forked from intuitem/ciso-assistant-community
-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathenisa-5g-scm-v1.3.yaml
9190 lines (8986 loc) · 519 KB
/
enisa-5g-scm-v1.3.yaml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
urn: urn:intuitem:risk:library:enisa-5g-scm-v1.3
locale: en
ref_id: ENISA 5G SCM v1.3
name: ENISA 5G Security Control Matrix v1.3
description: "The main goal of the ENISA 5G security controls matrix is to support\
\ the national authorities in the EU Member States with implementing the technical\
\ measures of the EU\u2019s 5G Cybersecurity toolbox.\nSource: https://www.enisa.europa.eu/publications/5g-security-controls-matrix\n"
copyright: "The Matrix is provided on an \u2018as is\u2019 basis. ENISA is not responsible\
\ for the information contained in the Matrix, including the use that might be made\
\ of this information, or the content of any external sources referenced in the\
\ Matrix.\n"
version: 2
provider: ENISA
packager: intuitem
objects:
reference_controls:
- urn: urn:intuitem:risk:reference_control:enisa-5g-scm:5g-m1
ref_id: 5G-M1
category: process
description: '(L1) Set a high level security policy addressing the security of
networks and services '
- urn: urn:intuitem:risk:reference_control:enisa-5g-scm:5g-m2
ref_id: 5G-M2
category: process
description: (L1) Make key personnel aware of the security policy
- urn: urn:intuitem:risk:reference_control:enisa-5g-scm:5g-m3
ref_id: 5G-M3
category: process
description: (L2) Set detailed information security policies for critical assets
and business processes
- urn: urn:intuitem:risk:reference_control:enisa-5g-scm:5g-m4
ref_id: 5G-M4
category: process
description: (L2) Make all personnel aware of the security policy and what it
implies for their work
- urn: urn:intuitem:risk:reference_control:enisa-5g-scm:5g-m5
ref_id: 5G-M5
category: process
description: (L2) Review the security policy following incidents
- urn: urn:intuitem:risk:reference_control:enisa-5g-scm:5g-m6
ref_id: 5G-M6
category: process
description: (L3) Review the information security policies periodically, and take
into account violations, exceptions, past incidents, past tests/exercises, and
incidents affecting other (similar) providers in the sector
- urn: urn:intuitem:risk:reference_control:enisa-5g-scm:5g-m7
ref_id: 5G-M7
category: process
description: (L1) Make a list of the main risks for security of networks and services,
taking into account main threats for the critical assets
- urn: urn:intuitem:risk:reference_control:enisa-5g-scm:5g-m8
ref_id: 5G-M8
category: process
description: (L1) Make key personnel aware of the main risks and how they are
mitigated
- urn: urn:intuitem:risk:reference_control:enisa-5g-scm:5g-m9
ref_id: 5G-M9
category: process
description: (L2) Set up a risk management methodology and/or tools based on industry
standards
- urn: urn:intuitem:risk:reference_control:enisa-5g-scm:5g-m10
ref_id: 5G-M10
category: process
description: (L2) Ensure that key personnel use the risk management methodology
and tools
- urn: urn:intuitem:risk:reference_control:enisa-5g-scm:5g-m11
ref_id: 5G-M11
category: process
description: (L2) Review the risk assessments following changes or incidents
- urn: urn:intuitem:risk:reference_control:enisa-5g-scm:5g-m12
ref_id: 5G-M12
category: process
description: (L2) Ensure residual risks are accepted by management
- urn: urn:intuitem:risk:reference_control:enisa-5g-scm:5g-m13
ref_id: 5G-M13
category: process
description: (L3) Review the risk management methodology and/or tools, periodically,
taking into account changes and past incidents
- urn: urn:intuitem:risk:reference_control:enisa-5g-scm:5g-m14
ref_id: 5G-M14
category: process
description: (L1) Assign security roles and responsibilities to personnel
- urn: urn:intuitem:risk:reference_control:enisa-5g-scm:5g-m15
ref_id: 5G-M15
category: process
description: (L1) Make sure the security roles are reachable in case of security
incidents
- urn: urn:intuitem:risk:reference_control:enisa-5g-scm:5g-m16
ref_id: 5G-M16
category: process
description: (L2) Personnel is formally appointed in security roles
- urn: urn:intuitem:risk:reference_control:enisa-5g-scm:5g-m17
ref_id: 5G-M17
category: process
description: (L2) Make personnel aware of the security roles in your organisation
and when they should be contacted
- urn: urn:intuitem:risk:reference_control:enisa-5g-scm:5g-m18
ref_id: 5G-M18
category: process
description: (L3) Structure of security roles and responsibilities is regularly
reviewed and revised, based on changes and/or past incidents
- urn: urn:intuitem:risk:reference_control:enisa-5g-scm:5g-m19
ref_id: 5G-M19
category: process
description: (L1) Include security requirements in contracts with third-parties,
including confidentiality and secure transfer of information
- urn: urn:intuitem:risk:reference_control:enisa-5g-scm:5g-m20
ref_id: 5G-M20
category: process
description: (L2) Set a security policy for contracts with third-parties
- urn: urn:intuitem:risk:reference_control:enisa-5g-scm:5g-m21
ref_id: 5G-M21
category: process
description: (L2) Ensure that all procurement of services/products from third-parties
follows the policy
- urn: urn:intuitem:risk:reference_control:enisa-5g-scm:5g-m22
ref_id: 5G-M22
category: process
description: (L2) Review security policy for third parties, following incidents
or changes
- urn: urn:intuitem:risk:reference_control:enisa-5g-scm:5g-m23
ref_id: 5G-M23
category: process
description: "(L2) Demand specific security standards in third-party supplier\u2019\
s processes during procurement"
- urn: urn:intuitem:risk:reference_control:enisa-5g-scm:5g-m24
ref_id: 5G-M24
category: process
description: (L2) Mitigate residual risks that are not addressed by the third
party
- urn: urn:intuitem:risk:reference_control:enisa-5g-scm:5g-m25
ref_id: 5G-M25
category: process
description: (L3) Keep track of security incidents related to or caused by third-parties
- urn: urn:intuitem:risk:reference_control:enisa-5g-scm:5g-m26
ref_id: 5G-M26
category: process
description: (L3) Periodically review and update security policy for third parties
at regular intervals, taking into account past incidents, changes, etc.
- urn: urn:intuitem:risk:reference_control:enisa-5g-scm:5g-m27
ref_id: 5G-M27
category: process
description: '(L1) Check professional references of key personnel (system administrators,
security officers, guards, etc.) '
- urn: urn:intuitem:risk:reference_control:enisa-5g-scm:5g-m28
ref_id: 5G-M28
category: process
description: (L2) Perform background checks/screening for key personnel, when
needed and legally permitted
- urn: urn:intuitem:risk:reference_control:enisa-5g-scm:5g-m29
ref_id: 5G-M29
category: process
description: (L2) Set up a policy and procedure for background checks
- urn: urn:intuitem:risk:reference_control:enisa-5g-scm:5g-m30
ref_id: 5G-M30
category: process
description: (L3) Review and update policy/procedures for background checks and
reference checks at regular intervals, taking into account changes and past
incidents
- urn: urn:intuitem:risk:reference_control:enisa-5g-scm:5g-m31
ref_id: 5G-M31
category: process
description: (L1) Provide key personnel with relevant training and material on
security issues
- urn: urn:intuitem:risk:reference_control:enisa-5g-scm:5g-m32
ref_id: 5G-M32
category: process
description: (L2) Implement a program for training, making sure that key personnel
have sufficient and up-to-date security knowledge
- urn: urn:intuitem:risk:reference_control:enisa-5g-scm:5g-m33
ref_id: 5G-M33
category: process
description: (L2) Organise trainings and awareness sessions for personnel on security
topics important for your organisation
- urn: urn:intuitem:risk:reference_control:enisa-5g-scm:5g-m34
ref_id: 5G-M34
category: process
description: (L3) Review and update the training program periodically, taking
into account changes and past incidents
- urn: urn:intuitem:risk:reference_control:enisa-5g-scm:5g-m35
ref_id: 5G-M35
category: process
description: (L3) Test the security knowledge of personnel
- urn: urn:intuitem:risk:reference_control:enisa-5g-scm:5g-m36
ref_id: 5G-M36
category: process
description: (L1) Following changes in personnel revoke access rights, badges,
equipment, etc., if no longer necessary or permitted
- urn: urn:intuitem:risk:reference_control:enisa-5g-scm:5g-m37
ref_id: 5G-M37
category: process
description: (L1) Brief and educate new personnel on the policies and procedures
in place
- urn: urn:intuitem:risk:reference_control:enisa-5g-scm:5g-m38
ref_id: 5G-M38
category: process
description: (L2) Implement policy/procedures for personnel changes, taking into
account timely revocation of access rights, badges and equipment
- urn: urn:intuitem:risk:reference_control:enisa-5g-scm:5g-m39
ref_id: 5G-M39
category: process
description: (L2) Implement policy/procedures for education and training for personnel
in new roles
- urn: urn:intuitem:risk:reference_control:enisa-5g-scm:5g-m40
ref_id: 5G-M40
category: process
description: (L3) Periodically check that the policy/procedures are effective
- urn: urn:intuitem:risk:reference_control:enisa-5g-scm:5g-m41
ref_id: 5G-M41
category: process
description: (L3) Review and evaluate policy/procedures for personnel changes,
taking into account changes or past incidents
- urn: urn:intuitem:risk:reference_control:enisa-5g-scm:5g-m42
ref_id: 5G-M42
category: process
description: (L1) Hold personnel accountable for security incidents caused by
violations of policies, for example via the employment contract
- urn: urn:intuitem:risk:reference_control:enisa-5g-scm:5g-m43
ref_id: 5G-M43
category: process
description: (L2) Set up procedures for violations of policies by personnel
- urn: urn:intuitem:risk:reference_control:enisa-5g-scm:5g-m44
ref_id: 5G-M44
category: process
description: (L3) Periodically review and update the disciplinary process, based
on changes and past incidents
- urn: urn:intuitem:risk:reference_control:enisa-5g-scm:5g-m45
ref_id: 5G-M45
category: process
description: "(L1) Prevent unauthorized physical access to facilities and infrastructure\
\ and set up adequate environmental controls, to protect provider assets (including\
\ third party assets, where applicable) against unauthorized access, burglary,\
\ fire, flooding, etc. Security controls should be selected based on the risk\
\ assessment, which should also take in consideration current and forecasted\
\ environmental security risks \u2013 e.g. related to climate change"
- urn: urn:intuitem:risk:reference_control:enisa-5g-scm:5g-m46
ref_id: 5G-M46
category: process
description: (L2) Implement a policy for physical security measures and environmental
controls
- urn: urn:intuitem:risk:reference_control:enisa-5g-scm:5g-m47
ref_id: 5G-M47
category: process
description: (L2) Industry standard implementation of physical and environmental
controls
- urn: urn:intuitem:risk:reference_control:enisa-5g-scm:5g-m48
ref_id: 5G-M48
category: process
description: (L2) Apply reinforced controls for physical access to critical assets.
For example, physical access to such assets should only be granted to a limited
number of security-vetted, trained and qualified personnel. Access by third-parties,
contractors, and employees of suppliers/vendors, integrators, should be limited
and monitored
- urn: urn:intuitem:risk:reference_control:enisa-5g-scm:5g-m49
ref_id: 5G-M49
category: process
description: (L3) Evaluate the effectiveness of physical and environmental controls
periodically
- urn: urn:intuitem:risk:reference_control:enisa-5g-scm:5g-m50
ref_id: 5G-M50
category: process
description: (L3) Review and update the policy for physical security measures
and environmental controls taking into account changes and past incidents
- urn: urn:intuitem:risk:reference_control:enisa-5g-scm:5g-m51
ref_id: 5G-M51
category: process
description: (L1) Ensure security of critical supplies
- urn: urn:intuitem:risk:reference_control:enisa-5g-scm:5g-m52
ref_id: 5G-M52
category: process
description: (L2) Implement a policy for security of critical supplies
- urn: urn:intuitem:risk:reference_control:enisa-5g-scm:5g-m53
ref_id: 5G-M53
category: process
description: (L2) Implement industry standard security measures to protect critical
supplies and supporting facilities (e.g. passive cooling, automatic restart
after power interruption, battery backup power, diesel generators, backup fuel,
etc.)
- urn: urn:intuitem:risk:reference_control:enisa-5g-scm:5g-m54
ref_id: 5G-M54
category: process
description: (L3) Implement state of the art security measures to protect critical
supplies (such as active cooling, UP, hot standby power generators, SLAs with
fuel delivery companies, redundant cooling and power backup systems)
- urn: urn:intuitem:risk:reference_control:enisa-5g-scm:5g-m55
ref_id: 5G-M55
category: process
description: (L3) Review and update policy and procedures to secure critical supplies
regularly, taking into account changes and past incidents
- urn: urn:intuitem:risk:reference_control:enisa-5g-scm:5g-m56
ref_id: 5G-M56
category: process
description: "(L1) Users and systems have unique ID\u2019s and are authenticated\
\ before accessing services or systems"
- urn: urn:intuitem:risk:reference_control:enisa-5g-scm:5g-m57
ref_id: 5G-M57
category: process
description: (L1) Implement logical access control mechanism for network and information
systems to allow only authorized use
- urn: urn:intuitem:risk:reference_control:enisa-5g-scm:5g-m58
ref_id: 5G-M58
category: process
description: (L2) Implement policy for protecting access to network and information
systems, addressing for example roles, rights, responsibilities and procedures
for assigning and revoking access rights
- urn: urn:intuitem:risk:reference_control:enisa-5g-scm:5g-m59
ref_id: 5G-M59
category: process
description: (L2) Choose appropriate authentication mechanisms, depending on the
type of access
- urn: urn:intuitem:risk:reference_control:enisa-5g-scm:5g-m60
ref_id: 5G-M60
category: process
description: (L2) Monitor access to network and information systems, have a process
for approving exceptions and registering access violations
- urn: urn:intuitem:risk:reference_control:enisa-5g-scm:5g-m61
ref_id: 5G-M61
category: process
description: (L2) Reinforce controls for remote access to critical assets of network
and information systems by third parties
- urn: urn:intuitem:risk:reference_control:enisa-5g-scm:5g-m62
ref_id: 5G-M62
category: process
description: (L3) Evaluate the effectiveness of access control policies and procedures
and implement cross checks on access control mechanisms
- urn: urn:intuitem:risk:reference_control:enisa-5g-scm:5g-m63
ref_id: 5G-M63
category: process
description: (L3) Access control policy and access control mechanisms are reviewed
and when needed revised
- urn: urn:intuitem:risk:reference_control:enisa-5g-scm:5g-m64
ref_id: 5G-M64
category: process
description: (L1) Make sure software of network and information systems is not
tampered with or altered, for instance by using input controls and firewalls
- urn: urn:intuitem:risk:reference_control:enisa-5g-scm:5g-m65
ref_id: 5G-M65
category: process
description: (L1) Check for malware on (internal) network and information systems
- urn: urn:intuitem:risk:reference_control:enisa-5g-scm:5g-m66
ref_id: 5G-M66
category: process
description: (L2) Implement industry standard security measures, providing defence-in-depth
against tampering and altering of systems
- urn: urn:intuitem:risk:reference_control:enisa-5g-scm:5g-m67
ref_id: 5G-M67
category: process
description: (L2) Apply reinforced software integrity, update and patch management
controls for critical assets in virtualised networks
- urn: urn:intuitem:risk:reference_control:enisa-5g-scm:5g-m68
ref_id: 5G-M68
category: process
description: (L3) Set up state of the art controls to protect integrity of systems
- urn: urn:intuitem:risk:reference_control:enisa-5g-scm:5g-m69
ref_id: 5G-M69
category: process
description: (L3) Evaluate and review the effectiveness of measures to protect
integrity of systems
- urn: urn:intuitem:risk:reference_control:enisa-5g-scm:5g-m70
ref_id: 5G-M70
category: process
description: (L1) Where appropriate to prevent and/or minimise the impact of security
incidents on users and on other networks and services, encrypt data during its
storage in and/or transmission via networks. The type and scope of data to be
encrypted should be determined based on the risk assessment performed and will
typically include communication data, customer critical data (e.g. unique identifiers),
relevant management and signalling traffic and any other data or metadata, the
disclosure or tampering of which may cause security incidents
- urn: urn:intuitem:risk:reference_control:enisa-5g-scm:5g-m71
ref_id: 5G-M71
category: process
description: (L2) Implement encryption policy
- urn: urn:intuitem:risk:reference_control:enisa-5g-scm:5g-m72
ref_id: 5G-M72
category: process
description: (L2) Use industry standard encryption algorithms and the corresponding
recommended lengths of encryption keys
- urn: urn:intuitem:risk:reference_control:enisa-5g-scm:5g-m73
ref_id: 5G-M73
category: process
description: (L3) Review and update encryption policy
- urn: urn:intuitem:risk:reference_control:enisa-5g-scm:5g-m74
ref_id: 5G-M74
category: process
description: (L3) Use state of the art encryption algorithms
- urn: urn:intuitem:risk:reference_control:enisa-5g-scm:5g-m75
ref_id: 5G-M75
category: process
description: (L1) Make sure that cryptographic key material and secret authentication
information (including cryptographic key material used for authentication) are
not disclosed or tampered with
- urn: urn:intuitem:risk:reference_control:enisa-5g-scm:5g-m76
ref_id: 5G-M76
category: process
description: (L2) Implement policy for management of cryptographic keys
- urn: urn:intuitem:risk:reference_control:enisa-5g-scm:5g-m77
ref_id: 5G-M77
category: process
description: (L2) Implement policy for management of user passwords
- urn: urn:intuitem:risk:reference_control:enisa-5g-scm:5g-m78
ref_id: 5G-M78
category: process
description: (L3) Review and update of key management policy
- urn: urn:intuitem:risk:reference_control:enisa-5g-scm:5g-m79
ref_id: 5G-M79
category: process
description: (L3) Review and update of user password management policy
- urn: urn:intuitem:risk:reference_control:enisa-5g-scm:5g-m80
ref_id: 5G-M80
category: process
description: (L1) Set up operational procedures and assign responsibilities for
operation of critical systems
- urn: urn:intuitem:risk:reference_control:enisa-5g-scm:5g-m81
ref_id: 5G-M81
category: process
description: (L2) Implement a policy for operation of systems to make sure all
critical systems are operated and managed in line with predefined procedures
- urn: urn:intuitem:risk:reference_control:enisa-5g-scm:5g-m82
ref_id: 5G-M82
category: process
description: (L3) Review and update the policy/procedures for operation of critical
systems, taking into account incidents and/or changes
- urn: urn:intuitem:risk:reference_control:enisa-5g-scm:5g-m83
ref_id: 5G-M83
category: process
description: (L1) Follow predefined methods or procedures when making changes
to critical systems
- urn: urn:intuitem:risk:reference_control:enisa-5g-scm:5g-m84
ref_id: 5G-M84
category: process
description: (L2) Implement policy/procedures for change management, to make sure
that changes of critical systems are always done following a predefined way
- urn: urn:intuitem:risk:reference_control:enisa-5g-scm:5g-m85
ref_id: 5G-M85
category: process
description: (L2) Document change management procedures, and record for each change
the steps of the followed procedure
- urn: urn:intuitem:risk:reference_control:enisa-5g-scm:5g-m86
ref_id: 5G-M86
category: process
description: (L3) Review and update change management procedures regularly, taking
into account changes and past incidents
- urn: urn:intuitem:risk:reference_control:enisa-5g-scm:5g-m87
ref_id: 5G-M87
category: process
description: (L1) Identify critical assets and configurations of critical systems
- urn: urn:intuitem:risk:reference_control:enisa-5g-scm:5g-m88
ref_id: 5G-M88
category: process
description: (L2) Implement policy/procedures for asset management and configuration
control
- urn: urn:intuitem:risk:reference_control:enisa-5g-scm:5g-m89
ref_id: 5G-M89
category: process
description: (L3) Review and update the asset management policy regularly, based
on changes and past incidents
- urn: urn:intuitem:risk:reference_control:enisa-5g-scm:5g-m90
ref_id: 5G-M90
category: process
description: (L1) Make sure personnel is available and prepared to manage and
handle incidents
- urn: urn:intuitem:risk:reference_control:enisa-5g-scm:5g-m91
ref_id: 5G-M91
category: process
description: (L1) Keep a record of all major incidents
- urn: urn:intuitem:risk:reference_control:enisa-5g-scm:5g-m92
ref_id: 5G-M92
category: process
description: (L2) Implement policy/procedures for managing incidents
- urn: urn:intuitem:risk:reference_control:enisa-5g-scm:5g-m93
ref_id: 5G-M93
category: process
description: (L3) Investigate major incidents and draft final incident reports,
including actions taken and recommendations to mitigate future occurrence of
this type of incident
- urn: urn:intuitem:risk:reference_control:enisa-5g-scm:5g-m94
ref_id: 5G-M94
category: process
description: (L3) Evaluate incident management policy/procedures based on past
incidents
- urn: urn:intuitem:risk:reference_control:enisa-5g-scm:5g-m95
ref_id: 5G-M95
category: process
description: (L1) Set up processes or systems for incident detection
- urn: urn:intuitem:risk:reference_control:enisa-5g-scm:5g-m96
ref_id: 5G-M96
category: process
description: (L2) Implement industry standard systems and procedures for incident
detection
- urn: urn:intuitem:risk:reference_control:enisa-5g-scm:5g-m97
ref_id: 5G-M97
category: process
description: (L2) Implement systems and procedures for registering and forwarding
incidents timely to the appropriate people
- urn: urn:intuitem:risk:reference_control:enisa-5g-scm:5g-m98
ref_id: 5G-M98
category: process
description: (L3) Review systems and processes for incident detection regularly
and update them taking into account changes and past incidents
- urn: urn:intuitem:risk:reference_control:enisa-5g-scm:5g-m99
ref_id: 5G-M99
category: process
description: (L3) Implement state of the art systems and procedures for incident
detection
- urn: urn:intuitem:risk:reference_control:enisa-5g-scm:5g-m100
ref_id: 5G-M100
category: process
description: (L1) Communicate and report about on-going or past incidents to third
parties, customers, and/or government authorities, when necessary
- urn: urn:intuitem:risk:reference_control:enisa-5g-scm:5g-m101
ref_id: 5G-M101
category: process
description: (L2) Implement policy and procedures for communicating and reporting
about incidents
- urn: urn:intuitem:risk:reference_control:enisa-5g-scm:5g-m102
ref_id: 5G-M102
category: process
description: (L3) Evaluate past communications and reporting about incidents
- urn: urn:intuitem:risk:reference_control:enisa-5g-scm:5g-m103
ref_id: 5G-M103
category: process
description: (L3) Review and update the reporting and communication plans, based
on changes or past incidents
- urn: urn:intuitem:risk:reference_control:enisa-5g-scm:5g-m104
ref_id: 5G-M104
category: process
description: (L1) Implement a service continuity strategy for the communications
networks and/or services provided
- urn: urn:intuitem:risk:reference_control:enisa-5g-scm:5g-m105
ref_id: 5G-M105
category: process
description: (L2) Implement contingency plans for critical systems
- urn: urn:intuitem:risk:reference_control:enisa-5g-scm:5g-m106
ref_id: 5G-M106
category: process
description: (L2) Monitor activation and execution of contingency plans, registering
successful and failed recovery times
- urn: urn:intuitem:risk:reference_control:enisa-5g-scm:5g-m107
ref_id: 5G-M107
category: process
description: (L2) Implement contingency plans for dependent and inter-dependent
critical sectors and services. When determining dependent critical sectors and
services, providers may take into account those services that are dependent
on the continuity of the network and service operation which are essential for
the maintenance of critical societal and/or economic activities and for which
an incident would have significant disruptive effects on the provision of that
service. One possible way for identifying such dependent services may be to
pass the obligation to service consumers to inform the providers if their service
is considered critical
- urn: urn:intuitem:risk:reference_control:enisa-5g-scm:5g-m108
ref_id: 5G-M108
category: process
description: (L3) Review and revise service continuity strategy periodically
- urn: urn:intuitem:risk:reference_control:enisa-5g-scm:5g-m109
ref_id: 5G-M109
category: process
description: (L3) Review and revise contingency plans, based on past incidents
and changes
- urn: urn:intuitem:risk:reference_control:enisa-5g-scm:5g-m110
ref_id: 5G-M110
category: process
description: (L1) Prepare for recovery and restoration of services following disasters
- urn: urn:intuitem:risk:reference_control:enisa-5g-scm:5g-m111
ref_id: 5G-M111
category: process
description: (L2) Implement policy/procedures for deploying disaster recovery
capabilities
- urn: urn:intuitem:risk:reference_control:enisa-5g-scm:5g-m112
ref_id: 5G-M112
category: process
description: (L2) Implement industry standard disaster recovery capabilities,
or be assured they are available from third parties (such as national emergency
networks)
- urn: urn:intuitem:risk:reference_control:enisa-5g-scm:5g-m113
ref_id: 5G-M113
category: process
description: (L3) Set up state of the art disaster recovery capabilities to mitigate
natural and/major disasters
- urn: urn:intuitem:risk:reference_control:enisa-5g-scm:5g-m114
ref_id: 5G-M114
category: process
description: (L3) Review and update disaster recovery capabilities regularly,
taking into account changes, past incidents, and results of tests and exercises
- urn: urn:intuitem:risk:reference_control:enisa-5g-scm:5g-m115
ref_id: 5G-M115
category: process
description: (L1) Implement monitoring and logging of critical systems
- urn: urn:intuitem:risk:reference_control:enisa-5g-scm:5g-m116
ref_id: 5G-M116
category: process
description: (L2) Implement policy for logging and monitoring of critical systems
- urn: urn:intuitem:risk:reference_control:enisa-5g-scm:5g-m117
ref_id: 5G-M117
category: process
description: '(L2) Set up tools for monitoring critical systems '
- urn: urn:intuitem:risk:reference_control:enisa-5g-scm:5g-m118
ref_id: 5G-M118
category: process
description: (L2) Set up tools to collect and store logs of critical systems
- urn: urn:intuitem:risk:reference_control:enisa-5g-scm:5g-m119
ref_id: 5G-M119
category: process
description: (L3) Set up tools for automated collection and analysis of monitoring
data and logs
- urn: urn:intuitem:risk:reference_control:enisa-5g-scm:5g-m120
ref_id: 5G-M120
category: process
description: (L3) Review and update logging and monitoring policy/procedures,
taking into account changes and past incidents
- urn: urn:intuitem:risk:reference_control:enisa-5g-scm:5g-m121
ref_id: 5G-M121
category: process
description: (L1) Exercise and test backup and contingency plans to make sure
systems and processes work and personnel is prepared for large failures and
contingencies
- urn: urn:intuitem:risk:reference_control:enisa-5g-scm:5g-m122
ref_id: 5G-M122
category: process
description: (L2) Implement a program for exercising backup and contingency plans
regularly, using realistic scenarios covering a range of different scenarios
over time
- urn: urn:intuitem:risk:reference_control:enisa-5g-scm:5g-m123
ref_id: 5G-M123
category: process
description: (L2) Make sure that the issues and lessons learnt from exercises
are addressed by the responsible people and that the relevant processes and
systems are updated accordingly
- urn: urn:intuitem:risk:reference_control:enisa-5g-scm:5g-m124
ref_id: 5G-M124
category: process
description: (L3) Review and update the exercise plans, taking into account changes,
past incidents and contingencies which were not covered by the exercise program
- urn: urn:intuitem:risk:reference_control:enisa-5g-scm:5g-m125
ref_id: 5G-M125
category: process
description: (L3) Involve suppliers and other third parties in exercises, for
example business partners and customers
- urn: urn:intuitem:risk:reference_control:enisa-5g-scm:5g-m126
ref_id: 5G-M126
category: process
description: (L1) Test networks and information systems before using them or connecting
them to existing systems
- urn: urn:intuitem:risk:reference_control:enisa-5g-scm:5g-m127
ref_id: 5G-M127
category: process
description: (L2) Implement policy/procedures for testing network and information
systems
- urn: urn:intuitem:risk:reference_control:enisa-5g-scm:5g-m128
ref_id: 5G-M128
category: process
description: (L2) Implement tools for automated testing
- urn: urn:intuitem:risk:reference_control:enisa-5g-scm:5g-m129
ref_id: 5G-M129
category: process
description: (L3) Review and update the policy/procedures for testing, taking
into account changes and past incidents
- urn: urn:intuitem:risk:reference_control:enisa-5g-scm:5g-m130
ref_id: 5G-M130
category: process
description: (L1) Ensure critical systems undergo security scans and security
testing regularly, particularly when new systems are introduced and following
changes
- urn: urn:intuitem:risk:reference_control:enisa-5g-scm:5g-m131
ref_id: 5G-M131
category: process
description: (L2) Implement policy/procedures for security assessments and security
testing
- urn: urn:intuitem:risk:reference_control:enisa-5g-scm:5g-m132
ref_id: 5G-M132
category: process
description: (L3) Evaluate the effectiveness of policy/procedures for security
assessments and security testing
- urn: urn:intuitem:risk:reference_control:enisa-5g-scm:5g-m133
ref_id: 5G-M133
category: process
description: (L3) Review and update policy/procedures for security assessments
and security testing, taking into account changes and past incidents
- urn: urn:intuitem:risk:reference_control:enisa-5g-scm:5g-m134
ref_id: 5G-M134
category: process
description: (L1) Monitor compliance to standards and legal requirements
- urn: urn:intuitem:risk:reference_control:enisa-5g-scm:5g-m135
ref_id: 5G-M135
category: process
description: (L2) Implement policy/procedures for compliance monitoring and auditing
- urn: urn:intuitem:risk:reference_control:enisa-5g-scm:5g-m136
ref_id: 5G-M136
category: process
description: (L3) Evaluate the policy/procedures for compliance and auditing
- urn: urn:intuitem:risk:reference_control:enisa-5g-scm:5g-m137
ref_id: 5G-M137
category: process
description: (L3) Review and update the policy/procedures for compliance and auditing,
taking into account changes and past incidents
- urn: urn:intuitem:risk:reference_control:enisa-5g-scm:5g-m138
ref_id: 5G-M138
category: process
description: (L1) Perform regular threat monitoring
- urn: urn:intuitem:risk:reference_control:enisa-5g-scm:5g-m139
ref_id: 5G-M139
category: process
description: (L2) Implement threat intelligence program
- urn: urn:intuitem:risk:reference_control:enisa-5g-scm:5g-m140
ref_id: 5G-M140
category: process
description: (L3) Review and update the threat intelligence program
- urn: urn:intuitem:risk:reference_control:enisa-5g-scm:5g-m141
ref_id: 5G-M141
category: process
description: (L3) Threat intelligence program makes use of state of the art threat
intelligence systems
- urn: urn:intuitem:risk:reference_control:enisa-5g-scm:5g-m142
ref_id: 5G-M142
category: process
description: (L1) Inform end-users of communication networks and services about
particular and significant security threats to network or service that may affect
them
- urn: urn:intuitem:risk:reference_control:enisa-5g-scm:5g-m143
ref_id: 5G-M143
category: process
description: (L2) Implement policy/procedures for regular update of end-users
about security threats to network or service that may affect them
- urn: urn:intuitem:risk:reference_control:enisa-5g-scm:5g-m144
ref_id: 5G-M144
category: process
description: (L3) Review and update the policy/procedures for regular update of
end-users about security threats to network or service that may affect them
framework:
urn: urn:intuitem:risk:framework:enisa-5g-scm-v1.3
ref_id: ENISA 5G SCM v1.3
name: ENISA 5G Security Control Matrix v1.3
description: "The main goal of the ENISA 5G security controls matrix is to support\
\ the national authorities in the EU Member States with implementing the technical\
\ measures of the EU\u2019s 5G Cybersecurity toolbox.\nSource: https://www.enisa.europa.eu/publications/5g-security-controls-matrix\n"
requirement_nodes:
- urn: urn:intuitem:risk:req_node:enisa-5g-scm-v1.3:d1
assessable: false
depth: 1
ref_id: D1
name: GOVERNANCE AND RISK MANAGEMENT
description: D1 covers the security objectives related to governance and management
of network and information security risks
- urn: urn:intuitem:risk:req_node:enisa-5g-scm-v1.3:so1
assessable: false
depth: 2
parent_urn: urn:intuitem:risk:req_node:enisa-5g-scm-v1.3:d1
ref_id: SO1
name: Information security policy
description: Establish and maintain an appropriate information security policy
- urn: urn:intuitem:risk:req_node:enisa-5g-scm-v1.3:so1-001
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:enisa-5g-scm-v1.3:so1
ref_id: SO1-001
description: Security policy is defined, followed, and kept updated
typical_evidence: MNO has well-defined and documented security policies, procedures,
and best practices. MNO also has a documented audit process to confirm that
security policy and procedures are followed and are effective
reference_controls:
- urn:intuitem:risk:reference_control:enisa-5g-scm:5G-M1
- urn:intuitem:risk:reference_control:enisa-5g-scm:5G-M2
- urn:intuitem:risk:reference_control:enisa-5g-scm:5G-M3
- urn:intuitem:risk:reference_control:enisa-5g-scm:5G-M4
- urn:intuitem:risk:reference_control:enisa-5g-scm:5G-M5
- urn:intuitem:risk:reference_control:enisa-5g-scm:5G-M6
- urn: urn:intuitem:risk:req_node:enisa-5g-scm-v1.3:so1-002
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:enisa-5g-scm-v1.3:so1
ref_id: SO1-002
description: Industry trends and best practices related to security management
should be monitored
typical_evidence: MNO has documented processes, tools, and responsible personnel
for monitoring industry trends and best practices related to security management.
If applicable, MNO has monitoring records, such as reports and lessons learnt
reference_controls:
- urn:intuitem:risk:reference_control:enisa-5g-scm:5G-M1
- urn:intuitem:risk:reference_control:enisa-5g-scm:5G-M2
- urn:intuitem:risk:reference_control:enisa-5g-scm:5G-M3
- urn:intuitem:risk:reference_control:enisa-5g-scm:5G-M4
- urn:intuitem:risk:reference_control:enisa-5g-scm:5G-M5
- urn:intuitem:risk:reference_control:enisa-5g-scm:5G-M6
- urn: urn:intuitem:risk:req_node:enisa-5g-scm-v1.3:so2
assessable: false
depth: 2
parent_urn: urn:intuitem:risk:req_node:enisa-5g-scm-v1.3:d1
ref_id: SO2
name: Governance and risk management
description: Establish and maintain an appropriate governance and risk management
framework, to identify and address risks for the communications networks and
services
- urn: urn:intuitem:risk:req_node:enisa-5g-scm-v1.3:so2-001
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:enisa-5g-scm-v1.3:so2
ref_id: SO2-001
description: Extensive assessment of virtualization-related vulnerabilities
for MEC components
typical_evidence: Documentation of MEC components lists potential vulnerabilities
relating to using MEC components in virtualized environments, along with appropriate
measures to ensure their secure deployment/operation
reference_controls:
- urn:intuitem:risk:reference_control:enisa-5g-scm:5G-M7
- urn:intuitem:risk:reference_control:enisa-5g-scm:5G-M8
- urn:intuitem:risk:reference_control:enisa-5g-scm:5G-M9
- urn:intuitem:risk:reference_control:enisa-5g-scm:5G-M10
- urn:intuitem:risk:reference_control:enisa-5g-scm:5G-M11
- urn:intuitem:risk:reference_control:enisa-5g-scm:5G-M12
- urn:intuitem:risk:reference_control:enisa-5g-scm:5G-M13
- urn: urn:intuitem:risk:req_node:enisa-5g-scm-v1.3:so2-002
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:enisa-5g-scm-v1.3:so2
ref_id: SO2-002
description: Insurable risks are identified, assessed, and appropriately mitigated
typical_evidence: Documented (i) process of identifying insurable risks, (ii)
list of insurable risks with their owners, (iii) risk assessment and evaluation
criteria as well as results (documented risk analysis), (iv) selected security
controls for each of the identified risks, and (v) a list of accepted residual
risks
reference_controls:
- urn:intuitem:risk:reference_control:enisa-5g-scm:5G-M7
- urn:intuitem:risk:reference_control:enisa-5g-scm:5G-M8
- urn:intuitem:risk:reference_control:enisa-5g-scm:5G-M9
- urn:intuitem:risk:reference_control:enisa-5g-scm:5G-M10
- urn:intuitem:risk:reference_control:enisa-5g-scm:5G-M11
- urn:intuitem:risk:reference_control:enisa-5g-scm:5G-M12
- urn:intuitem:risk:reference_control:enisa-5g-scm:5G-M13
- urn: urn:intuitem:risk:req_node:enisa-5g-scm-v1.3:so2-003
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:enisa-5g-scm-v1.3:so2
ref_id: SO2-003
description: Internal and external sources of risks and threats are identified
proactively. Threats of particular significance for 5G networks are included.
Identified risks are aligned with the main risks for 5G networks identified
in the EU Coordinated Risk Assessment of 5G Network Security.
typical_evidence: MNO has documented risk analysis policy and procedures, including
a documented list of threats and risk scenarios with their sources, including
to 5G networks, which also involves threat information collected from external
sources. Documented list of external sources for threat and risk monitoring
includes publications (such as reports from private/public organizations,
e.g. ENISA 5G Threat Landscape) and/or relevant CTI tools and platforms (commercial
and open source solutions such as MISP/OpenCTI). The documented list of threats
and risk scenarios is aligned with the EU Coordinated Risk Assessment of 5G
Network Security.
reference_controls:
- urn:intuitem:risk:reference_control:enisa-5g-scm:5G-M7
- urn:intuitem:risk:reference_control:enisa-5g-scm:5G-M8
- urn:intuitem:risk:reference_control:enisa-5g-scm:5G-M9
- urn:intuitem:risk:reference_control:enisa-5g-scm:5G-M10
- urn:intuitem:risk:reference_control:enisa-5g-scm:5G-M11
- urn:intuitem:risk:reference_control:enisa-5g-scm:5G-M12
- urn:intuitem:risk:reference_control:enisa-5g-scm:5G-M13
- urn: urn:intuitem:risk:req_node:enisa-5g-scm-v1.3:so2-004
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:enisa-5g-scm-v1.3:so2
ref_id: SO2-004
description: A baseline set of security controls should be selected, designed,
and specified
typical_evidence: A documented risk management plan with assets and threats.
Documented processes and, if applicable, other records of using the risk management
plan as input for specification of security controls. Documented processes
and, if applicable, other records (such as review comments) showing that the
preventive measures listed by the security controls have been compared against
catalogues of best practices such as ISO 27001/ITU x.1051
reference_controls:
- urn:intuitem:risk:reference_control:enisa-5g-scm:5G-M7
- urn:intuitem:risk:reference_control:enisa-5g-scm:5G-M8
- urn:intuitem:risk:reference_control:enisa-5g-scm:5G-M9
- urn:intuitem:risk:reference_control:enisa-5g-scm:5G-M10
- urn:intuitem:risk:reference_control:enisa-5g-scm:5G-M11
- urn:intuitem:risk:reference_control:enisa-5g-scm:5G-M12
- urn:intuitem:risk:reference_control:enisa-5g-scm:5G-M13
- urn: urn:intuitem:risk:req_node:enisa-5g-scm-v1.3:so2-005
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:enisa-5g-scm-v1.3:so2
ref_id: SO2-005
description: "The MNO should have a mature supply chain risks management (SCRM),\
\ which should include security assessments of vendor development and product\
\ lifecycle processes and security assurance specifications. Such risk assessments\
\ could include 3GPP SCAS or the Common Criteria. \n \nIn 5G, the assessment\
\ is carried out at the beginning to ensure products/solutions are evaluated\
\ against known risks. However, this should be automated once the products\
\ are implemented in the network."
typical_evidence: "Verification of the evaluation report by the MNO to ensure\
\ that deployed VNFs conform to security functional and assurance requirements.\
\ \n \nIn case of a Common Criteria certification, MNO verifies the certificate\
\ issued by an accredited laboratory and certification body."
reference_controls:
- urn:intuitem:risk:reference_control:enisa-5g-scm:5G-M7
- urn:intuitem:risk:reference_control:enisa-5g-scm:5G-M8
- urn:intuitem:risk:reference_control:enisa-5g-scm:5G-M9
- urn:intuitem:risk:reference_control:enisa-5g-scm:5G-M10
- urn:intuitem:risk:reference_control:enisa-5g-scm:5G-M11
- urn:intuitem:risk:reference_control:enisa-5g-scm:5G-M12
- urn:intuitem:risk:reference_control:enisa-5g-scm:5G-M13
- urn: urn:intuitem:risk:req_node:enisa-5g-scm-v1.3:so3
assessable: false
depth: 2
parent_urn: urn:intuitem:risk:req_node:enisa-5g-scm-v1.3:d1
ref_id: SO3
name: Security roles and responsibilities
description: Establish and maintain an appropriate structure of security roles
and responsibilities
- urn: urn:intuitem:risk:req_node:enisa-5g-scm-v1.3:so3-001
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:enisa-5g-scm-v1.3:so3
ref_id: SO3-001
description: Assign security roles and responsibilities to personnel with clear
segregation of duties
typical_evidence: List of MNO personnel with documented non-overlapping security
roles and responsibilities. Documented processes are in place for regularly
reviewing and revising the structure of roles and responsibilities based on
changes and/or past incidents
reference_controls:
- urn:intuitem:risk:reference_control:enisa-5g-scm:5G-M14
- urn:intuitem:risk:reference_control:enisa-5g-scm:5G-M15
- urn:intuitem:risk:reference_control:enisa-5g-scm:5G-M16
- urn:intuitem:risk:reference_control:enisa-5g-scm:5G-M17
- urn:intuitem:risk:reference_control:enisa-5g-scm:5G-M18
- urn: urn:intuitem:risk:req_node:enisa-5g-scm-v1.3:so4
assessable: false
depth: 2
parent_urn: urn:intuitem:risk:req_node:enisa-5g-scm-v1.3:d1
ref_id: SO4
name: Security of third party dependencies
description: Establish and maintain a policy, with security requirements for
contracts with third parties, to ensure that dependencies on third parties
do not negatively affect security of networks and/or services
- urn: urn:intuitem:risk:req_node:enisa-5g-scm-v1.3:so4-001
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:enisa-5g-scm-v1.3:so4
ref_id: SO4-001
description: Equipment installed outside a telecommunications organization's
own premises should be sited in a protected area
typical_evidence: Contracts with third parties hosting the equipment contain
requirements for adhering to security best practices and industry standards.
Documented security policy for contracts with third parties and a list of
contracts with third-parties. Verify that residual risks are included in incident
management plans/processes (for incidents) and business continuity plans/processes
(for disasters)
reference_controls:
- urn:intuitem:risk:reference_control:enisa-5g-scm:5G-M19
- urn:intuitem:risk:reference_control:enisa-5g-scm:5G-M20
- urn:intuitem:risk:reference_control:enisa-5g-scm:5G-M21
- urn:intuitem:risk:reference_control:enisa-5g-scm:5G-M22
- urn:intuitem:risk:reference_control:enisa-5g-scm:5G-M23
- urn:intuitem:risk:reference_control:enisa-5g-scm:5G-M24
- urn:intuitem:risk:reference_control:enisa-5g-scm:5G-M25
- urn:intuitem:risk:reference_control:enisa-5g-scm:5G-M26
- urn: urn:intuitem:risk:req_node:enisa-5g-scm-v1.3:so4-002
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:enisa-5g-scm-v1.3:so4
ref_id: SO4-002
description: Protection against semiconductor doping
typical_evidence: Product documentation contains information on certification
of semiconductors and their suppliers for compliance with standards such as
ISO 26262
reference_controls:
- urn:intuitem:risk:reference_control:enisa-5g-scm:5G-M19
- urn:intuitem:risk:reference_control:enisa-5g-scm:5G-M20
- urn:intuitem:risk:reference_control:enisa-5g-scm:5G-M21
- urn:intuitem:risk:reference_control:enisa-5g-scm:5G-M22
- urn:intuitem:risk:reference_control:enisa-5g-scm:5G-M23
- urn:intuitem:risk:reference_control:enisa-5g-scm:5G-M24
- urn:intuitem:risk:reference_control:enisa-5g-scm:5G-M25
- urn:intuitem:risk:reference_control:enisa-5g-scm:5G-M26
- urn: urn:intuitem:risk:req_node:enisa-5g-scm-v1.3:so4-003
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:enisa-5g-scm-v1.3:so4
ref_id: SO4-003
description: Prevent TPM-Fail vulnerabilities
typical_evidence: Verify product documentation to ensure that the TPM hardware
used in the product is certified, for example, by the Trusted Computing Group
(TCG)
reference_controls:
- urn:intuitem:risk:reference_control:enisa-5g-scm:5G-M19
- urn:intuitem:risk:reference_control:enisa-5g-scm:5G-M20
- urn:intuitem:risk:reference_control:enisa-5g-scm:5G-M21
- urn:intuitem:risk:reference_control:enisa-5g-scm:5G-M22
- urn:intuitem:risk:reference_control:enisa-5g-scm:5G-M23
- urn:intuitem:risk:reference_control:enisa-5g-scm:5G-M24
- urn:intuitem:risk:reference_control:enisa-5g-scm:5G-M25
- urn:intuitem:risk:reference_control:enisa-5g-scm:5G-M26
- urn: urn:intuitem:risk:req_node:enisa-5g-scm-v1.3:so4-004
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:enisa-5g-scm-v1.3:so4
ref_id: SO4-004
description: SBOM for software components (including NFV software components)
is maintained. This makes it possible to quickly scan and search the SBOM
for any Zero-Day vulnerability once disclosed, allowing the MNO and the cloud
provider to respond quickly to such vulnerability to mitigate potential attacks.