governing policy document (current, approved, communicated) Reviewed annually
3.2 Establish and Maintain a Data Inventory
Type Evidence Item Frequency
Document Current inventory or catalog documentation Maintained continuously, reviewed quarterly
Document Process/procedure documentation for identification activities Reviewed annually
Technical Asset/software inventory export with required fields populated Exported quarterly for review
Record Inventory review meeting minutes or sign-off Per review cycle
Document Governing policy document (current, approved, communicated) Reviewed annually
3.3 Configure Data Access Control Lists
Type Evidence Item Frequency
Technical Configuration screenshots or exports showing protection controls enabled Captured quarterly
Document Procedure documentation for protection measures Reviewed annually
Record Access review/recertification records with sign-off Quarterly
Technical Access control configuration evidence (RBAC settings, group memberships) Reviewed quarterly
Document Governing policy document (current, approved, communicated) Reviewed annually
3.4 Enforce Data Retention
Type Evidence Item Frequency
Technical Configuration screenshots or exports showing protection controls enabled Captured quarterly
Document Procedure documentation for protection measures Reviewed annually
Document Governing policy document (current, approved, communicated) Reviewed annually
3.5 Securely Dispose of Data
Type Evidence Item Frequency
Technical Configuration screenshots or exports showing protection controls enabled Captured quarterly
Document Procedure documentation for protection measures Reviewed annually
Document Governing policy document (current, approved, communicated) Reviewed annually
3.6 Encrypt Data on End>User Devices
Type Evidence Item Frequency
Technical Configuration screenshots or exports showing protection controls enabled Captured quarterly
Document Procedure documentation for protection measures Reviewed annually
Technical Encryption configuration evidence (disk encryption status, TLS settings) Scanned monthly
Document Key management procedures and key rotation records Reviewed annually
Document Governing policy document (current, approved, communicated) Reviewed annually
3.7 Establish and Maintain a Data Classification Scheme
Type Evidence Item Frequency
Document Current inventory or catalog documentation Maintained continuously, reviewed quarterly
Document Process/procedure documentation for identification activities Reviewed annually
Document Governing policy document (current, approved, communicated) Reviewed annually
3.8 Document Data Flows
Type Evidence Item Frequency
Document Current inventory or catalog documentation Maintained continuously, reviewed quarterly
Document Process/procedure documentation for identification activities Reviewed annually
Record Third-party risk assessment reports and scorecards Annually per vendor
Document Vendor contracts with security requirements Per contract cycle
Document Governing policy document (current, approved, communicated) Reviewed annually
3.9 Encrypt Data on Removable Media
Type Evidence Item Frequency
Technical Configuration screenshots or exports showing protection controls enabled Captured quarterly
Document Procedure documentation for protection measures Reviewed annually
Technical Encryption configuration evidence (disk encryption status, TLS settings) Scanned monthly
Document Key management procedures and key rotation records Reviewed annually
Document Governing policy document (current, approved, communicated) Reviewed annually
3.10 Encrypt Sensitive Data in Transit
Type Evidence Item Frequency
Technical Configuration screenshots or exports showing protection controls enabled Captured quarterly
Document Procedure documentation for protection measures Reviewed annually
Technical Encryption configuration evidence (disk encryption status, TLS settings) Scanned monthly
Document Key management procedures and key rotation records Reviewed annually
Document Governing policy document (current, approved, communicated) Reviewed annually
3.11 Encrypt Sensitive Data at Rest
Type Evidence Item Frequency
Technical Configuration screenshots or exports showing protection controls enabled Captured quarterly
Document Procedure documentation for protection measures Reviewed annually
Technical Encryption configuration evidence (disk encryption status, TLS settings) Scanned monthly
Document Key management procedures and key rotation records Reviewed annually
Document Governing policy document (current, approved, communicated) Reviewed annually
3.12 Segment Data Processing and Storage Based on Sensitivity
Type Evidence Item Frequency
Technical Configuration screenshots or exports showing protection controls enabled Captured quarterly
Document Procedure documentation for protection measures Reviewed annually
Document Governing policy document (current, approved, communicated) Reviewed annually
3.13 Deploy a Data Loss Prevention Solution
Type Evidence Item Frequency
Technical Configuration screenshots or exports showing protection controls enabled Captured quarterly
Document Procedure documentation for protection measures Reviewed annually
Technical Asset/software inventory export with required fields populated Exported quarterly for review
Record Inventory review meeting minutes or sign-off Per review cycle
Record Third-party risk assessment reports and scorecards Annually per vendor
Document Vendor contracts with security requirements Per contract cycle
Document Governing policy document (current, approved, communicated) Reviewed annually
3.14 Log Sensitive Data Access
Type Evidence Item Frequency
Technical Detection tool deployment evidence (dashboard screenshots, agent status) Captured monthly
Technical Sample alert/detection output demonstrating capability Captured quarterly
Technical SIEM dashboard showing log sources and collection status Captured monthly
Record Log review records and findings Per review cycle
Document Governing policy document (current, approved, communicated) Reviewed annually

4 Secure Configuration of Enterprise Assets and Software

Required Policies

Secure Configuration Management Policy Mobile Device Management Policy Firewall Policy
4.1 Establish and Maintain a Secure Configuration Process
Type Evidence Item Frequency
Technical Configuration screenshots or exports showing protection controls enabled Captured quarterly
Document Procedure documentation for protection measures Reviewed annually
Technical Configuration compliance scan results against approved baseline Scanned monthly
Document Approved baseline configuration documentation Reviewed quarterly
Document Governing policy document (current, approved, communicated) Reviewed annually
4.2 Establish and Maintain a Secure Configuration Process for Network Infrastructure
Type Evidence Item Frequency
Technical Configuration screenshots or exports showing protection controls enabled Captured quarterly
Document Procedure documentation for protection measures Reviewed annually
Technical Configuration compliance scan results against approved baseline Scanned monthly
Document Approved baseline configuration documentation Reviewed quarterly
Document Governing policy document (current, approved, communicated) Reviewed annually
4.3 Configure Automatic Session Locking on Enterprise Assets
Type Evidence Item Frequency
Technical Configuration screenshots or exports showing protection controls enabled Captured quarterly
Document Procedure documentation for protection measures Reviewed annually
Document Governing policy document (current, approved, communicated) Reviewed annually
4.4 Implement and Manage a Firewall on Servers
Type Evidence Item Frequency
Technical Configuration screenshots or exports showing protection controls enabled Captured quarterly
Document Procedure documentation for protection measures Reviewed annually
Technical Firewall rule set export and review documentation Reviewed quarterly
Record Firewall change request and approval records Per change
Record Third-party risk assessment reports and scorecards Annually per vendor
Document Vendor contracts with security requirements Per contract cycle
Document Governing policy document (current, approved, communicated) Reviewed annually
4.5 Implement and Manage a Firewall on End>User Devices
Type Evidence Item Frequency
Technical Configuration screenshots or exports showing protection controls enabled Captured quarterly
Document Procedure documentation for protection measures Reviewed annually
Technical Firewall rule set export and review documentation Reviewed quarterly
Record Firewall change request and approval records Per change
Document Governing policy document (current, approved, communicated) Reviewed annually
4.6 Securely Manage Enterprise Assets and Software
Type Evidence Item Frequency
Technical Configuration screenshots or exports showing protection controls enabled Captured quarterly
Document Procedure documentation for protection measures Reviewed annually
Technical Configuration compliance scan results against approved baseline Scanned monthly
Document Approved baseline configuration documentation Reviewed quarterly
Record Access review/recertification records with sign-off Quarterly
Technical Access control configuration evidence (RBAC settings, group memberships) Reviewed quarterly
Document Governing policy document (current, approved, communicated) Reviewed annually
4.7 Manage Default Accounts on Enterprise Assets and Software
Type Evidence Item Frequency
Technical Configuration screenshots or exports showing protection controls enabled Captured quarterly
Document Procedure documentation for protection measures Reviewed annually
Document Governing policy document (current, approved, communicated) Reviewed annually
4.8 Uninstall or Disable Unnecessary Services on Enterprise Assets and Software
Type Evidence Item Frequency
Technical Configuration screenshots or exports showing protection controls enabled Captured quarterly
Document Procedure documentation for protection measures Reviewed annually
Document Governing policy document (current, approved, communicated) Reviewed annually
4.9 Configure Trusted DNS Servers on Enterprise Assets
Type Evidence Item Frequency
Technical Configuration screenshots or exports showing protection controls enabled Captured quarterly
Document Procedure documentation for protection measures Reviewed annually
Record Access review/recertification records with sign-off Quarterly
Technical Access control configuration evidence (RBAC settings, group memberships) Reviewed quarterly
Technical DNS filtering configuration and block statistics Monthly
Document Governing policy document (current, approved, communicated) Reviewed annually
4.10 Enforce Automatic Device Lockout on Portable End>User Devices
Type Evidence Item Frequency
Document Response procedure/playbook documentation Reviewed bi-annually
Record Response action logs showing procedure execution Per incident
Technical Configuration compliance scan results against approved baseline Scanned monthly
Document Approved baseline configuration documentation Reviewed quarterly
Document Governing policy document (current, approved, communicated) Reviewed annually
4.11 Enforce Remote Wipe Capability on Portable End>User Devices
Type Evidence Item Frequency
Technical Configuration screenshots or exports showing protection controls enabled Captured quarterly
Document Procedure documentation for protection measures Reviewed annually
Document Governing policy document (current, approved, communicated) Reviewed annually
4.12 Separate Enterprise Workspaces on Mobile End>User Devices
Type Evidence Item Frequency
Technical Configuration screenshots or exports showing protection controls enabled Captured quarterly
Document Procedure documentation for protection measures Reviewed annually
Technical Configuration compliance scan results against approved baseline Scanned monthly
Document Approved baseline configuration documentation Reviewed quarterly
Document Governing policy document (current, approved, communicated) Reviewed annually

5 Account Management

Required Policies

Account and Credential Management Policy Privileged Access Management Policy
5.1 Establish and Maintain an Inventory of Accounts
Type Evidence Item Frequency
Document Current inventory or catalog documentation Maintained continuously, reviewed quarterly
Document Process/procedure documentation for identification activities Reviewed annually
Technical Asset/software inventory export with required fields populated Exported quarterly for review
Record Inventory review meeting minutes or sign-off Per review cycle
Document Governing policy document (current, approved, communicated) Reviewed annually
5.2 Use Unique Passwords
Type Evidence Item Frequency
Technical Configuration screenshots or exports showing protection controls enabled Captured quarterly
Document Procedure documentation for protection measures Reviewed annually
Technical MFA enrollment status and enforcement configuration Reviewed monthly
Document Governing policy document (current, approved, communicated) Reviewed annually
5.3 Disable Dormant Accounts
Type Evidence Item Frequency
Document Response procedure/playbook documentation Reviewed bi-annually
Record Response action logs showing procedure execution Per incident
Document Governing policy document (current, approved, communicated) Reviewed annually
5.4 Restrict Administrator Privileges to Dedicated Administrator Accounts
Type Evidence Item Frequency
Technical Configuration screenshots or exports showing protection controls enabled Captured quarterly
Document Procedure documentation for protection measures Reviewed annually
Technical Email security configuration (SPF, DKIM, DMARC records) Verified quarterly
Document Governing policy document (current, approved, communicated) Reviewed annually
5.5 Establish and Maintain an Inventory of Service Accounts
Type Evidence Item Frequency
Document Current inventory or catalog documentation Maintained continuously, reviewed quarterly
Document Process/procedure documentation for identification activities Reviewed annually
Technical Asset/software inventory export with required fields populated Exported quarterly for review
Record Inventory review meeting minutes or sign-off Per review cycle
Document Governing policy document (current, approved, communicated) Reviewed annually
5.6 Centralize Account Management
Type Evidence Item Frequency
Technical Configuration screenshots or exports showing protection controls enabled Captured quarterly
Document Procedure documentation for protection measures Reviewed annually
Document Governing policy document (current, approved, communicated) Reviewed annually

6 Access Control Management

Required Policies

Account and Credential Management Policy Privileged Access Management Policy
6.1 Establish an Access Granting Process
Type Evidence Item Frequency
Technical Configuration screenshots or exports showing protection controls enabled Captured quarterly
Document Procedure documentation for protection measures Reviewed annually
Document Governing policy document (current, approved, communicated) Reviewed annually
6.2 Establish an Access Revoking Process
Type Evidence Item Frequency
Technical Configuration screenshots or exports showing protection controls enabled Captured quarterly
Document Procedure documentation for protection measures Reviewed annually
Technical SIEM dashboard showing log sources and collection status Captured monthly
Record Log review records and findings Per review cycle
Document Governing policy document (current, approved, communicated) Reviewed annually
6.3 Require MFA for Externally>Exposed Applications
Type Evidence Item Frequency
Technical Configuration screenshots or exports showing protection controls enabled Captured quarterly
Document Procedure documentation for protection measures Reviewed annually
Technical MFA enrollment status and enforcement configuration Reviewed monthly
Record Third-party risk assessment reports and scorecards Annually per vendor
Document Vendor contracts with security requirements Per contract cycle
Document Governing policy document (current, approved, communicated) Reviewed annually
6.4 Require MFA for Remote Network Access
Type Evidence Item Frequency
Technical Configuration screenshots or exports showing protection controls enabled Captured quarterly
Document Procedure documentation for protection measures Reviewed annually
Technical MFA enrollment status and enforcement configuration Reviewed monthly
Document Governing policy document (current, approved, communicated) Reviewed annually
6.5 Require MFA for Administrative Access
Type Evidence Item Frequency
Technical Configuration screenshots or exports showing protection controls enabled Captured quarterly
Document Procedure documentation for protection measures Reviewed annually
Technical MFA enrollment status and enforcement configuration Reviewed monthly
Record Third-party risk assessment reports and scorecards Annually per vendor
Document Vendor contracts with security requirements Per contract cycle
Document Governing policy document (current, approved, communicated) Reviewed annually
6.6 Establish and Maintain an Inventory of Authentication and Authorization Systems
Type Evidence Item Frequency
Document Current inventory or catalog documentation Maintained continuously, reviewed quarterly
Document Process/procedure documentation for identification activities Reviewed annually
Technical Asset/software inventory export with required fields populated Exported quarterly for review
Record Inventory review meeting minutes or sign-off Per review cycle
Record Third-party risk assessment reports and scorecards Annually per vendor
Document Vendor contracts with security requirements Per contract cycle
Document Governing policy document (current, approved, communicated) Reviewed annually
6.7 Centralize Access Control
Type Evidence Item Frequency
Technical Configuration screenshots or exports showing protection controls enabled Captured quarterly
Document Procedure documentation for protection measures Reviewed annually
Record Access review/recertification records with sign-off Quarterly
Technical Access control configuration evidence (RBAC settings, group memberships) Reviewed quarterly
Document Governing policy document (current, approved, communicated) Reviewed annually
6.8 Define and Maintain Role>Based Access Control
Type Evidence Item Frequency
Technical Configuration screenshots or exports showing protection controls enabled Captured quarterly
Document Procedure documentation for protection measures Reviewed annually
Record Access review/recertification records with sign-off Quarterly
Technical Access control configuration evidence (RBAC settings, group memberships) Reviewed quarterly
Document Governing policy document (current, approved, communicated) Reviewed annually

7 Continuous Vulnerability Management

Required Policies

Vulnerability Management Policy Patch Management Policy
7.1 Establish and Maintain a Vulnerability Management Process
Type Evidence Item Frequency
Technical Configuration screenshots or exports showing protection controls enabled Captured quarterly
Document Procedure documentation for protection measures Reviewed annually
Technical Vulnerability scan reports showing scope and findings Per scan cycle
Record Vulnerability remediation tracking with SLA compliance metrics Monthly
Document Governing policy document (current, approved, communicated) Reviewed annually
7.2 Establish and Maintain a Remediation Process
Type Evidence Item Frequency
Document Response procedure/playbook documentation Reviewed bi-annually
Record Response action logs showing procedure execution Per incident
Document Governing policy document (current, approved, communicated) Reviewed annually
7.3 Perform Automated Operating System Patch Management
Type Evidence Item Frequency
Technical Configuration screenshots or exports showing protection controls enabled Captured quarterly
Document Procedure documentation for protection measures Reviewed annually
Document Governing policy document (current, approved, communicated) Reviewed annually
7.4 Perform Automated Application Patch Management
Type Evidence Item Frequency
Technical Configuration screenshots or exports showing protection controls enabled Captured quarterly
Document Procedure documentation for protection measures Reviewed annually
Document Governing policy document (current, approved, communicated) Reviewed annually
7.5 Perform Automated Vulnerability Scans of Internal Enterprise Assets
Type Evidence Item Frequency
Document Current inventory or catalog documentation Maintained continuously, reviewed quarterly
Document Process/procedure documentation for identification activities Reviewed annually
Technical Vulnerability scan reports showing scope and findings Per scan cycle
Record Vulnerability remediation tracking with SLA compliance metrics Monthly
Document Governing policy document (current, approved, communicated) Reviewed annually
7.6 Perform Automated Vulnerability Scans of Externally>Exposed Enterprise Assets
Type Evidence Item Frequency
Document Current inventory or catalog documentation Maintained continuously, reviewed quarterly
Document Process/procedure documentation for identification activities Reviewed annually
Technical Vulnerability scan reports showing scope and findings Per scan cycle
Record Vulnerability remediation tracking with SLA compliance metrics Monthly
Document Governing policy document (current, approved, communicated) Reviewed annually
7.7 Remediate Detected Vulnerabilities
Type Evidence Item Frequency
Document Response procedure/playbook documentation Reviewed bi-annually
Record Response action logs showing procedure execution Per incident
Technical Vulnerability scan reports showing scope and findings Per scan cycle
Record Vulnerability remediation tracking with SLA compliance metrics Monthly
Document Governing policy document (current, approved, communicated) Reviewed annually

8 Audit Log Management

Required Policies

Audit Log Management Policy Log Retention Policy
8.1 Establish and Maintain an Audit Log Management Process
Type Evidence Item Frequency
Technical Configuration screenshots or exports showing protection controls enabled Captured quarterly
Document Procedure documentation for protection measures Reviewed annually
Technical SIEM dashboard showing log sources and collection status Captured monthly
Record Log review records and findings Per review cycle
Document Governing policy document (current, approved, communicated) Reviewed annually
8.2 Collect Audit Logs
Type Evidence Item Frequency
Technical Detection tool deployment evidence (dashboard screenshots, agent status) Captured monthly
Technical Sample alert/detection output demonstrating capability Captured quarterly
Technical SIEM dashboard showing log sources and collection status Captured monthly
Record Log review records and findings Per review cycle
Document Governing policy document (current, approved, communicated) Reviewed annually
8.3 Ensure Adequate Audit Log Storage
Type Evidence Item Frequency
Technical Configuration screenshots or exports showing protection controls enabled Captured quarterly
Document Procedure documentation for protection measures Reviewed annually
Technical SIEM dashboard showing log sources and collection status Captured monthly
Record Log review records and findings Per review cycle
Document Governing policy document (current, approved, communicated) Reviewed annually
8.4 Standardize Time Synchronization
Type Evidence Item Frequency
Technical Configuration screenshots or exports showing protection controls enabled Captured quarterly
Document Procedure documentation for protection measures Reviewed annually
Document Governing policy document (current, approved, communicated) Reviewed annually
8.5 Collect Detailed Audit Logs
Type Evidence Item Frequency
Technical Detection tool deployment evidence (dashboard screenshots, agent status) Captured monthly
Technical Sample alert/detection output demonstrating capability Captured quarterly
Technical SIEM dashboard showing log sources and collection status Captured monthly
Record Log review records and findings Per review cycle
Document Governing policy document (current, approved, communicated) Reviewed annually
8.6 Collect DNS Query Audit Logs
Type Evidence Item Frequency
Technical Detection tool deployment evidence (dashboard screenshots, agent status) Captured monthly
Technical Sample alert/detection output demonstrating capability Captured quarterly
Technical SIEM dashboard showing log sources and collection status Captured monthly
Record Log review records and findings Per review cycle
Technical DNS filtering configuration and block statistics Monthly
Document Governing policy document (current, approved, communicated) Reviewed annually
8.7 Collect URL Request Audit Logs
Type Evidence Item Frequency
Technical Detection tool deployment evidence (dashboard screenshots, agent status) Captured monthly
Technical Sample alert/detection output demonstrating capability Captured quarterly
Technical SIEM dashboard showing log sources and collection status Captured monthly
Record Log review records and findings Per review cycle
Document Governing policy document (current, approved, communicated) Reviewed annually
8.8 Collect Command>Line Audit Logs
Type Evidence Item Frequency
Technical Detection tool deployment evidence (dashboard screenshots, agent status) Captured monthly
Technical Sample alert/detection output demonstrating capability Captured quarterly
Technical SIEM dashboard showing log sources and collection status Captured monthly
Record Log review records and findings Per review cycle
Document Governing policy document (current, approved, communicated) Reviewed annually
8.9 Centralize Audit Logs
Type Evidence Item Frequency
Technical Detection tool deployment evidence (dashboard screenshots, agent status) Captured monthly
Technical Sample alert/detection output demonstrating capability Captured quarterly
Technical SIEM dashboard showing log sources and collection status Captured monthly
Record Log review records and findings Per review cycle
Document Governing policy document (current, approved, communicated) Reviewed annually
8.10 Retain Audit Logs
Type Evidence Item Frequency
Technical Configuration screenshots or exports showing protection controls enabled Captured quarterly
Document Procedure documentation for protection measures Reviewed annually
Technical SIEM dashboard showing log sources and collection status Captured monthly
Record Log review records and findings Per review cycle
Document Governing policy document (current, approved, communicated) Reviewed annually
8.11 Conduct Audit Log Reviews
Type Evidence Item Frequency
Technical Detection tool deployment evidence (dashboard screenshots, agent status) Captured monthly
Technical Sample alert/detection output demonstrating capability Captured quarterly
Technical SIEM dashboard showing log sources and collection status Captured monthly
Record Log review records and findings Per review cycle
Document Governing policy document (current, approved, communicated) Reviewed annually
8.12 Collect Service Provider Logs
Type Evidence Item Frequency
Technical Detection tool deployment evidence (dashboard screenshots, agent status) Captured monthly
Technical Sample alert/detection output demonstrating capability Captured quarterly
Technical SIEM dashboard showing log sources and collection status Captured monthly
Record Log review records and findings Per review cycle
Record Third-party risk assessment reports and scorecards Annually per vendor
Document Vendor contracts with security requirements Per contract cycle
Document Governing policy document (current, approved, communicated) Reviewed annually

9 Email and Web Browser Protections

Required Policies

Secure Configuration Management Policy Email Security Policy Web Browser Security Policy
9.1 Ensure Use of Only Fully Supported Browsers and Email Clients
Type Evidence Item Frequency
Technical Configuration screenshots or exports showing protection controls enabled Captured quarterly
Document Procedure documentation for protection measures Reviewed annually
Technical Email security configuration (SPF, DKIM, DMARC records) Verified quarterly
Document Governing policy document (current, approved, communicated) Reviewed annually
9.2 Use DNS Filtering Services
Type Evidence Item Frequency
Technical Configuration screenshots or exports showing protection controls enabled Captured quarterly
Document Procedure documentation for protection measures Reviewed annually
Technical DNS filtering configuration and block statistics Monthly
Document Governing policy document (current, approved, communicated) Reviewed annually
9.3 Maintain and Enforce Network>Based URL Filters
Type Evidence Item Frequency
Technical Configuration screenshots or exports showing protection controls enabled Captured quarterly
Document Procedure documentation for protection measures Reviewed annually
Document Governing policy document (current, approved, communicated) Reviewed annually
9.4 Restrict Unnecessary or Unauthorized Browser and Email Client Extensions
Type Evidence Item Frequency
Technical Configuration screenshots or exports showing protection controls enabled Captured quarterly
Document Procedure documentation for protection measures Reviewed annually
Technical Email security configuration (SPF, DKIM, DMARC records) Verified quarterly
Document Governing policy document (current, approved, communicated) Reviewed annually
9.5 Implement DMARC
Type Evidence Item Frequency
Technical Configuration screenshots or exports showing protection controls enabled Captured quarterly
Document Procedure documentation for protection measures Reviewed annually
Technical Email security configuration (SPF, DKIM, DMARC records) Verified quarterly
Document Governing policy document (current, approved, communicated) Reviewed annually
9.6 Block Unnecessary File Types
Type Evidence Item Frequency
Technical Configuration screenshots or exports showing protection controls enabled Captured quarterly
Document Procedure documentation for protection measures Reviewed annually
Technical Email security configuration (SPF, DKIM, DMARC records) Verified quarterly
Document Governing policy document (current, approved, communicated) Reviewed annually
9.7 Deploy and Maintain Email Server Anti>Malware Protections
Type Evidence Item Frequency
Technical Configuration screenshots or exports showing protection controls enabled Captured quarterly
Document Procedure documentation for protection measures Reviewed annually
Technical Vulnerability scan reports showing scope and findings Per scan cycle
Record Vulnerability remediation tracking with SLA compliance metrics Monthly
Technical Email security configuration (SPF, DKIM, DMARC records) Verified quarterly
Technical Anti-malware deployment status and detection statistics Monthly
Document Governing policy document (current, approved, communicated) Reviewed annually

10 Malware Defenses

Required Policies

Anti-Malware Policy Removable Media Policy
10.1 Deploy and Maintain Anti>Malware Software
Type Evidence Item Frequency
Technical Configuration screenshots or exports showing protection controls enabled Captured quarterly
Document Procedure documentation for protection measures Reviewed annually
Technical Anti-malware deployment status and detection statistics Monthly
Document Governing policy document (current, approved, communicated) Reviewed annually
10.2 Configure Automatic Anti>Malware Signature Updates
Type Evidence Item Frequency
Technical Configuration screenshots or exports showing protection controls enabled Captured quarterly
Document Procedure documentation for protection measures Reviewed annually
Technical Anti-malware deployment status and detection statistics Monthly
Document Governing policy document (current, approved, communicated) Reviewed annually
10.3 Disable Autorun and Autoplay for Removable Media
Type Evidence Item Frequency
Technical Configuration screenshots or exports showing protection controls enabled Captured quarterly
Document Procedure documentation for protection measures Reviewed annually
Document Governing policy document (current, approved, communicated) Reviewed annually
10.4 Configure Automatic Anti>Malware Scanning of Removable Media
Type Evidence Item Frequency
Technical Detection tool deployment evidence (dashboard screenshots, agent status) Captured monthly
Technical Sample alert/detection output demonstrating capability Captured quarterly
Technical Vulnerability scan reports showing scope and findings Per scan cycle
Record Vulnerability remediation tracking with SLA compliance metrics Monthly
Technical Anti-malware deployment status and detection statistics Monthly
Document Governing policy document (current, approved, communicated) Reviewed annually
10.5 Enable Anti>Exploitation Features
Type Evidence Item Frequency
Technical Configuration screenshots or exports showing protection controls enabled Captured quarterly
Document Procedure documentation for protection measures Reviewed annually
Document Governing policy document (current, approved, communicated) Reviewed annually
10.6 Centrally Manage Anti>Malware Software
Type Evidence Item Frequency
Technical Configuration screenshots or exports showing protection controls enabled Captured quarterly
Document Procedure documentation for protection measures Reviewed annually
Technical Anti-malware deployment status and detection statistics Monthly
Document Governing policy document (current, approved, communicated) Reviewed annually
10.7 Use Behavior>Based Anti>Malware Software
Type Evidence Item Frequency
Technical Detection tool deployment evidence (dashboard screenshots, agent status) Captured monthly
Technical Sample alert/detection output demonstrating capability Captured quarterly
Technical Anti-malware deployment status and detection statistics Monthly
Document Governing policy document (current, approved, communicated) Reviewed annually

11 Data Recovery

Required Policies

Backup and Recovery Policy
11.1 Establish and Maintain a Data Recovery Process 
Type Evidence Item Frequency
Document Recovery plan documentation Reviewed annually
Record Recovery test results and lessons learned Tested quarterly
Technical Backup job status reports and success rates Reviewed weekly
Record Backup restoration test results Tested quarterly
Document Governing policy document (current, approved, communicated) Reviewed annually
11.2 Perform Automated Backups 
Type Evidence Item Frequency
Document Recovery plan documentation Reviewed annually
Record Recovery test results and lessons learned Tested quarterly
Technical Backup job status reports and success rates Reviewed weekly
Record Backup restoration test results Tested quarterly
Document Governing policy document (current, approved, communicated) Reviewed annually
11.3 Protect Recovery Data
Type Evidence Item Frequency
Technical Configuration screenshots or exports showing protection controls enabled Captured quarterly
Document Procedure documentation for protection measures Reviewed annually
Technical Encryption configuration evidence (disk encryption status, TLS settings) Scanned monthly
Document Key management procedures and key rotation records Reviewed annually
Technical Backup job status reports and success rates Reviewed weekly
Record Backup restoration test results Tested quarterly
Document Governing policy document (current, approved, communicated) Reviewed annually
11.4 Establish and Maintain an Isolated Instance of Recovery Data 
Type Evidence Item Frequency
Document Recovery plan documentation Reviewed annually
Record Recovery test results and lessons learned Tested quarterly
Technical Backup job status reports and success rates Reviewed weekly
Record Backup restoration test results Tested quarterly
Document Governing policy document (current, approved, communicated) Reviewed annually
11.5 Test Data Recovery
Type Evidence Item Frequency
Document Recovery plan documentation Reviewed annually
Record Recovery test results and lessons learned Tested quarterly
Technical Backup job status reports and success rates Reviewed weekly
Record Backup restoration test results Tested quarterly
Document Governing policy document (current, approved, communicated) Reviewed annually

12 Network Infrastructure Management

Required Policies

Secure Configuration Management Policy Network Security Policy Network Change Management Policy
12.1 Ensure Network Infrastructure is Up>to>Date
Type Evidence Item Frequency
Technical Configuration screenshots or exports showing protection controls enabled Captured quarterly
Document Procedure documentation for protection measures Reviewed annually
Document Governing policy document (current, approved, communicated) Reviewed annually
12.2 Establish and Maintain a Secure Network Architecture
Type Evidence Item Frequency
Technical Configuration screenshots or exports showing protection controls enabled Captured quarterly
Document Procedure documentation for protection measures Reviewed annually
Document Governing policy document (current, approved, communicated) Reviewed annually
12.3 Securely Manage Network Infrastructure
Type Evidence Item Frequency
Technical Configuration screenshots or exports showing protection controls enabled Captured quarterly
Document Procedure documentation for protection measures Reviewed annually
Document Governing policy document (current, approved, communicated) Reviewed annually
12.4 Establish and Maintain Architecture Diagram(s)
Type Evidence Item Frequency
Document Current inventory or catalog documentation Maintained continuously, reviewed quarterly
Document Process/procedure documentation for identification activities Reviewed annually
Document Governing policy document (current, approved, communicated) Reviewed annually
12.5 Centralize Network Authentication, Authorization, and Auditing (AAA)
Type Evidence Item Frequency
Technical Configuration screenshots or exports showing protection controls enabled Captured quarterly
Document Procedure documentation for protection measures Reviewed annually
Document Governing policy document (current, approved, communicated) Reviewed annually
12.6 Use of Secure Network Management and Communication Protocols 
Type Evidence Item Frequency
Technical Configuration screenshots or exports showing protection controls enabled Captured quarterly
Document Procedure documentation for protection measures Reviewed annually
Document Governing policy document (current, approved, communicated) Reviewed annually
12.7 Ensure Remote Devices Utilize a VPN and are Connecting to an Enterprise’s AAA Infrastructure
Type Evidence Item Frequency
Technical Configuration screenshots or exports showing protection controls enabled Captured quarterly
Document Procedure documentation for protection measures Reviewed annually
Document Governing policy document (current, approved, communicated) Reviewed annually
12.8 Establish and Maintain Dedicated Computing Resources for All Administrative Work
Type Evidence Item Frequency
Technical Configuration screenshots or exports showing protection controls enabled Captured quarterly
Document Procedure documentation for protection measures Reviewed annually
Technical SIEM dashboard showing log sources and collection status Captured monthly
Record Log review records and findings Per review cycle
Document Governing policy document (current, approved, communicated) Reviewed annually

13 Network Monitoring and Defense

Required Policies

Network Security Policy Network Access Control Policy Network Monitoring Policy
13.1 Centralize Security Event Alerting
Type Evidence Item Frequency
Technical Detection tool deployment evidence (dashboard screenshots, agent status) Captured monthly
Technical Sample alert/detection output demonstrating capability Captured quarterly
Technical SIEM dashboard showing log sources and collection status Captured monthly
Record Log review records and findings Per review cycle
Document Governing policy document (current, approved, communicated) Reviewed annually
13.2 Deploy a Host>Based Intrusion Detection Solution
Type Evidence Item Frequency
Technical Detection tool deployment evidence (dashboard screenshots, agent status) Captured monthly
Technical Sample alert/detection output demonstrating capability Captured quarterly
Document Governing policy document (current, approved, communicated) Reviewed annually
13.3 Deploy a Network Intrusion Detection Solution
Type Evidence Item Frequency
Technical Detection tool deployment evidence (dashboard screenshots, agent status) Captured monthly
Technical Sample alert/detection output demonstrating capability Captured quarterly
Record Third-party risk assessment reports and scorecards Annually per vendor
Document Vendor contracts with security requirements Per contract cycle
Document Governing policy document (current, approved, communicated) Reviewed annually
13.4 Perform Traffic Filtering Between Network Segments
Type Evidence Item Frequency
Technical Configuration screenshots or exports showing protection controls enabled Captured quarterly
Document Procedure documentation for protection measures Reviewed annually
Document Governing policy document (current, approved, communicated) Reviewed annually
13.5 Manage Access Control for Remote Assets
Type Evidence Item Frequency
Technical Configuration screenshots or exports showing protection controls enabled Captured quarterly
Document Procedure documentation for protection measures Reviewed annually
Technical Configuration compliance scan results against approved baseline Scanned monthly
Document Approved baseline configuration documentation Reviewed quarterly
Record Access review/recertification records with sign-off Quarterly
Technical Access control configuration evidence (RBAC settings, group memberships) Reviewed quarterly
Technical Anti-malware deployment status and detection statistics Monthly
Document Governing policy document (current, approved, communicated) Reviewed annually
13.6 Collect Network Traffic Flow Logs
Type Evidence Item Frequency
Technical Detection tool deployment evidence (dashboard screenshots, agent status) Captured monthly
Technical Sample alert/detection output demonstrating capability Captured quarterly
Technical SIEM dashboard showing log sources and collection status Captured monthly
Record Log review records and findings Per review cycle
Document Governing policy document (current, approved, communicated) Reviewed annually
13.7 Deploy a Host>Based Intrusion Prevention Solution
Type Evidence Item Frequency
Technical Configuration screenshots or exports showing protection controls enabled Captured quarterly
Document Procedure documentation for protection measures Reviewed annually
Document Incident response plan and playbooks Reviewed bi-annually
Record Incident reports and post-incident review documentation Per incident
Document Governing policy document (current, approved, communicated) Reviewed annually
13.8 Deploy a Network Intrusion Prevention Solution
Type Evidence Item Frequency
Technical Configuration screenshots or exports showing protection controls enabled Captured quarterly
Document Procedure documentation for protection measures Reviewed annually
Document Governing policy document (current, approved, communicated) Reviewed annually
13.9 Deploy Port>Level Access Control
Type Evidence Item Frequency
Technical Configuration screenshots or exports showing protection controls enabled Captured quarterly
Document Procedure documentation for protection measures Reviewed annually
Record Access review/recertification records with sign-off Quarterly
Technical Access control configuration evidence (RBAC settings, group memberships) Reviewed quarterly
Document Governing policy document (current, approved, communicated) Reviewed annually
13.10 Perform Application Layer Filtering
Type Evidence Item Frequency
Technical Configuration screenshots or exports showing protection controls enabled Captured quarterly
Document Procedure documentation for protection measures Reviewed annually
Technical Firewall rule set export and review documentation Reviewed quarterly
Record Firewall change request and approval records Per change
Document Governing policy document (current, approved, communicated) Reviewed annually
13.11 Tune Security Event Alerting Thresholds
Type Evidence Item Frequency
Technical Detection tool deployment evidence (dashboard screenshots, agent status) Captured monthly
Technical Sample alert/detection output demonstrating capability Captured quarterly
Document Governing policy document (current, approved, communicated) Reviewed annually

14 Security Awareness and Skills Training

Required Policies

Security Awareness and Training Policy
14.1 Establish and Maintain a Security Awareness Program
Type Evidence Item Frequency
Technical Configuration screenshots or exports showing protection controls enabled Captured quarterly
Document Procedure documentation for protection measures Reviewed annually
Record Training completion records and compliance rates Tracked continuously, reported quarterly
Document Training content and curriculum documentation Reviewed annually
Document Governing policy document (current, approved, communicated) Reviewed annually
14.2 Train Workforce Members to Recognize Social Engineering Attacks
Type Evidence Item Frequency
Technical Configuration screenshots or exports showing protection controls enabled Captured quarterly
Document Procedure documentation for protection measures Reviewed annually
Record Training completion records and compliance rates Tracked continuously, reported quarterly
Document Training content and curriculum documentation Reviewed annually
Document Governing policy document (current, approved, communicated) Reviewed annually
14.3 Train Workforce Members on Authentication Best Practices
Type Evidence Item Frequency
Technical Configuration screenshots or exports showing protection controls enabled Captured quarterly
Document Procedure documentation for protection measures Reviewed annually
Record Training completion records and compliance rates Tracked continuously, reported quarterly
Document Training content and curriculum documentation Reviewed annually
Technical MFA enrollment status and enforcement configuration Reviewed monthly
Document Governing policy document (current, approved, communicated) Reviewed annually
14.4 Train Workforce on Data Handling Best Practices
Type Evidence Item Frequency
Technical Configuration screenshots or exports showing protection controls enabled Captured quarterly
Document Procedure documentation for protection measures Reviewed annually
Record Training completion records and compliance rates Tracked continuously, reported quarterly
Document Training content and curriculum documentation Reviewed annually
Document Governing policy document (current, approved, communicated) Reviewed annually
14.5 Train Workforce Members on Causes of Unintentional Data Exposure
Type Evidence Item Frequency
Technical Configuration screenshots or exports showing protection controls enabled Captured quarterly
Document Procedure documentation for protection measures Reviewed annually
Record Training completion records and compliance rates Tracked continuously, reported quarterly
Document Training content and curriculum documentation Reviewed annually
Document Governing policy document (current, approved, communicated) Reviewed annually
14.6 Train Workforce Members on Recognizing and Reporting Security Incidents
Type Evidence Item Frequency
Technical Configuration screenshots or exports showing protection controls enabled Captured quarterly
Document Procedure documentation for protection measures Reviewed annually
Record Training completion records and compliance rates Tracked continuously, reported quarterly
Document Training content and curriculum documentation Reviewed annually
Document Incident response plan and playbooks Reviewed bi-annually
Record Incident reports and post-incident review documentation Per incident
Document Governing policy document (current, approved, communicated) Reviewed annually
14.7 Train Workforce on How to Identify and Report if Their Enterprise Assets are Missing Security Updates
Type Evidence Item Frequency
Technical Configuration screenshots or exports showing protection controls enabled Captured quarterly
Document Procedure documentation for protection measures Reviewed annually
Record Training completion records and compliance rates Tracked continuously, reported quarterly
Document Training content and curriculum documentation Reviewed annually
Document Governing policy document (current, approved, communicated) Reviewed annually
14.8 Train Workforce on the Dangers of Connecting to and Transmitting Enterprise Data Over Insecure Networks
Type Evidence Item Frequency
Technical Configuration screenshots or exports showing protection controls enabled Captured quarterly
Document Procedure documentation for protection measures Reviewed annually
Record Training completion records and compliance rates Tracked continuously, reported quarterly
Document Training content and curriculum documentation Reviewed annually
Document Governing policy document (current, approved, communicated) Reviewed annually
14.9 Conduct Role>Specific Security Awareness and Skills Training
Type Evidence Item Frequency
Technical Configuration screenshots or exports showing protection controls enabled Captured quarterly
Document Procedure documentation for protection measures Reviewed annually
Technical Vulnerability scan reports showing scope and findings Per scan cycle
Record Vulnerability remediation tracking with SLA compliance metrics Monthly
Record Training completion records and compliance rates Tracked continuously, reported quarterly
Document Training content and curriculum documentation Reviewed annually
Document Governing policy document (current, approved, communicated) Reviewed annually

15 Service Provider Management

Required Policies

Third-Party Risk Management Policy
15.1 Establish and Maintain an Inventory of Service Providers
Type Evidence Item Frequency
Document Current inventory or catalog documentation Maintained continuously, reviewed quarterly
Document Process/procedure documentation for identification activities Reviewed annually
Technical Asset/software inventory export with required fields populated Exported quarterly for review
Record Inventory review meeting minutes or sign-off Per review cycle
Record Third-party risk assessment reports and scorecards Annually per vendor
Document Vendor contracts with security requirements Per contract cycle
Document Governing policy document (current, approved, communicated) Reviewed annually
15.2 Establish and Maintain a Service Provider Management Policy
Type Evidence Item Frequency
Document Current inventory or catalog documentation Maintained continuously, reviewed quarterly
Document Process/procedure documentation for identification activities Reviewed annually
Technical Asset/software inventory export with required fields populated Exported quarterly for review
Record Inventory review meeting minutes or sign-off Per review cycle
Record Third-party risk assessment reports and scorecards Annually per vendor
Document Vendor contracts with security requirements Per contract cycle
Document Governing policy document (current, approved, communicated) Reviewed annually
15.3 Classify Service Providers
Type Evidence Item Frequency
Document Current inventory or catalog documentation Maintained continuously, reviewed quarterly
Document Process/procedure documentation for identification activities Reviewed annually
Record Third-party risk assessment reports and scorecards Annually per vendor
Document Vendor contracts with security requirements Per contract cycle
Document Governing policy document (current, approved, communicated) Reviewed annually
15.4 Ensure Service Provider Contracts Include Security Requirements
Type Evidence Item Frequency
Technical Configuration screenshots or exports showing protection controls enabled Captured quarterly
Document Procedure documentation for protection measures Reviewed annually
Technical Encryption configuration evidence (disk encryption status, TLS settings) Scanned monthly
Document Key management procedures and key rotation records Reviewed annually
Document Incident response plan and playbooks Reviewed bi-annually
Record Incident reports and post-incident review documentation Per incident
Record Third-party risk assessment reports and scorecards Annually per vendor
Document Vendor contracts with security requirements Per contract cycle
Document Governing policy document (current, approved, communicated) Reviewed annually
15.5 Assess Service Providers
Type Evidence Item Frequency
Document Current inventory or catalog documentation Maintained continuously, reviewed quarterly
Document Process/procedure documentation for identification activities Reviewed annually
Record Third-party risk assessment reports and scorecards Annually per vendor
Document Vendor contracts with security requirements Per contract cycle
Document Governing policy document (current, approved, communicated) Reviewed annually
15.6 Monitor Service Providers
Type Evidence Item Frequency
Technical Detection tool deployment evidence (dashboard screenshots, agent status) Captured monthly
Technical Sample alert/detection output demonstrating capability Captured quarterly
Record Third-party risk assessment reports and scorecards Annually per vendor
Document Vendor contracts with security requirements Per contract cycle
Document Governing policy document (current, approved, communicated) Reviewed annually
15.7 Securely Decommission Service Providers
Type Evidence Item Frequency
Technical Configuration screenshots or exports showing protection controls enabled Captured quarterly
Document Procedure documentation for protection measures Reviewed annually
Record Third-party risk assessment reports and scorecards Annually per vendor
Document Vendor contracts with security requirements Per contract cycle
Document Governing policy document (current, approved, communicated) Reviewed annually

16 Application Software Security

Required Policies

Secure Software Development Lifecycle Policy Application Security Policy
16.1 Establish and Maintain a Secure Application Development Process
Type Evidence Item Frequency
Technical Configuration screenshots or exports showing protection controls enabled Captured quarterly
Document Procedure documentation for protection measures Reviewed annually
Technical Vulnerability scan reports showing scope and findings Per scan cycle
Record Vulnerability remediation tracking with SLA compliance metrics Monthly
Record Training completion records and compliance rates Tracked continuously, reported quarterly
Document Training content and curriculum documentation Reviewed annually
Record Third-party risk assessment reports and scorecards Annually per vendor
Document Vendor contracts with security requirements Per contract cycle
Document Governing policy document (current, approved, communicated) Reviewed annually
16.2 Establish and Maintain a Process to Accept and Address Software Vulnerabilities
Type Evidence Item Frequency
Technical Configuration screenshots or exports showing protection controls enabled Captured quarterly
Document Procedure documentation for protection measures Reviewed annually
Technical Vulnerability scan reports showing scope and findings Per scan cycle
Record Vulnerability remediation tracking with SLA compliance metrics Monthly
Record Third-party risk assessment reports and scorecards Annually per vendor
Document Vendor contracts with security requirements Per contract cycle
Document Governing policy document (current, approved, communicated) Reviewed annually
16.3 Perform Root Cause Analysis on Security Vulnerabilities
Type Evidence Item Frequency
Technical Configuration screenshots or exports showing protection controls enabled Captured quarterly
Document Procedure documentation for protection measures Reviewed annually
Technical Vulnerability scan reports showing scope and findings Per scan cycle
Record Vulnerability remediation tracking with SLA compliance metrics Monthly
Document Governing policy document (current, approved, communicated) Reviewed annually
16.4 Establish and Manage an Inventory of Third>Party Software Components
Type Evidence Item Frequency
Technical Configuration screenshots or exports showing protection controls enabled Captured quarterly
Document Procedure documentation for protection measures Reviewed annually
Technical Asset/software inventory export with required fields populated Exported quarterly for review
Record Inventory review meeting minutes or sign-off Per review cycle
Record Third-party risk assessment reports and scorecards Annually per vendor
Document Vendor contracts with security requirements Per contract cycle
Document Governing policy document (current, approved, communicated) Reviewed annually
16.5 Use Up>to>Date and Trusted Third>Party Software Components
Type Evidence Item Frequency
Technical Configuration screenshots or exports showing protection controls enabled Captured quarterly
Document Procedure documentation for protection measures Reviewed annually
Technical Vulnerability scan reports showing scope and findings Per scan cycle
Record Vulnerability remediation tracking with SLA compliance metrics Monthly
Record Third-party risk assessment reports and scorecards Annually per vendor
Document Vendor contracts with security requirements Per contract cycle
Document Governing policy document (current, approved, communicated) Reviewed annually
16.6 Establish and Maintain a Severity Rating System and Process for Application Vulnerabilities
Type Evidence Item Frequency
Technical Configuration screenshots or exports showing protection controls enabled Captured quarterly
Document Procedure documentation for protection measures Reviewed annually
Technical Vulnerability scan reports showing scope and findings Per scan cycle
Record Vulnerability remediation tracking with SLA compliance metrics Monthly
Document Governing policy document (current, approved, communicated) Reviewed annually
16.7 Use Standard Hardening Configuration Templates for Application Infrastructure
Type Evidence Item Frequency
Technical Configuration screenshots or exports showing protection controls enabled Captured quarterly
Document Procedure documentation for protection measures Reviewed annually
Technical Configuration compliance scan results against approved baseline Scanned monthly
Document Approved baseline configuration documentation Reviewed quarterly
Document Governing policy document (current, approved, communicated) Reviewed annually
16.8 Separate Production and Non>Production Systems
Type Evidence Item Frequency
Technical Configuration screenshots or exports showing protection controls enabled Captured quarterly
Document Procedure documentation for protection measures Reviewed annually
Document Governing policy document (current, approved, communicated) Reviewed annually
16.9 Train Developers in Application Security Concepts and Secure Coding
Type Evidence Item Frequency
Technical Configuration screenshots or exports showing protection controls enabled Captured quarterly
Document Procedure documentation for protection measures Reviewed annually
Record Training completion records and compliance rates Tracked continuously, reported quarterly
Document Training content and curriculum documentation Reviewed annually
Document Governing policy document (current, approved, communicated) Reviewed annually
16.10 Apply Secure Design Principles in Application Architectures
Type Evidence Item Frequency
Technical Configuration screenshots or exports showing protection controls enabled Captured quarterly
Document Procedure documentation for protection measures Reviewed annually
Document Governing policy document (current, approved, communicated) Reviewed annually
16.11 Leverage Vetted Modules or Services for Application Security Components
Type Evidence Item Frequency
Technical Configuration screenshots or exports showing protection controls enabled Captured quarterly
Document Procedure documentation for protection measures Reviewed annually
Technical Encryption configuration evidence (disk encryption status, TLS settings) Scanned monthly
Document Key management procedures and key rotation records Reviewed annually
Technical SIEM dashboard showing log sources and collection status Captured monthly
Record Log review records and findings Per review cycle
Document Governing policy document (current, approved, communicated) Reviewed annually
16.12 Implement Code>Level Security Checks
Type Evidence Item Frequency
Technical Configuration screenshots or exports showing protection controls enabled Captured quarterly
Document Procedure documentation for protection measures Reviewed annually
Document Governing policy document (current, approved, communicated) Reviewed annually
16.13 Conduct Application Penetration Testing
Type Evidence Item Frequency
Technical Configuration screenshots or exports showing protection controls enabled Captured quarterly
Document Procedure documentation for protection measures Reviewed annually
Technical SIEM dashboard showing log sources and collection status Captured monthly
Record Log review records and findings Per review cycle
Technical Vulnerability scan reports showing scope and findings Per scan cycle
Record Vulnerability remediation tracking with SLA compliance metrics Monthly
Record Penetration test report and executive summary Per engagement
Record Remediation tracking and retest validation results Post-engagement
Document Governing policy document (current, approved, communicated) Reviewed annually
16.14 Conduct Threat Modeling
Type Evidence Item Frequency
Technical Configuration screenshots or exports showing protection controls enabled Captured quarterly
Document Procedure documentation for protection measures Reviewed annually
Record Training completion records and compliance rates Tracked continuously, reported quarterly
Document Training content and curriculum documentation Reviewed annually
Document Governing policy document (current, approved, communicated) Reviewed annually

17 Incident Response Management

Required Policies

Incident Response Policy Incident Communication Policy
17.1 Designate Personnel to Manage Incident Handling
Type Evidence Item Frequency
Document Response procedure/playbook documentation Reviewed bi-annually
Record Response action logs showing procedure execution Per incident
Technical Backup job status reports and success rates Reviewed weekly
Record Backup restoration test results Tested quarterly
Document Incident response plan and playbooks Reviewed bi-annually
Record Incident reports and post-incident review documentation Per incident
Record Third-party risk assessment reports and scorecards Annually per vendor
Document Vendor contracts with security requirements Per contract cycle
Document Governing policy document (current, approved, communicated) Reviewed annually
17.2 Establish and Maintain Contact Information for Reporting Security Incidents
Type Evidence Item Frequency
Document Response procedure/playbook documentation Reviewed bi-annually
Record Response action logs showing procedure execution Per incident
Document Incident response plan and playbooks Reviewed bi-annually
Record Incident reports and post-incident review documentation Per incident
Record Third-party risk assessment reports and scorecards Annually per vendor
Document Vendor contracts with security requirements Per contract cycle
Document Governing policy document (current, approved, communicated) Reviewed annually
17.3 Establish and Maintain an Enterprise Process for Reporting Incidents
Type Evidence Item Frequency
Document Response procedure/playbook documentation Reviewed bi-annually
Record Response action logs showing procedure execution Per incident
Document Incident response plan and playbooks Reviewed bi-annually
Record Incident reports and post-incident review documentation Per incident
Document Governing policy document (current, approved, communicated) Reviewed annually
17.4 Establish and Maintain an Incident Response Process
Type Evidence Item Frequency
Document Response procedure/playbook documentation Reviewed bi-annually
Record Response action logs showing procedure execution Per incident
Document Incident response plan and playbooks Reviewed bi-annually
Record Incident reports and post-incident review documentation Per incident
Document Governing policy document (current, approved, communicated) Reviewed annually
17.5 Assign Key Roles and Responsibilities
Type Evidence Item Frequency
Document Response procedure/playbook documentation Reviewed bi-annually
Record Response action logs showing procedure execution Per incident
Document Incident response plan and playbooks Reviewed bi-annually
Record Incident reports and post-incident review documentation Per incident
Document Governing policy document (current, approved, communicated) Reviewed annually
17.6 Define Mechanisms for Communicating During Incident Response
Type Evidence Item Frequency
Document Response procedure/playbook documentation Reviewed bi-annually
Record Response action logs showing procedure execution Per incident
Document Incident response plan and playbooks Reviewed bi-annually
Record Incident reports and post-incident review documentation Per incident
Technical Email security configuration (SPF, DKIM, DMARC records) Verified quarterly
Document Governing policy document (current, approved, communicated) Reviewed annually
17.7 Conduct Routine Incident Response Exercises
Type Evidence Item Frequency
Document Recovery plan documentation Reviewed annually
Record Recovery test results and lessons learned Tested quarterly
Document Incident response plan and playbooks Reviewed bi-annually
Record Incident reports and post-incident review documentation Per incident
Document Governing policy document (current, approved, communicated) Reviewed annually
17.8 Conduct Post>Incident Reviews
Type Evidence Item Frequency
Document Recovery plan documentation Reviewed annually
Record Recovery test results and lessons learned Tested quarterly
Document Incident response plan and playbooks Reviewed bi-annually
Record Incident reports and post-incident review documentation Per incident
Document Governing policy document (current, approved, communicated) Reviewed annually
17.9 Establish and Maintain Security Incident Thresholds
Type Evidence Item Frequency
Document Recovery plan documentation Reviewed annually
Record Recovery test results and lessons learned Tested quarterly
Technical Vulnerability scan reports showing scope and findings Per scan cycle
Record Vulnerability remediation tracking with SLA compliance metrics Monthly
Document Incident response plan and playbooks Reviewed bi-annually
Record Incident reports and post-incident review documentation Per incident
Document Governing policy document (current, approved, communicated) Reviewed annually

18 Penetration Testing

Required Policies

Penetration Testing Policy
18.1 Establish and Maintain a Penetration Testing Program
Type Evidence Item Frequency
Document Current inventory or catalog documentation Maintained continuously, reviewed quarterly
Document Process/procedure documentation for identification activities Reviewed annually
Record Penetration test report and executive summary Per engagement
Record Remediation tracking and retest validation results Post-engagement
Document Governing policy document (current, approved, communicated) Reviewed annually
18.2 Perform Periodic External Penetration Tests
Type Evidence Item Frequency
Document Current inventory or catalog documentation Maintained continuously, reviewed quarterly
Document Process/procedure documentation for identification activities Reviewed annually
Record Penetration test report and executive summary Per engagement
Record Remediation tracking and retest validation results Post-engagement
Document Governing policy document (current, approved, communicated) Reviewed annually
18.3 Remediate Penetration Test Findings
Type Evidence Item Frequency
Technical Configuration screenshots or exports showing protection controls enabled Captured quarterly
Document Procedure documentation for protection measures Reviewed annually
Record Penetration test report and executive summary Per engagement
Record Remediation tracking and retest validation results Post-engagement
Document Governing policy document (current, approved, communicated) Reviewed annually
18.4 Validate Security Measures
Type Evidence Item Frequency
Technical Configuration screenshots or exports showing protection controls enabled Captured quarterly
Document Procedure documentation for protection measures Reviewed annually
Record Penetration test report and executive summary Per engagement
Record Remediation tracking and retest validation results Post-engagement
Document Governing policy document (current, approved, communicated) Reviewed annually
18.5 Perform Periodic Internal Penetration Tests
Type Evidence Item Frequency
Document Current inventory or catalog documentation Maintained continuously, reviewed quarterly
Document Process/procedure documentation for identification activities Reviewed annually
Record Penetration test report and executive summary Per engagement
Record Remediation tracking and retest validation results Post-engagement
Document Governing policy document (current, approved, communicated) Reviewed annually