GOV-06: Contacts With Authorities
Mechanisms exist to identify and document appropriate contacts with relevant law enforcement and regulatory bodies.
Control Question: Does the organization identify and document appropriate contacts with relevant law enforcement and regulatory bodies?
General (24)
| Framework | Mapping Values |
|---|---|
| AICPA TSC 2017:2022 (used for SOC 2) (source) | CC2.2-POF4 CC2.3 CC3.1-POF10 |
| COSO 2017 | Principle 15 |
| GovRAMP Core | IR-06 |
| GovRAMP Low | IR-06 |
| GovRAMP Low+ | IR-06 |
| GovRAMP Moderate | IR-06 |
| GovRAMP High | IR-06 |
| ISO 27002 2022 | 5.5 |
| ISO 27017 2015 | 6.1.3 |
| NIST AI 600-1 | GV-2.1-004 |
| NIST 800-53 R4 | IR-6 |
| NIST 800-53 R4 (low) | IR-6 |
| NIST 800-53 R4 (moderate) | IR-6 |
| NIST 800-53 R4 (high) | IR-6 |
| NIST 800-53 R5 (source) | IR-6 |
| NIST 800-53B R5 (privacy) (source) | IR-6 |
| NIST 800-53B R5 (low) (source) | IR-6 |
| NIST 800-53B R5 (moderate) (source) | IR-6 |
| NIST 800-53B R5 (high) (source) | IR-6 |
| NIST 800-82 R3 LOW OT Overlay | IR-6 |
| NIST 800-82 R3 MODERATE OT Overlay | IR-6 |
| NIST 800-82 R3 HIGH OT Overlay | IR-6 |
| NIST 800-161 R1 | IR-6 |
| SCF CORE Mergers, Acquisitions & Divestitures (MA&D) | GOV-06 |
US (25)
| Framework | Mapping Values |
|---|---|
| US CERT RMM 1.2 | IMC:SG2.SP1 |
| US CISA CPG 2022 | 4.A |
| US CJIS Security Policy 5.9.3 (source) | IR-6 |
| US CMS MARS-E 2.0 | IR-6 |
| US DFARS Cybersecurity 252.204-70xx | 252.204-7019(c)(1) 252.204-7019(c)(2) |
| US FedRAMP R4 | IR-6 |
| US FedRAMP R4 (low) | IR-6 |
| US FedRAMP R4 (moderate) | IR-6 |
| US FedRAMP R4 (high) | IR-6 |
| US FedRAMP R4 (LI-SaaS) | IR-6 |
| US FedRAMP R5 (source) | IR-6 |
| US FedRAMP R5 (low) (source) | IR-6 |
| US FedRAMP R5 (moderate) (source) | IR-6 |
| US FedRAMP R5 (high) (source) | IR-6 |
| US FedRAMP R5 (LI-SaaS) (source) | IR-6 |
| US HIPAA HICP Medium Practice | 8.M.A 8.M.C |
| US HIPAA HICP Large Practice | 8.M.A 8.M.C 7.L.A 8.L.B |
| US IRS 1075 | 1.8.3 IR-6 |
| US NISPOM 2020 | 1-303 4-218 |
| US SEC Cybersecurity Rule | Form 8-K Item 1.05(a) |
| US TSA / DHS 1580/82-2022-01 | III.F.3 VI.A VI.B VI.B.1 VI.B.2 VI.C VI.D VI.E.1 VI.E.2 VI.F |
| US - TX BC521 | 521.053 |
| US - TX DIR Control Standards 2.0 | IR-6 |
| US - TX TX-RAMP Level 1 | IR-6 |
| US - TX TX-RAMP Level 2 | IR-6 |
EMEA (5)
| Framework | Mapping Values |
|---|---|
| EMEA EU EBA GL/2019/04 | 3.7.5(91) |
| EMEA EU DORA | 31.4 |
| EMEA Germany C5 2020 | OIS-05 |
| EMEA Spain BOE-A-2022-7191 | 32.1 32.2 32.3 |
| EMEA Spain 311/2022 | 32.1 32.2 32.3 |
APAC (3)
| Framework | Mapping Values |
|---|---|
| APAC Australia Prudential Standard CPS230 | 33 42 51 59(a) 59(b) |
| APAC Australia Prudential Standard CPS234 | 35 35(a) 35(b) 36 |
| APAC Japan ISMAP | 6.1.3 |
Capability Maturity Model
Level 0 — Not Performed
There is no evidence of a capability to identify and document appropriate contacts with relevant law enforcement and regulatory bodies.
Level 1 — Performed Informally
Cybersecurity & Privacy Governance (GOV) efforts are ad hoc and inconsistent. CMM Level 1 control maturity would reasonably expect all, or at least most, the following criteria to exist:
- No formal cybersecurity and/ or data privacy principles are identified for the organization.
- No formal Governance, Risk & Compliance (GRC) team exists. GRC roles are assigned to existing IT/cybersecurity personnel.
- Governance efforts are narrowly-limited to certain compliance requirements.
- Formal roles and responsibilities for cybersecurity and/ or data privacy may exist.
- Cybersecurity and data privacy governance is informally assigned as an additional duty to existing IT/cybersecurity personnel.
- Basic cybersecurity policies and standards are documented [not based on any industry framework]
- Basic procedures are established for important tasks, but are ad hoc and not formally documented.
- Documentation is made available to internal personnel.
- Organizational leadership maintains an informal process to review and respond to observed trends.
- Cybersecurity personnel identify and maintain contact information for local and national law enforcement (e.g., FBI field office) in case of cybersecurity incidents that require law enforcement involvement.
Level 2 — Planned & Tracked
Cybersecurity & Privacy Governance (GOV) efforts are requirements-driven and governed at a local/regional level, but are not consistent across the organization. CMM Level 2 control maturity would reasonably expect all, or at least most, the following criteria to exist:
- Cybersecurity and data privacy governance activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.
- IT/cybersecurity personnel identify cybersecurity and data protection controls that are appropriate to address applicable statutory, regulatory and contractual requirements for cybersecurity and data privacy governance activities.
- The Chief Information Officer (CIO), or similar function, analyzes the organization's business strategy and prioritizes the objectives of the security function, based on business requirements.
- A qualified individual is assigned the role and responsibilities to centrally manage, coordinate, develop, implement and maintain a cybersecurity and data privacy program (e.g., cybersecurity director or Chief Information Security Officer (CISO)).
- No formal Governance, Risk & Compliance (GRC) team exists. GRC roles are assigned to existing cybersecurity personnel.
- Compliance requirements for cybersecurity and data privacy are identified and documented.
- Cybersecurity policies and standards exist that are aligned with a leading cybersecurity framework (e.g., SCF, NIST 800-53, ISO 27002 or NIST Cybersecurity Framework).
- Controls are assigned to sensitive/regulated assets to comply with specific compliance requirements.
- Procedures are established for sensitive/regulated obligations, but are not standardized across the organization.
- Documentation is made available to internal personnel.
- Incident response personnel identify and maintain contact information for local and national law enforcement (e.g., FBI field office) in case of cybersecurity incidents that require law enforcement involvement.
- Contact information is verified and updated on at least an annual basis.
Level 3 — Well Defined
Cybersecurity & Privacy Governance (GOV) efforts are standardized across the organization and centrally managed, where technically feasible, to ensure consistency. CMM Level 3 control maturity would reasonably expect all, or at least most, the following criteria to exist:
- Statutory, regulatory and contractual compliance requirements for cybersecurity and data privacy are identified and documented. Recurring testing is utilized to assess adherence to internal standards and/or external compliance requirements.
- A Governance, Risk & Compliance (GRC) function, or similar function, provides scoping guidance to determine control applicability.
- Internal policies and standards address all statutory, regulatory and contractual obligations for cybersecurity and data privacy.
- Controls are standardized across the organization to ensure uniformity and consistent execution.
- Corporate governance (executive oversight) exists for the cybersecurity and data privacy, which includes regular briefings to ensure executives have sufficient situational awareness to properly govern the organization.
- Procedures are established for sensitive/regulated compliance obligations that are standardized across the organization.
- Defined roles & responsibilities require data/process owners to define, implement and maintain cybersecurity and data protection controls for each system, application and/ or service of which they have accountability.
- The organization designates one or more qualified individuals to govern the cybersecurity and data privacy programs (e.g., Chief Information Security Officer or Chief Privacy Officer).
- Risk management processes are defined, to include materiality considerations.
Level 4 — Quantitatively Controlled
Cybersecurity & Privacy Governance (GOV) efforts are metrics driven and provide sufficient management insight (based on a quantitative understanding of process capabilities) to predict optimal performance, ensure continued operations and identify areas for improvement. In addition to CMM Level 3 criteria, CMM Level 4 control maturity would reasonably expect all, or at least most, the following criteria to exist:
- Metrics are developed that provide management insight, per a quantitative understanding of process capabilities, to predict optimal performance, ensure continued operations and identify areas for improvement.
- Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).
- Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).
- Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.
- Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).
- Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.
- Both business and technical stakeholders are involved in reviewing and approving proposed changes.
Level 5 — Continuously Improving
Cybersecurity & Privacy Governance (GOV) efforts are “world-class” capabilities that leverage predictive analysis (e.g., machine learning, AI, etc.). In addition to CMM Level 4 criteria, CMM Level 5 control maturity would reasonably expect all, or at least most, the following criteria to exist:
- Stakeholders make time-sensitive decisions to support operational efficiency, which may include automated remediation actions.
- Based on predictive analysis, process improvements are implemented according to “continuous improvement” practices that affect process changes.
Assessment Objectives
- GOV-06_A01 relevant law enforcement and/or regulatory bodies are identified that necessitate communications.
- GOV-06_A02 contacts with relevant law enforcement and/or regulatory bodies are established and documented.
Technology Recommendations
Medium
- Integrated Security Incident Response Team (ISIRT)
Large
- Integrated Security Incident Response Team (ISIRT)
Enterprise
- Integrated Security Incident Response Team (ISIRT)