text: http://eur-lex.europa.eu/legal-content/EN/TXT/?uri=uriserv:OJ.L_.2016.194.01.0001.01.ENG&toc=OJ:L:2016:194:TOC 3 ANNEX II of the NISD. According to the NIS Directive ‘operator of essential services’ means a public or private entity of a type referred in Annex II of the Directive, which meets the criteria laid down in

text: Article 5(2)

text: . 4 ANNEX III of the NIS Directive. 5 The requirements are defined in Articles 15 and 16 of the NIS Directive. This objective derives from the fact that there are numerous frameworks developed for specific industries and sectors, incorporating different regulatory compliance goals and varying degrees of complexity and scale. Therefore, the mapping of Information Security Audit and self-assessment/ management Frameworks for DSP and OES should ensure the cultural coverage of both sectorial and cross sectors (e.g. as energy, transport, drinking water and distribution, banking and financial market infrastructures, healthcare and digital infrastructure as referred to in the ANNEX II of the NIS Directive;

text: 14 For the purposes of this document according to articles 14, 15 and 16 of the NIS Directive , the primary goals of an IS audit, include (but are not limited to):

text: Commission Implementing

text: Regulation (EU) 2018/151 of 30 January 2018

text: laying down rules for application of

text: Directive (EU) 2016/1148

text: of the European Parliament and of the Council as regards further specification of the elements to be taken into account by digital service providers for managing the risks posed to the security of network and information systems and of the parameters for determining whether an incident has a substantial impact, available at https://eur-lex.europa.eu/legalcontent/EN/TXT/?uri=uriserv%3AOJ.L_.2018.026.01.0048.01.ENG.

identifier: Guidelines on assessing DSP security and OES compliance with the NISD security requirements

amnesord:
Cybersecurity of Critical Sectors
State of cybersecurity in the EU

title: Guidelines on assessing DSP security and OES compliance with the NISD security requirements

text: Guidelines on assessing DSP and OES compliance to the NISD security requirements Information Security Audit and Self – Assessment/ Management Frameworks

text: NOVEMBER 2018

text: www.enisa.europa.eu European Union Agency For Network and Information Security Guidelines on assessing DSP and OES compliance to the NISD security requirements

text: NOVEMBER 2018

text: About ENISA

text: The European Union Agency for Network and Information Security (ENISA) is a centre of network and information security expertise for the EU, its member states, the private sector and EU citizens. ENISA works with these groups to develop advice and recommendations on good practice in information security. It assists member states in implementing relevant EU legislation and works to improve the resilience of Europe’s critical information infrastructure and networks. ENISA seeks to enhance existing expertise in member states by supporting the development of cross-border communities committed to improving network and information security throughout the EU. More information about ENISA and its work can be found at www.enisa.europa.eu. Contact For queries in relation to this paper, please use ciip&resilience@enisa.europa.eu For media enquires about this paper, please use press@enisa.europa.eu. Legal notice Notice must be taken that this publication represents the views and interpretations of ENISA, unless stated otherwise. This publication should not be construed to be a legal action of ENISA or the ENISA bodies unless adopted pursuant to the

text: Regulation (EU) No 526/2013

text: . This publication does not necessarily represent state-of the-art and ENISA may update it from time to time. Third-party sources are quoted as appropriate. ENISA is not responsible for the content of the external sources including external websites referenced in this publication. This publication is intended for information purposes only. It must be accessible free of charge. Neither ENISA nor any person acting on its behalf is responsible for the use that might be made of the information contained in this publication. Copyright Notice © European Union Agency for Network and Information Security (ENISA), 2018 Reproduction is authorised provided the source is acknowledged. ISBN 978-92-9204-264-6, DOI 10.2824/265743 02 Guidelines on assessing DSP and OES compliance to the NISD security requirements

text: NOVEMBER 2018

text: Table of Contents

text: Executive Summary 5 1. Introduction 6 Scope and Objectives 6 EU Policy Context 7 Methodology 7 Target Audience 7 Document Overview 7 2. Introduction to Information Security Audits 8 Definition of an IS audit 8 Forms of an IS audit 8 Scope of an IS audit 9 Process of an IS audit 9 Key outcomes of an audit 10 3. Information Security Audit Lifecycle for NCA 12 Pre-audit/Planning Phase 12 3.1.1 Scoping 13 3.1.2 Pre-audit issues to consider 13 Audit Execution/Fieldwork Phase 14 3.2.1 Audit methodology for OES 14 3.2.2 Audit methodology for DSP 23 Post-audit actions for NCA 27 3.3.1 Post-audit issues to consider 28 4. Mapping to Information Security Risk Assessment/Management Frameworks 30 Analysis of Relevant (Self) Risk Assessment/Management Frameworks 30 4.1.1 International (Self) Risk Assessment/Management Standards & Frameworks 31 4.1.2 National (Self) Risk Assessment/Management Standards & Frameworks 32 4.1.3 Analysis of Information Security Control Audit Frameworks 33 4.1.4 Mapping Information Security Risk Assessment/Management Frameworks with Information Security Control frameworks. 34 5. Outlook 36 Annex A: Risk Assessment and Risk Management Documentation 37 Relevant Information Security Control Standards and Frameworks 37 03 Guidelines on assessing DSP and OES compliance to the NISD security requirements

text: NOVEMBER 2018

text: A.1.1 ISO 27001 37 A.1.2 COBIT 5 38 A.1.3 ISA/IEC 62443 39 Risk Assessment and Risk Management Methodologies and Tools 41 Annex B: International and National (Self) Risk Assessment/Management Standards and Frameworks 54 International Self-Risk Assessment/Management Standards and Frameworks 54 B.1.1 ISO/IEC 27001 54 B.1.2 OCTAVE 54 B.1.3 CRAMM 55 B.1.4 FAIR 55 B.1.5 IRAM2 55 B.1.6 NIST 800-30 55 National Self-Risk Assessment/Management Standards and Frameworks 56 B.2.1 BSI-100-3 56 B.2.2 MAGERIT 56 B.2.3 MEHARI 57 B.2.4 MONARC 57 Annex C: Terminology and Abbreviations 58 04 Guidelines on assessing DSP and OES compliance to the NISD security requirements

text: NOVEMBER 2018

text: Executive Summary

text: According to the NIS Directive Articles

text: and

text: , one of the key objectives is to introduce appropriate security measures for operators of essential services (OES) as well as for the digital service providers (DSP) in an effort to achieve a baseline, common level of information security within the European Union (EU) network and information systems. Information security (IS) audits and self–assessment/ management exercises are the two major enablers to achieve this objective. This report presents the steps of an information security audit process for the OES compliance, as well as of a selfassessment/ management framework for the DSP security against the security requirements set by the NIS Directive. In addition, it provides an analysis of the most relevant information security standards and frameworks to support OES and DSP in practicing the above exercises in the most tailored and efficient manner. The report identifies numerous parameters towards the successful conduct of information security audits as well as self-assessment/management. Specifically it:  Proposes an information security audit methodology that could be utilized to facilitate the audit process for OES by the NCA and DSP security self-assessments e;  Provides an indicative guideline (set of questions) accompanied by evidence that could be utilized to facilitate the overall audit process;  Proposes to DSP an indicative list of questions, together with relevant evidence, that could facilitate their self assessment exercises against the security requirements prescribed in article 16(1) of the NIS Directive;  Presents post-audit actions for the NCA with a view to extract benefit and/or knowledge, following an information security audit exercise;  Illustrates all the information security lifecycle phases and highlights key issues in each phase (e.g. scoping and main challenges during the pre-audit/ planning phase); and  Presents a comparison of IS audit and self-assessment/management frameworks and methodologies and their correlation with relevant IS audit standards. Overall, this report is a guidance to national competent authorities in supporting the implementation of the requirements stemming from article 14, 15 and 16 of the Directive. https://eur-lex.europa.eu/legalcontent/EN/TXT/?toc=OJ:L:2016:194:TOC&uri=uriserv:OJ.L_.2016.194.01.0001.01.ENG 05 Guidelines on assessing DSP and OES compliance to the NISD security requirements

text: NOVEMBER 2018

text: 1. Introduction

text: According to the Network and Information Security (NIS)

text: Directive (EU) 2016/1148

text: , Member States should adopt a common set of baseline security requirements to ensure a minimum level of harmonized security measures across EU Member States and enhance the overall level of security of operators providing essential services (OES) and digital service providers (DSP) in the EU. The NIS Directive sets (3) three primary objectives:  to improve the national information security capabilities of the Member States;  to build mutual cooperation at EU level; and  to promote a culture of risk management and incident reporting among actors (OES and DSP) of particular importance for the maintenance of key economic and societal activities in the Union. This report outlines audit and self-assessment/ management frameworks that can be applied:  by both OES and DSP regarding the NIS Directive security requirements;  as the baseline for building an information security program to manage risk and reduce vulnerabilities;  to define and prioritize the tasks required to enhance security into IT-security risk-based environments. Scope and Objectives The main objective of this report is to facilitate NCA conducting audits and to assist DSP and OES across all EU Member States to comply with the requirements of the NIS Directive in the effort to achieve a baseline security level. This is achieved by: a) proposing the information security audit and self-assessment/management frameworks that can be applied by DSP and OES, with regards to the NISD security requirements ; b) mapping those frameworks per domain of applicability (i.e. in DSP, OES business environments or both); c) presenting recommendations to the NCA on how to handle, manage and process the information collected during audits performed on OES. The key outcome of the study is a set of questions and supporting information that NCA can use to assess OES compliance as well as a set of questions for DSP to perform security self assessments against the NISD security requirements 06 Guidelines on assessing DSP and OES compliance to the NISD security requirements

text: NOVEMBER 2018

text: EU Policy Context The compliance assessment performed by national competent authorities (NCA) is mentioned in articles 14, 15 and 16 of the NISD and defines risk assessment and auditing obligations for the OES and DSP respectively. 

text: Article 14

text: : “Member States shall ensure that operators of essential services take appropriate and proportionate technical and organisational measures to manage the risks posed to the security of network and information systems which they use in their operations. Having regard to the state of the art, those measures shall ensure a level of security of network and information systems appropriate to the risk posed.”  Article (15): “Member States shall ensure that the competent authorities have the powers and means to require operators of essential services to provide (b) evidence of the effective implementation of security policies, such as the results of a security audit carried out by the competent authority or a qualified auditor and, in the latter case, to make the results thereof, including the underlying evidence, available to the competent authority.”  Article (16): “Member States shall ensure that digital service providers identify and take appropriate and proportionate technical and organisational measures to manage the risks posed to the security of network and information systems which they use in the context of offering services referred to in Annex III within the Union. Having regard to the state of the art, those measures shall ensure a level of security of network and information systems appropriate to the risk posed, and shall take into account the following elements: a) the security of systems and facilities, b) incident handling, c) business continuity management, d) monitoring, auditing and testing, and e) compliance with international standards”. Methodology This study is based on: (a) desktop research of (inter)national security standards, IS audit frameworks, legislative documents and regulations, good practices and common key policies; (b) an online survey circulated within EU Member States (MS) representatives and experts, including all the identified elements of the desktop research. Target Audience  Operators of Essential Services (OES), either public or private entities, covering a number of sectors as described in Annex II of the NIS Directive .  Digital Service Providers (DSP), any legal entity that provides any digital service, at a distance, by electronic means and at the individual request as described in

text: Directive (EU) 2015/1535

text: .  National Competent Authorities (NCA) on the security of network and information systems, covering the sectors and services referred to in Annex II and Annex III of the NIS Directive. Document Overview The rest of this report is structured as follows:  Section 2 presents and analyses the forms, the scope, the basic principles, goals, and applicability of Information security audit frameworks for OES and DSP.  Section 3 provides good practices for NCA and recommendations on performing effective and tailored audits throughout all phases of the audit lifecycle.  Section 4 provides an overview of relevant information security self-assessment/ management frameworks and alignment to control frameworks .  Supplementary material regarding the standards and frameworks can be found on Annex A: and Annex B: alongside with terminology and abbreviations on Annex C:.

text: https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32016L1148&from=EN 8 https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32015L1535&from=EN

text: 07 Guidelines on assessing DSP and OES compliance to the NISD security requirements

text: NOVEMBER 2018

text: 2. Introduction to Information Security Audits

text: It is common practice to customise an information security standard or framework (based to IT security controls) to fit a particular business environment. Several criteria (e.g. adequacy, sufficiency, validity and acceptability) can 9, 10 be used for this . The "modus operandi" (e.g. form, scope, process, basic principles and goals) of existing information security standards and frameworks are described in the following sub chapters. Definition of an IS audit An information systems security audit is an independent review and examination of system records, activities and related documents. These audits are intended to improve the level of information security, avoid improper information security designs, and optimize the efficiency of the security safeguards and security processes .  the risk assessment, identification and classification of the organization’s information systems and/or assets; and  the overall evaluation of the organization’s design and operating control effectiveness, in all layers, procedural and systemic; and  the ultimate compliance of all systems and processes of the organization with:  the existing regulatory framework (e.g. European and national legislation); and  the IT-related policies and standards. Forms of an IS audit There are three main forms of IS audit , depending on the relationship between the auditor and the auditee parties:  First-party audit is defined in each and every internal procedure handled by an internal member or group of members within an organisation. The purpose of the first-party audit is to ensure that a process, or set of processes in the quality management system, meets the procedure requirements specified by the enterprise. If the audit is performed by the owner(s) of the process(es) then the audit process is called a self-assessment, which is a commonly accepted procedure of the audit preparation. On behalf of the enterprise, the auditor acts internally and inspects in depth for problematic areas where processes possibly do not comply, and identifies opportunities for improvement. http://ec.europa.eu/information_society/newsroom/image/document/2018- 19/reference_document_security_measures_version_to_be_published_44F171BD-9E21-9945- FB43065BDD852E89_52065.pdf https://ec.europa.eu/info/law/better-regulation/initiative/167285/attachment/090166e5b833a031_en Moeller, Robert R. IT audit, control, and security. Vol. 13. John Wiley & Sons, 2010. https://www.isaca.org/Journal/archives/2016/volume-5/Pages/information-systems-security-audit.aspx which is to facilitate NCA conducting audits and to assist DSP and OES across all EU Member States to comply with the requirements of the NIS Directive in the effort to achieve a baseline security level. https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32016L1148&from=EN http://asq.org/learn-about-quality/auditing/ The auditor acts on behalf of the enterprise rather than a customer or certification body 08 Guidelines on assessing DSP and OES compliance to the NISD security requirements

text: NOVEMBER 2018

text:  A second-party audit takes place when the organization performs an audit of a vendor/supplier to ensure that all the requirements specified in the contract between the two parties exists.  A third-party audit occurs when an organization’s decision concerns the creation of a quality management system (QMS) that conforms to a standard set of requirements. In this case, an independent company is required to perform an audit to verify and validate the conformity and compliance of the organization with the necessary requirements. These certification bodies conduct audits to compare and verify that the QMS of the enterprise meets all the criteria and requirements of the standard of interest, and continues to meet the requirements on an ongoing basis. Once, the QMS meets the requirements, the certification body approves and delivers the certificate to the organization. The Directive foresees (

text: article 15

text: (2b)) that a Competent Authority itself or a qualified auditor might carry out the audit. Scope of an IS audit The scope of an IS audit includes various elements such as the description of the physical locations, the organizational units, the related activities and processes, as well as the timeline needed for conducting the audit. Determining the scope of the audit procedure is the most vital element of the overall audit planning; therefore, the audit scope should be based on, but not limited only to the followings:  risk exposures, regulatory guidelines and focus to high risk areas as they deserve closer attention and a broader scope to cover all the identified risk factors;  critical components that directly contribute to recovery capability and operations resilience; and  the nature of the business operations and the impact on operations of the audit process. An audit procedure performed by the National Competent Authorities (NCA) should mainly focus on:  high risk areas based on national criteria derived from a previously conducted assessment; or  areas that are considered critical, depending on the OES and DSP specialization. It has to be noted that the scoping of an audit in the context of the NIS Directive presents several challenges. Section 3.1 provides more information as well as relevant good practices. Process of an IS audit OES as well as DSP should take appropriate and proportionate technical and organisational measures to manage the risks posed to the security of network and information systems, which they use in their operations . Information security risk assessment is the process commonly used to determine these risks and is an integral part and a critical step in the information security risk management process. Risk assessment, even though it is part of the risk management process, is an individual activity (and not a continuous one), initiated when required or at specified regular intervals. 09 Guidelines on assessing DSP and OES compliance to the NISD security requirements

text: NOVEMBER 2018

text: Information security risk management can be either implemented individually or it can be part of the overall risk management process . The overall process and structure of an Information Security Risk Management process is depicted in Figure 1.

text: Figure 1. Information security risk management process

text: The main outcome of a risk assessment process is usually a qualitative, quantitative or a semi-quantitative evaluation of the possible risks that a given system, complex or not, is exposed to, taking into consideration its context and likely threats . Key outcomes of an audit One of the primary goals of the audit, is to assess the design and operating effectiveness of the implemented controls on all layers, organizational, procedural and/or technical. An additional key outcome/goal would be the assessment Risk Management refers to the overall management of risks. IS Risk Management refers to the management of risks derived by IT related risks. Therefore, IS RM can be part of the general RM process. Technical Department of ENISA Section Risk Management. Risk management: Implementation principles and inventories for risk management/risk assessment methods and tools. Technical report, ENISA, 2006. ISO, ISO, and I. E. C. Std. “ISO 27005: 2011.” Information technology–Security techniques–Information security risk management. ISO (2011). Campbell, T. (2016). "Chapter 14: Secure Systems Development". Practical Information Security Management: A Complete Guide to Planning and Implementation, ISBN 9781484216859. Guidelines on assessing DSP and OES compliance to the NISD security requirements

text: NOVEMBER 2018

text: of the implemented controls’ efficiency towards minimizing the identified risk. Finally, the following outcomes, is 22, 23 expected to be achieved during the IS audit lifecycle :  information and evidence about conformity or non-conformity to all the requirements of the legislative context or/and standards;  performance monitoring, measuring, reporting and reviewing against key performance objectives and targets;  auditee management systems and performance regarding the legal compliance;  review of design and operational effectiveness for all organizational and/or technical controls;  management responsibility for auditee policies;  review links between the normative requirements, policy, performance objectives and targets;  review any applicable legal requirements, responsibilities, competence of personnel; and  review operations, procedures, performance data and internal audit findings and conclusions. https://www.iso.org/iso-31000-risk-management.html https://na.theiia.org/standards-guidance/Public%20Documents/IPPF%202013%20English.pdf Guidelines on assessing DSP and OES compliance to the NISD security requirements

text: NOVEMBER 2018

text: 3. Information Security Audit Lifecycle for NCA

text: The information security audit lifecycle comprises all the steps of the audit process, beginning from the audit planning until the closure of the audit as well as other relevant post-execution actions. Figure 2 illustrates these phases; a description of each is provided in the following paragraphs.

text: Figure 2. Information security audit lifecycle for National Competent Authorities

text:  Pre-Audit/Planning Phase: Information needed for the execution of the security assessment is gathered during this phase (e.g. assets to be assessed, main threats against the assets, security controls to be used to mitigate these threats etc.). The security assessment is comprised of a project management plan, specific goals and objectives, scope, requirements, team roles and responsibilities, limitations, assumptions, challenges, timeframe and finally deliverables. All of the above have to be agreed during the planning phase.  Audit Execution/Fieldwork Phase: The execution phase is the main audit phase, during which the intended assessment methodology and technique should be implemented. Upon completion of the execution phase, assessors should have identified system, network and organizational process vulnerabilities.  Post-Execution Phase: This following tasks take place during this phase:  analysis of the identified vulnerabilities;  root cause identification is performed;  recommendations for mitigation measures; and  final report drafting. NCA as well as auditing and certification bodies must focus on all three phases above taking into account the:  practices and policies of the auditee during normal operation (security and monitoring of systems and facilities);  practices and policies of the auditee during abnormal operation (incident handling and reporting); and  compliance with national, international standards and requirements of the NIS Directive. Pre-audit/Planning Phase Prior to the execution of any audit, NCA have to prepare the audit implementation phase, while taking into account numerous factors including but not limited to:  the nature and scale of the audit;  the arrangement of assigned resources;  the understanding of the audit roadmap; and Guidelines on assessing DSP and OES compliance to the NISD security requirements

text: NOVEMBER 2018

text:  challenges and constraints. 3.1.1 Scoping As part of the pre-audit process , a scoping exercise, which ensures compliance with the NIS Directive, must take place. Scoping involves the determination of significant processes, locations (entities) and IT applications and systems that will be subject to assessment. To identify the above as well as their relevant assertions, NCA are required to evaluate the qualitative and quantitative risk factors related to the audited organization. The scoping will have a direct impact on the implementation of controls and the assessment of controls to be performed by the NCA. More specifically, the first step in scoping, is to conduct an assessment that will enable the NCA to identify the essential services and essential information systems of the auditee. The second step is to perform the risk assessment of the essential services and the underlying infrastructure by taking under consideration numerous factors such as the following:  the existing processes which support this infrastructure;  the resilience of systems and services;  the existing security architecture;  change and maintenance procedures; and  past incidents. According to Annex II of the NIS Directive, there are organizations whose daily activities are based not only on traditional Information Technology (IT) environments, but also on Operational Technology (OT) Environments (and focus on safety e.g. oil, gas, rail sector, ). There are different standards and practices focusing on IT and OT environments, which sometimes create competing priorities. Furthermore, these two areas in many instances do not have the required overarching governance with established communication and/ or cooperation schemes. This separation is evident across many sectors (i.e. transport sector - aviation, maritime, railway), introducing in many instances pitfalls for the audit process and the auditor. In addition, there are cases where operations of an organization span more than one NIS Directive sector (crossborder and cross-sector) which makes scoping even more challenging. 3.1.2 Pre-audit issues to consider A big aspect of the pre-audit planning is the timely identification and mitigation of possible challenges during the audit fieldwork. Important factors to consider may include:  The organization’s business model that determines the IT functions’ structure and service delivery model (i.e. geographic distribution of IT resources, decentralised IT operations).  Customization of IT and OT environments increases complexity (architectural diversity) in the risk-assessment management frameworks, requiring a high degree of subject matter expertise during the audit lifecycle. Additionally, in the context of the NISD audit requirements, the following should be considered: Although audit is not a requirement for DSP, it is recommended that they take into account similar scoping considerations as these presented in this section. A top-down, risk based approach is recommended in the scoping decisions in accordance with widely accepted information security standards and global best practices. Guidelines on assessing DSP and OES compliance to the NISD security requirements

text: NOVEMBER 2018

text:  Clear definition of the audit universe between the legal (i.e. regulatory issues) basis and the actual audit (compliance): identify the information systems that support the essential service and identify the scope of the audit.  emerging technology and infrastructure changes: transformation, innovation, disruption;  pressure of limited skilled resources, budgets and controlling costs: identifying, recruiting and maintaining individuals with the appropriate expertise, managing and controlling costs of the whole procedure;  audit (and certification) of the supply chain elements/ dependencies: legal obligations differ between OES and DSP, therefore the same audit framework/ security requirements cannot be utilized;  bridging IT and the business: IT should be integrated and aligned with the business and strategic decisions;  good practice indicators may differ for each sector and/ or the types of entities that are in the scope of the audit: a baseline is required to ensure a unified control list for auditing all different sectors; and  sharing the data collected by the audit: sharing of sensitive data should be managed accordingly. Audit Execution/Fieldwork Phase An information Security audit is an assessment of implemented security management controls within an IT system and/or infrastructure and is applicable to both OES and DSP related business environments . The auditing/certification body needs to evaluate (a sample of) the evidence (e.g. computer logs) obtained from the information and operational technology systems of an organization and determine the operational status of the organization (i.e. whether there is evidence that the implemented controls are operating effectively in line with the required level of security assurance). In this context, we suggest three main sources of reference, namely the:  NIS Directive Cooperation Group security measures for OES ;  ENISA report on security measures for DSP ; and  EC implementing act for DSP . The following security measures can be also used by the OES or the DSP as a tool to self-assess the maturity of the practices they follow in combination with well-known capability maturity models (CMM) such as the Capability Maturity Model (CMM®) and Capability Maturity Model Integration (CMMI), or the Business Development Capability Maturity Model (BD-CMM®). In principle, the fundamental concepts of the CMM as a model for optimizing the overall IT (and OT) security audit process can be applied and scaled to enhance any provider in scope of the NISD. 3.2.1 Audit methodology for OES In this section, a guidance to the NCA on how to facilitate the IS audit for OES is provided. The guidance follows the categorization of the security measures as suggested by the Cooperation Group (see Figure 3). More specifically, the report provides a list of questions categorized per security measure and each question is accompanied by indicative pieces of evidence, which enable the body that performs the audit (as per

text: article 14

text: ), to assess whether each control is implemented as intended. In the case of DSP it will take the form of an internal audit or security self assessment. http://ec.europa.eu/newsroom/dae/document.cfm?doc_id=53643 https://www.enisa.europa.eu/publications/minimum-security-measures-for-digital-service-providers/ https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=uriserv%3AOJ.L_.2018.026.01.0048.01.ENG Guidelines on assessing DSP and OES compliance to the NISD security requirements

text: NOVEMBER 2018

text: Figure 3. Security Measures for OES

text: PART 1 – GOVERNANCE AND ECOSYSTEM 1.1 INFORMATION SYSTEM SECURITY GOVERNANCE & RISK MANAGEMENT

text: S/N SECURITY MEASURES QUESTIONS EVIDENCE

text: Is the key personnel aware of the main Evidence of personnel attendance to the training (e.g. information security risks and the relevant accepted invitation, date and agenda of training, signed mitigations? participation list during the awareness workshop etc.).

text: Is there a mechanism for ensuring that all Information System Guidance for personnel on assessing risks and list of security personnel use the risk management 1 risks and evidence of updates/reviews documented. Security Risk Analysis methodology and tools?

text: Is the risk management methodology and/or Documentation of the review process and updates of tools, periodically reviewed, taking into the risk management methodology and/or tools. account changes and past incidents? Time-table and overall plan of the review cycle.

text: Is there an information security policy (ISSP) Information System 2 and an information security management Documented ISS policy in place (dated and signed). Security Policy system (ISMS) in place?

text: Guidelines on assessing DSP and OES compliance to the NISD security requirements

text: NOVEMBER 2018

text: Certification against information security risk Are there any certifications in place for management standards (for example ISO 27001), specific security risk management standards? including scope statement.

text: Are the information security processes Documentation of review process, taking into account reviewed at regular intervals, while taking into account violations, exceptions and incidents changes and past incidents. which affected other essential operators/ Time-table and overall plan of the review cycle. DSP?

text: Have the systems supporting essential services been regularly subjected to security scans and have they been integrated within Reports from past security scans and security tests. the risk management framework of the organization?

text: Documented policy/procedures for security assessments and security testing, which at least include: Information System -which assets should be assessed, 3 Security Accreditation Are there policy/procedures in place for the -under what circumstances, performance of security assessments and -the type of security assessments and tests, security testing? -frequency, -approved parties (internal or external), -confidentiality levels for assessment and -test results and the objectives security assessments and tests.

text: Has the effectiveness of policy/procedures for List of reports about security assessment and security security testing been evaluated? tests.

text: Are KPIs implemented in systems supporting Documentation of KPIs and mapping with the Critical essential services to be able to assess their Information System in which they are implemented. effectiveness at all times?

text: Are there any policy/procedures in place for Policy/procedures for testing critical information Information System the implementation of security indicators for systems, including when tests must be carried out, test 4 Security Indicators testing the systems supporting essential plans, test cases, test report templates, desired KPI services? values.

text: Updated policy/procedures for testing critical Are the aforementioned policy/procedures information systems, review comments, and/or change reviewed and updated? logs.

text: Is there an updated policy and/ or procedure Information System for performing information system security Information security audit policy and/ or procedures, 5 Security Audit assessments and audits of systems and assets formally documented and regularly maintained. supporting essential services?

text: Are the professional references of key Documentation of checks of professional references for personnel (system administrators, security key personnel. Human Resource officers, guards, et cetera) validated? 6 Security Is training material on security issues Evidence of personnel attendance to the training (e.g. provided to key personnel? Accepted invitation, date and agenda of training,

text: NOVEMBER 2018

text: signed participation list during the awareness

text: workshop etc.)

text:  List of appointments (CISO, DPO, etc.), and

text: description of responsibilities and tasks for

text: Is key personnel formally appointed in security roles. necessary security roles?  Organization’s organigram in place, job

text: descriptions signed by key personnel, relevant

text: role trainings attended.

text: Are the policies/procedures for the Human  Comments or change logs of the

text: Resource security regularly reviewed and policy/procedures.

text: updated, taking into account possible  Review time-plan versions of the policies/

text: changes? procedures providing the changes that took place.

text: Are lists of critical assets and configurations Lists of centrally managed critical assets and critical of systems supporting essential services system configurations managed and maintained. maintained?

text: Documented policy/procedures for asset management,

text: Is there a policy/procedures in place for asset including roles, responsibilities, assets and 7 Asset Management management configuration control? configurations that are subject to the policy along with

text: the objectives of the asset management

text: Is the asset management policy regularly Up to date asset management policy/procedures, updated, based on changes and past review comments and/or change logs. incidents?

text: 1.2 ECOSYSTEM MANAGEMENT

text: Are the contract relationships with third 1 Ecosystem Mapping Lists of all contracts with third-parties parties properly documented and listed?

text: Explicit security requirements in the contracts with Are the security requirements included in the third parties supplying IT products, IT services, contracts with third parties? outsourced business processes, helpdesks etc.

text: Documented security policy for contracts with third Is a security policy for third parties in place? parties.

text: Is the security policy for third parties Documented comments or change logs of the policy. reviewed following incidents or changes? 2 Ecosystem Relations

text:  Vendor Risk Assessment/ Management policy/ Are there any residual risks associated to procedure in place and maintained. third parties and their services not  Documented amendment or termination of addressed/mitigated? relationships with high-risk third parties.

text: Is a periodic review and update performed to Documentation of review process of the ecosystem the security policy of third parties, taking into relations policy. account past incidents, changes, etc.?

text: NOVEMBER 2018

text: PART 2 – PROTECTION 2.1 IT SECURITY ARCHITECTURE

text:  System configuration policy and/ or procedure in Are networks and systems supporting place and maintained. essential services configured with information  System configuration tables. security in mind?  Timetable and plan of system configuration review cycles. 1 Systems Configuration  Documented past exercises/ tests of critical Is the effectiveness of the security information systems in place. configurations to protect the integrity of  Timetable and plan of security configuration systems evaluated and reviewed? reviews.

text: Are the information systems properly Documentation about how the system segregation of 2 System Segregation segregated in order minimize the potential CISs and data is implemented. consequences when risks occur?

text: Is there a monitoring mechanism of the Monitoring reports of critical network and information systems supporting essential services in systems. place?

text: Is there a traffic monitoring policy of the Documented policy for monitoring procedures, 3 Traffic Filtering systems supporting essential services in including minimum monitoring requirements. place?

text: Are there tools in place for supporting the traffic monitoring of the systems supporting Proof of existing tools for monitoring systems. essential services?

text: Are there cryptographic mechanisms in place to protect the confidentiality and integrity of Appropriate cryptographic processes exist. information stored in or out of the company boundaries (digital facilities)? 4 Cryptography Are there implemented cryptographic mechanisms such as digital signatures and Safeguards to protect the secrecy of secret (private) hashes to detect unauthorized changes to key(s) are in place. critical data at rest?

text: 2.2 IT SECURITY ADMINISTRATION

text: Does the operator set up specific administration accounts, to be used only for Administration administrators that are carrying out specific Tailored and documented administration accounts with 1 Accounts operations (e.g. installation, configuration, specific access rights given to the relevant personnel. management, maintenance, etc.) on the systems supporting essential services?

text: NOVEMBER 2018

text: Are the administrator accounts solely used to  Documented management of administrator connect to administration information accounts process. systems?  Logs of administrator account activity available.

text: Are hardware and software resources, used Detailed inventory with hardware and software for administration purposes? resources used for administration purposes.

text: Are administration information systems solely Administration information systems isolated and Administration 2 used for administration purposes and not segregated from the rest of the infrastructure for Information Systems mixed up with other operations? enhanced resilience.

text: Are the aforementioned resources managed Responsible specialized personnel for the management and configured by an authorised operator? and configuration of the aforementioned resources.

text: 2.3 IDENTITY AND ACCESS MANAGEMENT

text: Are there any access control mechanisms in Access control policy including description of roles, place, for network and information systems, groups, access rights, procedures for granting and to allow only authorized use? revoking the right to access the information systems.

text: Are unused or no longer needed accounts Rule definition for deleting no longer used accounts Authentication and 1 deactivated? after a short period of time. Identification

text: Is there a mechanism in place for monitoring access to network and information systems Access control related matrices (e.g. segregation of and for approving exceptions and registering duties control matrix, remote access control, etc.) access violations?

text: Are access rights granted in a structured and Access right section included in access control policy/ monitored manner? Are they granted procedures. automatically when applicable? 2 Access Rights

text: Does the operator define access rights to the Access rights mapping register to relevant resources multiple functionalities of the resource? and/or processes included in access control policy.

text: 2.4 IT SECURITY MAINTENANCE

text: Has a procedure been established for security Maintenance security procedure properly documented maintenance in accordance with the security and approved by senior management. policy?

text: Are the conditions for enabling the minimum IT Security Clearly defined minimum security maintenance security level for systems supporting essential 1 Maintenance process. services resources defined? Procedure  Formally documented software and hardware Are software and hardware resources requirements for ensuring compatibility. regularly maintained and updated?  Software/ hardware asset management formally documented and maintained.

text: NOVEMBER 2018

text: Considering that the proper operation of many essential services depend on Industrial Control functioning and secure industrial control 2 Formally documented ICS requirements Systems systems (ICS), does the operator, if applicable, take the particular security requirements for ICS into account?

text: 2.5 PHYSICAL AND ENVIRONMENTAL SECURITY

text: Is unauthorized physical access to facilities Basic implementation of physical security measures and infrastructure prevented and have and environmental controls, such as door and cabinet environmental controls, for the protection locks, burglar alarm, fire alarms, fire extinguishers, against unauthorized access (such as CCTVs, etc. burglary, fire, flooding, etc.) been implemented?

text: Physical and 1 Has only a limited number of authorized Environmental Security personnel with authorized access and List of personnel with authorized access and appropriate authorization credentials access authorization credentials. to premises containing information systems?

text: Is there a policy for physical and Documented policy for physical security measures and environmental security measures environmental controls, including description of implemented? facilities and systems in scope.

text: PART 3 – DEFENCE 3.1 DETECTION

text: Documented incident detection and analysis policy, Is there a policy and related procedures for addressing purpose, scope, roles and responsibilities incident detection and analysis in place? and coordination among all related entities, including clients. 1 Detection Is there a mechanism to ensure that the personnel is available and properly trained to Reports from related awareness and training exercises. detect, understand and report a security incident?

text: Is there a mechanism in place for tracking and Inventory of major past incidents detected and documenting information security incidents escalated, including all related information (cause, through an incident monitoring process? impact, order of actions taken).

text: 2 Logging Have the systems been configured in a way that the automatically registering and Systems, tools and procedures for Incident detection escalating of incidents, to the appropriate and analysis. people, is possible?

text: NOVEMBER 2018

text: Are the information security incidents investigated and are the relevant reports Up to date documentation of the incident detection addressed to the organization’s management policy and related procedures and systems created?

text: Logs Correlation and 3 Is the policy along with the procedures, Analysis Evidence of reviews of the incident detection policy and related to incident detection, updated in the related procedures and systems. regular intervals?

text: Do you conduct information security Evidence of past related cyber exercises conducted, exercises? including the dates they were conducted.

text: 3.2 COMPUTER SECURITY INCIDENT MANAGEMENT

text: Documented incident detection and analysis policy, Is there a policy, along with related processes addressing purpose, scope, roles and responsibilities or systems, in place for incident response? and coordination among all related entities, including clients.

text: Is there a mechanism to ensure that the incident response personnel is available and Records of incident response related training sessions Information System properly trained to manage and handle to the appropriate personnel. 1 Security Incident incidents? Response

text: Is the incident response policy and Systems, tools and procedures for Incident detection procedures reviewed following an incident? and analysis.

text: Are there any incident handling processes in Management commitment with the incident response place in accordance with industry standards policy, guidelines and procedures. and good practices?

text: Is there a register of past security incidents in Existence of reports related to the detection and place? escalation of past security incidents.

text: Is the policy and procedures related to Up to date documentation of the incident detection incident response reviewed regularly and policy and related procedures and systems updated accordingly? 2 Incident Report Are reviews performed to the incident Evidence of reviews of the incident detection policy and detection policy and to related procedures the related procedures and systems. and systems?

text: Does the organization perform cyber Evidence of past cyber exercises conducted, including exercises in a regular basis? the dates they were conducted.

text: Does the operator implement a service that enables it to take note, without undue delay, Communication with of information sent out by its national Evidence of communication logs with NCA and/ or 3 Competent Authorities competent authority concerning incidents, CSIRTs. and CSIRTs vulnerabilities, threats and relevant mappings?

text: NOVEMBER 2018

text: PART 4 – RESILIENCE

text: 4.1 CONTINUITY OF OPERATIONS

text: Has a business continuity strategy for the Formally documented service continuity strategy, critical services provided by the organization including recovery time objectives for key services and been implemented? processes.

text: Business Continuity Are contingency plans for the systems Contingency plans for critical systems, including clear Management supporting essential services implemented in steps and procedures for common threats, triggers for 1 the organization? activation, steps and recovery time objectives.

text: Are all personnel involved in the continuity operations properly trained in their roles and Records of individual training activities as well as postresponsibilities with regards to the exercise reports. information system?

text: Is the organization prepared for recovery and Measures in place for dealing with disasters, such as restoration of the services affected by failover sites in other regions, backups of critical data to following disasters? remote locations, etc.

text: Formally documented policy/procedures for deploying Is there a policy in place along with related disaster recovery capabilities, including list of natural Disaster Recovery 2 procedures for deploying disaster recovery and/or major disasters that could affect the services, and Management capabilities? a list of disaster recovery capabilities (either those available internally or provided by third par-ties).

text: Is all the personnel involved in the disaster Records of individual training activities. recovery operations?

text: 4.2 CRISIS MANAGEMENT

text: Formally documented crisis management policy which Is there a crisis management policy in place Crisis Management shall at least include critical CIS, information assets, roles 1 for managing and responding to IT security Organization and responsibilities in the event of an IT security incidents? incident.

text: Does the operator define in its security policy Crisis Management the processes for crisis management which 2 Formally documented crisis management procedure Process the organization will implement in case of IT security incidents?

text: NOVEMBER 2018

text: 3.2.2 Audit methodology for DSP According to the NISD, DSPs have to take appropriate and proportionate technical and organisational measures to manage the risk posed to the security of their network and information systems. Security measures shall ensure a homogenized level of security of network and information systems appropriate to the risk posed for DSP across the Union. According to

text: Article 16

text: (a) of the NIS Directive and its implementation act , the security of DSP network and information systems and of their physical environment shall include the following elements (Error! Reference source not found.): a) security of systems and facilities: Meaning the security of network and information systems and of their physical environment, indicatively including measures such as the systematic management of network and information systems, the physical and environmental security, the security of suppliers and the access controls to network and information systems; b) incident handling: As far as incident handling, the measures taken by the digital service providers shall include: i. detection processes and procedures maintained and tested; ii. processes and policies on reporting incidents; iii. an incident response process in accordance with established procedures; and iv. an assessment of the incident's severity, as well as collection and analysis of relevant information which may serve as evidence and support a continuous improvement process. c) business continuity management: Meaning the capability of an organisation to maintain or as appropriate restore the delivery of services at acceptable predefined levels following a disruptive incident; d) monitoring, auditing and testing: Meaning the appropriate measures, including the establishment and maintenance of policies on: i. the conducting of a planned sequence of observations to assess whether information systems maintain functionality as originally intended; ii. the inspection and verification to check whether a standard or set of guidelines is being followed; and iii. the process intended to reveal flaws in the security mechanisms of a network and information system that protect data and maintain functionality as intended. e) compliance with international standards: Meaning, European or internationally accepted standards and specifications relevant to the security of network and information systems, including existing national standards, may also be used. Guidelines on assessing DSP and OES compliance to the NISD security requirements

text: NOVEMBER 2018

text: Figure 4 NISD security elements for DSP

text: ENISA has already published a report with recommended security measures for DSP. The report categorizes measures, into security objectives with the aim to cover all information security domains and provides examples of implementation. The NIS Directive does not strictly dictate that NCA perform audits of DSP. Furthermore, DSP remain free to take technical and organisational measures they consider appropriate and proportionate to manage the risk. However, it is highly recommended that DSP are prepared to provide NCA with the appropriate evidence of the effective implementation of the required security elements as described above. To facilitate the audit process, Table 1 below presents a mapping of the five (5) elements dictated by the European Commission against the relevant (based on the EC Implementing Act) security measures suggested by ENISA. It also includes a list of questions per security measure and each question is accompanied by indicative pieces of evidence, which facilitate the NCA performing the audit.

text: IMPLEMENTING REGULATION SECURITY MEASURE QUESTIONS EVIDENCE ELEMENTS

text: Basic implementation of physical security Are there policies and measures for Physical and measures and environmental controls, such as physical and environmental security of Environmental Security door and cabinet locks, burglar alarm, fire Security of datacentres? alarms, fire extinguishers, CCTVs, etc. Systems and facilities Access Control to Are appropriate policies and measures  Access logs show unique identifiers for Network and for access to business resources being users and systems when granted or Information Systems established and maintained? denied access.

text: https://www.enisa.europa.eu/publications/minimum-security-measures-for-digital-service-providers/ https://www.enisa.europa.eu/publications/minimum-security-measures-for-digital-service-providers/

text: NOVEMBER 2018

text:  Overview of authentication and access

text: control methods for systems and users.

text:  Software and data in network and

text: information systems is protected using Is the integrity of the network, Integrity of network prevention, input controls, firewalls, platforms and services being components and encryption and signing. established, protected and information systems  Documentation about how the protection maintained? of software and data in network and

text: information system is implemented.

text: Does change management procedures Documentation of change management Change Management exist for key network and information procedures for critical systems. systems?

text:  An asset inventory or inventories,

text: containing critical assets, their owners Does asset management procedures and the dependency between assets. Asset Management and configurations, for key network  A configuration control inventory or and information systems, exist? inventories, containing configurations of critical systems.

text:  The access control, sharing, copying,

text: transmittal and distribution of Are there appropriate mechanisms, for confidential and restricted data are Security of Data at Rest the protection of the data at rest, defined. being established and maintained?  Data retention policy exists and is

text: complete.

text:  Incident detection systems and

text: procedures, such as Security Incident and

text: Event Management (SIEM) tools, security helpdesk for personnel and customers, Are there procedures for detecting and Security incident reports and advisories from Computer responding to security incidents detection & Response Emergency Response Teams (CERTs), appropriately? tools to spot anomalies, etc.  Inventory of major incidents and per

text: incident, impact, cause, actions taken,

text: Incident and lessons learnt.

text: Handling

text: Documented policy and procedures for communicating and reporting about incidents,

text: describing reasons/ motivations for Are there appropriate procedures for communicating or reporting (business reasons, Security incident 33 reporting and communicating about legal reasons etc.), the type of incidents in reporting security incidents? scope, the required content of

text: communications, notifications or reports, the channels to be used, and the roles responsible

text: for communicating, notifying and reporting.

text: This security objective is also present at ‘Business Continuity Management’ as per the documentation of procedures for internal

text: and external communications in the event of a disruption using a crisis communication plan.

text: NOVEMBER 2018

text: Contingency plans for critical systems, Are there contingency plans and including clear steps and procedures for Business continuity continuity strategy for ensuring common threats, triggers for activation, steps continuity of the services offered? and recovery time objectives.

text: Business Is there an appropriate disaster Measures are in place for dealing with Continuity Disaster recovery recovery capability for restoring the disasters, such as failover sites in other Management 34 capabilities offered services in a case of natural regions, backups of critical data to remote and/or major disasters? locations, etc.

text: Documented policy to protect critical supplies Are there appropriate measures to Security of Supporting such as electrical power, fuel, etc., describing ensure security of supporting utilities Utilities different types of supplies, and the security (e.g. electricity?) measures protecting the supplies.

text: Are there procedures and systems for Security of supplies is protected in a basic way, Monitoring and logging monitoring and logging of the offered for example, backup power and/ or backup services? fuel is available.

text:  Policy/ procedures for testing networks

text: and information systems, including when Are there procedures for testing key tests must be carried out, test plans, test System tests network and information systems cases, test report templates.

text: underpinning the offered services? Test reports of the network and information

text: systems, including tests after big changes or the introduction of new systems.

text:  Documented policy/ procedures for Are there procedures for performing security assessments and security testing. Security assessments security assessments of assets  Reports from past security scans and supporting digital services? security tests. Monitoring, Auditing and  Formally documented security policy, Testing Is there a policy for ensuring secure including networks and services in scope, Interface Security interfaces? critical assets supporting them, and the security objectives.

text:  Formally documented policy and

text: guidelines, to ensure that software security is maintained. Is there a policy for secure software Software Security  Evidence of the test results to secure development? development environments, including measures for protecting test data are maintained.

text: Documented policy for monitoring and logging, Is there a policy which ensures that the including minimum monitoring and logging Customer Monitoring software is developed in a manner requirements, retention period, and the and log access which respects security? overall objectives of storing monitoring customer data and logs.

text: This security objective is also present at ‘Monitoring, Auditing and Testing’ as per the establishment and maintenance of policies for testing and exercising backups and contingency plans, where needed in collaboration with third parties.

text: NOVEMBER 2018

text:  Updated policy/procedures for Does a policy for checking and enforcing compliance of internal compliance and auditing, review Compliance policies against the national and EU comments, and/or change logs. legal requirements and industry best Reports describing the result of compliance Compliance practices and standards, exist? monitoring. with (Inter)national  State of the art controls exist and are a Standards Are any standards which allow crucial aspect to mitigate security related customers to interface with other Interoperability and risks for customers. digital services and if needed to portability  Documentation about how the protection migrate to other provides offering and integrity of infrastructure & similar services? virtualization security is maintained.

text: Table 1. Audit Methodology for DSP

text: Post-audit actions for NCA The results of the audits can be used by the NCA for assessing the security posture not only of a particular operator but also of the sector overall or at a national level. This will assist the NCA in shaping general or sector specific information security policies. Furthermore, the audit output can inform the implementation of the required controls on operational and/ or technical level. Based on widely accepted good practices, as well as from input of multiple representatives of EU Member States to the Cooperation Group, the following set of post-audit actions are recommended to NCA:  correlate information security maturity per operator’s importance: The audit outputs in possession of a NCA, can be used to facilitate the creation of a benchmarking dashboard, signifying the information security maturity of OES across the Member State. This dashboard can then be used as a reference point for the assessment of other organizations to be audited by the same NCA and/ or serve as a mechanism for knowledge sharing across NCAs in all EU Member States;  provide continual improvement: The output of an information security audit exercise can also be used to create a baseline required level of security for OES across the jurisdiction of the NCA. The NCA can then use this baseline in order to draft action plans for organizations to monitor their continual improvement towards achieving the required information security baseline level;  ensure compliance with information security requirements: by creating a guideline on how to comply with them;  fine tune identification criteria for OES, in the sense that less ‘secure’ auditees might take higher priority in the national risk assessment; As far as the assurance of compliance with information security requirements is concerned, the audit procedure provided in Section 3.2 assures that the monitoring, auditing and testing includes the establishment and maintenance of policies on: (a) conducting of a planned sequence of observations or measurements to assess whether network and information systems are operating as intended; (b) inspection and verification to check whether a standard or set of guidelines is being followed, records are accurate, and efficiency and effectiveness targets are being met; and Guidelines on assessing DSP and OES compliance to the NISD security requirements

text: NOVEMBER 2018

text: (c) a process intended to reveal flaws in the security mechanisms of a network and information system that protect data and maintain functionality as intended. Such process shall include technical processes and personnel involved in the operation flow. Data gathered in the above context, shows that the protection of DSP and OES, in some EU Member States, is mainly regulated by specific national acts and methodologies. In some cases though OES and their industry associations may propose their own industry-specific security standards. Furthermore, specific regulations in certain business-sectors may define additional regulations on audits (e.g., regulations on Health, Financial, or Energy sector). The use of the audit output, as derived by the performed analysis, is depicted in the pie chart (Figure 5). How the collected information is used by NCA

text: ensure compliance with information security requirements

text: signify information security maturity

text: 4% 44%

text: fine tune identification criteria

text: for continual improvement purposes

text: other

text: Figure 5. Audit output utilization

text: 3.3.1 Post-audit issues to consider Evidence Collection Methodologies of NCA The collection of evidence is a crucial part of any audit. NCA mainly use four ways to collect evidence (in descending order of popularity):  follow the guidance of a national/ international standard;  follow the guidance of an underlying framework;  follow the requirements of a national regulation; and  base evidence collection on common methodologies/ good practices. Implementation of Risk-based Information Security approach by MS in the case of DSP Guidelines on assessing DSP and OES compliance to the NISD security requirements

text: NOVEMBER 2018

text: For DSPs, Member States shall ensure that the level of security of NIS is appropriate to the risk posed by following national and international standards as well as underlying frameworks, which are selected accordingly in each case. In certain cases, Member States shall proceed with the utilisation of self-assessment methodologies in the case of DSP. Self risk-assessment provisions of NCA for OES and DSP In the case of self risk-assessment provisions, the operators and providers are allowed to perform these selfassessments that will be subsequently audited against international standards and/ or sector-specific security standards. National and international standards as well as common methodologies and good practices provide the main guidance and reference point for the risk-assessment exercises conducted by NCA. Finally, it is important to point out that the establishment and management of a security supervision framework in the context of the NIS Directive, involves several challenges, such as the lack of resources and the rapid change of technology and standards. Nevertheless, the effective utilisation of the audit output is essential to the evaluation of the implementation of required controls on an operational and/ or technical level. Implementation Roadmap with corrective actions The end product of an audit is the report which outlines all observations/ recommendations/ non-conformities depending on the scope and approach of the conducted audit exercise. The audits conducted by the NCA in the context of the NIS Directive should also include an implementation roadmap for the auditee, with proposed corrective actions and an implementation timeframe. The auditee must accept responsibility for the implementation of the aforementioned corrective actions before the agreed timeframe. Guidelines on assessing DSP and OES compliance to the NISD security requirements

text: NOVEMBER 2018

text: 4. Mapping to Information Security Risk Assessment/Management Frameworks

text: Defined OES and DSPs must carefully assess the actual level of preparedness and the related security risks they face in their effort to:  achieve a minimum, adequate and converged level of security in their networks and information systems (Article 3 of the NIS Directive); and  implement and establish, monitor, maintain and continuously improve an appropriate level of security. In the context of auditing, the NCA might decide to follow an already known risk assessment/management framework to ensure compliance of the OES (and possibly DSP) to the requirements of the NISD. In this chapter we present and briefly analyse the most commonly used risk assessment/ management frameworks. We map these against useful criteria for auditing. In Annex A the reader can find more detailed information on these frameworks (tools, plans and methodologies). Analysis of Relevant (Self) Risk Assessment/Management Frameworks Indicative examples of the most widely used and accepted methodologies are listed below:  ISO/IEC 27001 framework for an ISMS;  NIST Special Publication 800-30 Rev. 1, Risk Management Guide for Information Technology Systems;  CRAMM risk management methodology;  OCTAVE, suite of tools, techniques and methods;  FAIR, international standards quantitative mode;  IRAM2, end-to-end approach for performing business-focused information risk assessments;  BSI 100-3, methodology for performing risk analyses;  MAGERIT, methodology for Risk Analysis and Management;  MEHARI, information risk analysis assessment and risk management method; and  MONARC, risk management methodology. These methodologies are the most notable in the field of information security for risk assessment and management. For the analysis of the risk assessment/ management methodologies, a set of key criteria was selected:  scope/ domain: defines the scope and the domain of applicability of the methodology;  focus (RA/ RM): defines the focus of the methodology, i.e. risk assessment, risk management or both;  control compliance-based: defines whether the risk is determined through a gap-analysis of the control requirements and the maturity with which they're implemented;  flexibility: refers to the flexibility of the methodology;  controlled Scaling: defines whether the methodology can be scaled to the specific needs of an organization in a centralized, pre-defined way;  controlled Tailoring: defines whether the methodology allows the replacement of specified controls with alternate controls in a centralized, pre-defined way;  complexity: refers to the complexity of the methodology; For more information regarding the standards, methodologies and tools, please see Annex A:. Guidelines on assessing DSP and OES compliance to the NISD security requirements

text: NOVEMBER 2018

text:  approach: refers to the approach of the methodology;  assessment Guidance: defines whether the methodology determines the risk through a gap-analysis of the control requirements and the maturity with which they're implemented;  tool Support: defines whether there is a tool which implements the methodology;  supports Third Party Assurance: defines whether the methodology provides an adequate mechanism for the sharing of reasonably accurate and consistent risk information amongst organizations;  year released/ last update: refers to the release year and the last update of the methodology; and  target: refers to the sector and/ or the types of entities that are in the scope of the methodology. In the next sub-sections, the methodologies based of these criteria are analysed and categorised into international and national self-assessment/management standards and frameworks. 4.1.1 International (Self) Risk Assessment/Management Standards & Frameworks The analysis of well-known selected international self-risk assessment/management standards and frameworks based on the aforementioned criteria is presented below (Table 2):

text: S/N CRITERIA ISO 27001 OCTAVE CRAMM FAIR IRAM2 NIST 800-30

text: SMEs and SMEs and SMEs and Large Large Large Large Large SMEs and Large Organizations/ Organizations/ Organizations/ Scope/ Organizations/ Organizations/ Organizations/ Covers 1 Covers the Covers the IT Covers the Domain Covers the Covers the the IT related risks of entire related risks entire ISMS of an entire an organization organization of an organization organization organization organization

text: Focus (RA/

text: 2 RA/ RM RA/ RM RA RA RA/ RM RM

text: RM)

text: Control 2.1 Compliance- Yes Yes Yes No Yes Yes Based

text: Relatively Relatively 3 Flexibility Flexible No Flexibility Flexible Relatively Flexible Flexible Flexible

text: Controlled 3.1 Yes Yes No Yes Yes Yes Scaling

text: Controlled 3.2 Yes Yes Yes Yes Yes Yes Tailoring

text: Medium Low High Low Low 4 Complexity Low Complexity Complexity Complexity Complexity Complexity Complexity

text: Quantitative Risk-based Assessment of Qualitative, approach by Asset and risks from a Risk-based IT-related 5 Approach information asset-centric filling control based business risks management security approach questionnaire perspective strategic tables

text: For more information regarding the international standards, please see Annex B:. Guidelines on assessing DSP and OES compliance to the NISD security requirements

text: NOVEMBER 2018

text: assessment and planning

text: Assessment 5.1 Yes Yes No No Yes Yes Guidance

text: Tool

text: 6 No Yes Yes Yes Yes N/A

text: Support

text: Supports 6.1 Third Party No Yes No No No No Assurance

text: Year

text: 7 released/ 2005/ 2013 1999/ 2005 1985/ 2011 2001/ 2009 2014/ 2014 2000/ 2012

text: last update

text: All NISD All NISD All NISD All NISD All NISD 8 Target All NISD Sectors Sectors Sectors Sectors Sectors Sectors

text: Table 2. Criteria for International self-risk assessment/management standards and frameworks

text: 4.1.2 National (Self) Risk Assessment/Management Standards & Frameworks The analysis of the selected national risk assessment/ management standards and frameworks based on the aforementioned criteria is presented below (Table 3)

text: S/N CRITERIA BSI 100-3 MAGERIT MEHARI MONARC

text: SMEs and Large SMEs and Large Medium and Large SMEs and Large Organizations/ Organizations/ Organizations/ 1 Scope Organizations/ Covers the Covers the ISMS of Covers the entire Covers the entire entire organization an organization organization organization

text: 2 Focus (RA/RM) RA/ RM RA RM RA, RM

text: Control Compliance- 2.1 Yes Yes Yes Yes Based

text: 3 Flexibility Relatively Flexible Relatively Flexible Relatively Flexible Relatively Flexible

text: 3.1 Controlled Scaling Yes Yes Yes Yes

text: 3.2 Controlled Tailoring Yes Yes No Yes

text: 4 Complexity Medium Complexity Low Complexity Low Complexity Low Complexity

text: Qualitative analysis Based on risk scenarios for Qualitative, Asset of risk based on 5 Approach Asset based information assets by context and control based formulas and and/ or business parameters

text: NOVEMBER 2018

text: Assessment 5.1 Yes Yes Yes Yes Guidance

text: ISO/IEC 13335 Integrated ISO/IEC 27001 ISO/IEC 17799 5.2 Compliance ISO/IEC 27001 ISO/IEC 27005 ISO/IEC 27000 series ISO/IEC 15408 Framework ISO/IEC 13335 ISO/IEC 27001

text: 6 Tool Support Yes Yes Yes Yes

text: Supports Third Party 6.1 No No No Yes Assurance

text: Year released/ last

text: 7 2004/ 2008 1997/ 2013 1998/ 2010 2016/ 2016

text: update

text: Information and Large and Medium 8 Target All Communication All Enterprises Organizations

text: Table 3. Criteria for International self-risk assessment/management standards and frameworks

text: 4.1.3 Analysis of Information Security Control Audit Frameworks The information security control standards and frameworks presented above are the most notable in the field of information security. The selected audit frameworks, used in different settings and sectors, are aimed at ensuring that OES and DSPs comply with certain requirements deriving from the NIS Directive. In this subsection we analyse and categorise the aforementioned standards/ frameworks (Table 4) based on the criteria defined below:  scope: the scope of the standard/ framework;  software Support: existence of software which implements the standard/ framework;  year released/ last update: dates of release year and the last update of the standard/ framework;  target: refers to the sector and/ or the types of entities that are in the scope of the standard/ framework;  national/ Corporate Level: refers to the level of applicability of the standard/ framework; and  domain of applicability: operators of essential services or digital service providers or both.

text: S/N CRITERIA ISO/IEC 27001 COBIT 5 ISA/IEC 62443

text: Medium and Large SMEs and Large Organizations/ Process- Medium and Large Organizations/ 1 Scope Organizations/ Covers the based governance and Covers the entire industrial ISMS of an organization management of enterprise organization IT

text: 2 Software Support No Yes No

text: 3 Year released/ Last update 2005/ 2013 1996/ 2013 2007/ 2010

text: 4 Target All All Industrial sector

text: https://www.enisa.europa.eu/publications/schemes-for-auditing-security-measures http://www.isaca.org/COBIT/Pages/default.aspx Guidelines on assessing DSP and OES compliance to the NISD security requirements

text: NOVEMBER 2018

text: 5 National/ Corporate Level Both Both Both

text: Domain of Applicability/ All NISD Sectors and All NISD Sectors and Energy, Health sectors and Rail 6 NISD Sector/ Subsector Subsectors Subsectors Transport subsector

text: Table 4. Analysis of selected Information Security Control Standards and Frameworks

text: The criteria applied in the above analysis allow to highlight the commonalities and differences of the selected audit frameworks. The selected criteria are impartial and unquantifiable, making the comparison of the audit frameworks a straightforward procedure. As far as the ISO 27001 is concerned, it is an information security standard, not tied to a particular national legislation and it is very popular among security practitioners worldwide. It allows each organization to implement its guidelines in a different manner and select a method that suits its needs. To achieve this it must be used in conjunction with a risk assessment methodology that implements it. COBIT 5 is a comprehensive framework, which provides a business process-based methodology. It provides a good way of aligning IT and business goals and bridges the gap between business control models and IT control models. Additionally, it provides common language for business executives to communicate with each other on objectives, goals and results. On the other hand, ISA 62443 is a series of standards, technical reports, and related information that designate processes for applying security measures to organizations in the industrial sector. More information on these standards can be found in Annex A. 4.1.4 Mapping Information Security Risk Assessment/Management Frameworks with Information Security Control frameworks. Risk assessment/management and information security audit exercises can be directly linked under specific conditions and/or factors. The outcome of a risk assessment/ management exercise could ideally be utilised by an OES, a DSP, an external auditor or even a NCA as input for the conduct of an information security audit. There are a number of factors that may correlate a risk assessment/ management standard to an information security audit standard (e.g. assessment approach, compliance with International Standards, etc.). This subsection of the report serves the purpose of enabling all stakeholders to proceed following a self-risk assessment to an audit, using the appropriate combination of standards that will provide the required added value to the organization. Table 5 illustrates a mapping between risk assessment/ management methodologies and audit frameworks, based on specific correlation factors. This mapping indicates risk assessment/ management methodologies, which can provide the input for facilitating the applicable audit procedures. The research focused on the structure and functionality of the methodologies, i.e. assets or processes, suggests a correlation that leads to better capitalization of risk assessment/ management and audit methodologies. The correlations are indicative and not restrictive. Macedo, Filipe, and Miguel Mira Da Silva. "Comparative study of information security risk assessment models." Instituto Superior Técnico, UniversidadeTécnica de Lisboa, Lisboa, Portugal (2012). Guidelines on assessing DSP and OES compliance to the NISD security requirements

text: NOVEMBER 2018

text: AUDIT FRAMEWORKS RISK ASSESSMENT METHODOLOGIES ISO/IEC 27001 COBIT 5 ISA/IEC 62443

text: ISO/IEC 27001    OCTAVE   -

text: CRAMM  - 

text: FAIR    IRAM2    NIST 800-30  -  BSI 100-3  - - MAGERIT  - - MEHARI  - - MONARC  - -

text: Table 5. Correlation of Information Security Self Risk Assessment/Management Frameworks with Information Security Control frameworks

text: Correlation Factors legend 1. Asset based approach 5. Risk based, IT-related risk management 2. Process based approach 6. Qualitative approach 3. Control based approach 7. Quantitative approach 4. Risk scenarios based approach 8. Compliance with ISO/IEC 27K series 9. Compliance with ISO/IEC 15408, 17799, 13335 The outcome of the above analysis indicates that specific self-risk assessment/ management methodologies are better combined with specific audit methodologies and procedures. This correlation enables exploiting the advantages derived from each methodology. For example, if the objective is to perform an ISO/IEC 27001 audit, then it is suggested to use a self-risk assessment/ methodology based on the same approach, e.g. asset based approach, or the way of performing the risk assessment or the required detail required for the purposes of the audit, e.g. qualitative or quantitative risk assessment. These correlations could be utilized by an OES, a DSP, an external auditor or even a NCA as input to the conduct of an information security audit. This analysis enables all stakeholders to proceed following a self-risk assessment to an audit, using the appropriate combination of standards that will provide the required added value to the organization. Guidelines on assessing DSP and OES compliance to the NISD security requirements

text: NOVEMBER 2018

text: 5. Outlook

text: In its entirety, this report aims to provide guidance to the NCA in auditing against the security requirements of the NIS Directive. This report presents the full-fledged set of options for the NCA to meet these provisions. However, the framework to follow lies on the discretion of the NCA. Moreover, this report raises awareness against the most important challenges the NCA will face when auditing and provides some recommendations on how to tackle them. It is expected that the majority of the Member States will implement their own sectorial security measures. However, we consider this report a common denominator of these approaches as it is based on widely accepted guidance provided by the NIS Cooperation group as well as the EC implementing acts for DSP. In the same line, Member States are expected to follow their own methodologies to assess the security measures of OES and DSP. We consider that the proposed list of questions is a good starting point for the assessment because is based on the most relevant and applicable information security standards. In addition, the proposed list of questions is outlined with a preventive mode of investigation in mind. Although, all these questions are still valid in the case of a post incident audit, the MS should add additional questions, which address the particularities of the specific incident under investigation. Each identified framework is different, with its own advantages and disadvantages. The MS has to determine which framework will apply. The optimal choice depends on many factors including the size and maturity of the sector, the resources and skills of the government authority and whether or not there are well-functioning industry initiatives. Finally, it is worthy to note that the assessment of information security is not a static point-in-time task but a continuous process. The NCA should iterate the evaluation process periodically while taking into account the challenges faced in the previous iterations, the technological changes, the new business scenarios and the new essential services offered. Guidelines on assessing DSP and OES compliance to the NISD security requirements

text: NOVEMBER 2018

text: Annex A: Risk Assessment and Risk Management Documentation

text: Relevant Information Security Control Standards and Frameworks A.1.1 ISO 27001 ISO 27001 is an information security standard (Figure 6. ISO 27001 audit frameworkFigure 6), part of the ISO/IEC 27000 family of standards and derived from BS 7799 Part 2, first published by the British Standards Institute in 1999. ISO/IEC 27001 was revised in 2013, bringing it into line with the other ISO management systems standards. It is published by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC) under the joint ISO and IEC subcommittee. ISO/IEC 27001 defines the development of an audit programme for the information security management system (ISMS) of the auditee. This programme contains all the relevant information of the audits regarding first-party audits, audits to be performed by clients and third-party audits, as appropriate. The third-party audit procedure is performed by using several checklists:  audit checklist/ observation form: contains specific items that are particular to the organizational unit to be audited;  systemic requirements: contains items relating to the requirements of ISO/IEC 27001:2013 and tailored to the auditee specifications each time; and  control requirements: contains controls depicted in Appendix A of ISO/IEC 27001:2013 and further described ISO/IEC 27002:201342. ISO/IEC 27001 specifies that once the audit procedure has been completed, the following steps should be taken so as the audit programme is deemed complete:  review and analysis of findings;  consolidation of all findings including grouping and tabulation;  classification of findings;  preparation of recommendation and audit report;  classification of findings; and  preparation of recommendation and audit report. Whereas the national competent authorities are responsible for identifying non-conformities, OES and DSP are responsible for resolving non-conformities. ISO 27001 provides a taxonomy of possible controls, whereas ISO 27002 provides recommended practices for the implementation of controls. It should be mentioned that ISO 27001 gives auditors a certain degree of freedom, in order to ensure effective and efficient implementation of an ISMS according to the specific information security requirements of the organization under question. Figure 1 below, depicts the overall set-up of ISO 27001 framework. https://www.iso.org/standard/54534.html https://www.iso.org/standard/54533.html Guidelines on assessing DSP and OES compliance to the NISD security requirements

text: NOVEMBER 2018

text: Figure 6. ISO 27001 audit framework

text: A.1.2 COBIT 5 COBIT 5 (Control Objectives for Information and Related Technology) is a framework aimed to provide an end-toend business view of the governance of enterprise IT, developed, maintained and distributed by ISACA - Information Systems Audit and Control Association. COBIT 5 (Figure 7) is a comprehensive framework for developing, implementing, monitoring and enhancing information technology governance and management practices by maintaining an equilibrium between realizing benefits and optimizing risk levels and resource use. COBIT 5 provides an effective approach of aligning IT and business goals and bridges the gap between business control models and IT control models while retaining a common language for business executives to communicate with each other about objectives, goals and results. It is based on five key principles for governance and management of enterprise IT. By bringing together those five principles, COBIT 5 enables information and related technology to be governed and managed in a holistic manner for the whole critical infrastructure, taking in to account the full end-to-end business and functional areas of responsibility, considering the IT-related interests of internal and external stakeholders. Additionally, COBIT 5 aligns with the latest relevant standards and frameworks used by organizations, such as COSO, ISO 31000 and ISO 38500. However, even if COBIT 5 is able to bridge the gap between business control models and IT asset-based RAs, it comes with the disadvantage of utilizing over-complicated concepts and structures that make COBIT difficult and time consuming to apply it as a risk assessment tool. https://www.enisa.europa.eu/publications/schemes-for-auditing-security-measures http://www.isaca.org/cobit/pages/default.aspx Guidelines on assessing DSP and OES compliance to the NISD security requirements

text: NOVEMBER 2018

text: As defined in COBIT 5, each phase in the audit process is subsequently divided into key steps to plan, define, perform and report the results of the engagement, as shown in Figure 2 below.

text: Figure 7. COBIT5 Audit Procedure

text: A.1.3 ISA/IEC 62443 ISA/IEC 62443 is a series of standards, technical reports, and related information that designate processes for applying security measures to industrial zones and is one of the most comprehensive Industrial Automation and Control System Security Standards. This guidance applies to end-users (i.e. asset owner), system integrators, security practitioners, and control systems manufacturers responsible for manufacturing, designing, implementing, or managing industrial automation and control systems. The ISA/IEC-62443 series are organized into four categories, i.e. General, Policies and Procedures, System, and Component . The standards of the ISA/IEC-62443 which are deemed critical for the scope of this research are analysed and depicted in Figure 3, including but not limited to:  ISA-62443-1-3: System Security Compliance Metrics;  ISA-62443-2-1: Industrial automation and control system security management system;  ISA-62443-3-2: (99.03.02) Security for industrial automation and control systems; and  ISA-62443-3-3: (IEC 62443-3-3) System Security Requirements and Security Assurance Levels. The ISA/IEC 62443 series of standards propose and introduce the novel concepts of “zones” and “conduits” as a way to divide and segregate the diverse sub-systems in a control system. A zone is designated as a combination of physical or logical assets that share common security requirements related to factors such as consequence and criticality. Additional security measures, such as implementing additional technology or policies, are required if the security level capability of the equipment is deemed no equal to or higher than the requirement level. ISA/IEC 62443 also provides a framework for industries to achieve and maintain security improvements through a life cycle that integrates design, implementation, monitoring and continuous improvement. The frameworks offers https://www.isaca.org/COBIT/Documents/IS-auditing-creating-audit-programs_whp_eng_0316.pdf ISA, Safe and Secure: Multiple Challenges, One Solution, 2014. ANSI/ISA-62443-1-1 (99.01.01)-2007 Security for Industrial Automation and Control Systems Part 1: Terminology, Concepts, and Models: https://www.isa.org/store/products/product-detail/?productId=116720, Accessed on 25/05/2018, 2018. Guidelines on assessing DSP and OES compliance to the NISD security requirements

text: NOVEMBER 2018

text: industrial security solutions and the ability to relevant stakeholders to mitigate information security threats that arise within the segmenting control networks for zones and conduits. As of today, no ISA/IEC 62443 (Figure 8) risk assessment/ management or information security certification exists. ISA is currently working on a modified ISO/IEC 27005 risk assessment/ management process. Furthermore, related audit and evaluation processes are currently being developed, with the goal to provide a way for organizations to assess their current information security posture against the ISA/IEC 62443 family of standards. This assessment will be based on controls mainly deriving from related NIST (e.g. 800-53, 800-60, and 800-70) and FIPS (e.g. 199, 200) publications.

text: Figure 8. ISA/IEC 62443 Phases

text: NOVEMBER 2018

text: Related information regarding ISA 62443 is not available, as currently no audit/ certification and/ or RA/RM process exists. Currently, and until proprietary ISA 62443 audit standard is published, third-party assurance standards are proposed by ISA. More specifically: In regards to product assurance  ISO/ IEC 15408;  ISO/ IEC 19790 (Similar to NIST FIPS 140-2);  ISO/ IEC TR/19791. In regards to Process assurance  ISO/ IEC 21827;  ISO/ IEC 17799;  COBIT5;  Draft ISA S99 standards, including concepts and process guidance. In regards to environmental assurance  ISO 9000 series. Risk Assessment and Risk Management Methodologies and Tools Risk Assessment and Risk Management is the focus of the desktop research. The final results of this research are presented below (Table 6). Some key columns in the presented table are the following:  Target: refers to the sector and/or the types of entities that are in the scope of every document in the table (e.g. federal agencies, ICS, Financial Institutions etc.);  Country: refers to the country/ies to which the methodology is mainly applied;  Type: This column refers to the type of documents included in the table (i.e. methodology, standard, guideline, framework, tool);  Category: distinguishes if document in the table refers to Risk Management, Risk Assessment or to both. Guidelines on assessing DSP and OES compliance to the NISD security requirements

text: NOVEMBER 2018

text: TYPE (METHOD, RELEASED CATEGORY STANDARD, S/N NAME ISSUER/VENDOR LINK COUNTRY TARGET /VERSION (RA,RM) GUIDELINE, FRAMEWORK, TOOL)

text: ISO 27005 - Information The International technology -- Security 1 Organization for http://www.iso.org 2011 RM Standard International All techniques -- Information Standardization security risk management

text: The International ISO 31010 - Risk management 2 Organization for http://www.iso.org 2009 RA,RM Standard International All -- Risk assessment techniques Standardization

text: International ISO 31000 - Risk management 3 Organisation for http://www.iso.org 2018 RM Standard International All -- Principles and guidelines Standardisation

text: https://cobitonline.i 4 COBIT 5 ISACA 2012 RM Framework International All saca.org

text: Risk IT Framework for http://www.isaca.o 5 Management of IT Related ISACA 2009 RM Framework International All rg Business Risks

text: SARA - Simple to Apply Risk Information Security http://www.securit 6 1993 RA Method International All Analysis Forum - ISF yforum.org

text: Information Security SPRINT – Simplified Process Forum - ISF http://www.citicus. 7 1997 RA Method International All for Risk IdeNTification com European Security Forum

text: NIST SP800-30 http://nvlpubs.nist. 2012/Revi 8 NIST RA Guideline USA All Guide for Conducting Risk gov sion 1

text: Assessments

text: NOVEMBER 2018

text: NIST SP 800-37 – Guide for Applying the Risk 2010/Revi

text: Management Framework to sion 1 http://nvlpubs.nist. 9 Federal NIST (Updated RM Guideline USA All gov June Information Systems: A 2014)

text: Security Life Cycle Approach

text: NIST SP 800-39 Managing

text: Information Security Risk http://nvlpubs.nist. 10 NIST 2011 RM Guideline USA All Organization, Mission, and gov

text: Information System View

text: Ministerio de https://administraci AdministracionesPúblicas ICT 11 MAGERIT onelectronica.gob.e 2012 v3 RA Method Spain (Spanish Ministry for organizations s Public Administrations)

text: Central Information 1995 v1 https://www.ssi.go 12 EBIOS Systems Security Division RA, RM Method and Tool France All uv.fr (France) 2003 v2

text: 1987 Central Computer and 13 CRAMM Telecommunications - 2003 v5 RA Method UK All

text: Agency (CCTA) (the

text: latest)

text: BSI-Standard 100-3: Risk German Federal Office for https://www.bsi.bu 2008/vers 14 Analysis based on IT- RA, RM Standard and Method Germany All Information Security (BSI) nd.de ion 2.5 Grundschutz

text: https://www.iso.or 15 AS/NZS ISO 31000:2009 Standards Australia 2009 RM Standard Australia All g

text: NOVEMBER 2018

text: Risk management – Principles and Guidelines

text: Information Risk https://www.ncsc.g 16 Management: HMG IA CESG 2015 RM Standard UK All ov.uk Standard Numbers 1 & 2

text: AWWA J100-10(R13) Risk and Resilience Management of American Water Works https://www.awwa. 17 2013 RA, RM Standard USA Water Water and Wastewater Association org Systems

text: ASME Innovative Risk Analysis and Technologies Institute. Management for Critical Asset Protection (RAMCAP) American Water Works standard for risk and Association. https://searchwork 18 2012 RA, RM Standard USA Water resilience management of s.stanford.edu water and wastewater American National systems using the ASME-ITI Standards Institute.

text: RAMCAP Plus methodology ebrary, Inc.

text: Selex ES Government http://usa.selex- 19 MIGRA 2013 RA, RM Method and Tool Italy agencies, large AMTEC / comms.com vErlagDatamatS.p.A companies

text: ISAMM - Information Security Telindus N.V. (now 20 Assessment and Monitoring acquired by proximus - 2002 RA Method Belgium All Method Group)

text: Dutch ministry of internal 1996 (has The 21 Dutch A&K Analysis n/a not been RA Method affairs Netherlands updated

text: NOVEMBER 2018

text: since that time)

text: Threat Assessment & Remediation https://www.mitre. Information 22 MITRE 2011 RA Method USA org Infrastructures Analysis (TARA)

text: Risk Assessment Tools and Federal Deposit https://www.fdic.g 23 Practices for Information 1999 RA Guideline USA Finance Insurance Corporation ov System Security

text: Microsoft’s Security Risk https://technet.mic 2006/ 24 Microsoft RA Guideline International All Management Guide rosoft.com v1.2

text: Consultation Paper

text: Guidelines on ICT Risk European Banking https://www.eba.e 25 Assessment under the 2016 RA Guideline Europe Finance Authority (EBA) uropa.eu Supervisory Review and Evaluation process (SREP)

text: Security Assessment Guidelines for Financial https://www.sans.o 26 SANS 2002 RA Guideline USA Finance rg Institutions

text: U.S. Department of Energy (DOE), in Electricity Subsector collaboration with the Informationsecurity 27 National Institute of https://energy.gov 2012 RM Guideline USA Energy

text: Risk Management Process Standards and Technology (NIST) and the North American

text: NOVEMBER 2018

text: Electric Reliability Corporation

text: (NERC)

text: 28 RVA Model DEMA http://brs.dk 2006 RA Guideline Danish All

text: All sectors of the Dutch 29 DHM Security Management http://www.dhm.nl Netherlands critical Infrastructure

text: Good Practice Guide National Technical http://www.kcgaud United 30 Information Risk Authority for Information 2012 RM Guideline All it.co.uk kingdom Management Assurance

text: Facilitated Risk Analysis http://www.ittoday 31 Auerbach Publications 2000 RA Method All Process (FRAP) .info

text: RMI Factor Analysis of http://www.fairinsti 32 Developed by Jack A. RA Framework All Information Risk (FAIR) tute.org Jone

text: Risk Management Framework 33 NIST http://csrc.nist.gov 2002 RM Framework USA All (RMF)

text: 2009 (basic All European version) Threat, Vulnerability And Risk Telecommunication http://www.ttcn- 34 RA Method Europe Assessment (TVRA) Standardization Institute 3.org 2010 Also in (ETSI) (advanced Transport version)

text: NOVEMBER 2018

text: The Overview of IT Security Communications Security https://www.cse- 35 Risk Management: A Lifecycle Establishment Canada 2012 RM Guideline Canada All cst.gc.ca Approach (ITSG-33) (CSEC)

text: Good practices for Risk The 36 NAVI - 2009 Analysis Netherlands

text: The 37 NRB https://www.nctv.n 2007 l Netherlands

text: European Risk Assessment https://publications 2006- 38 Methodology project - TNO RA Method Europe All .tno.nl 2007 EURAM

text: CANSO – the

text: Civil Air

text: Navigation

text: Services CANSO – the Civil Air CANSO Cyber security and https://www.canso. Organisation 39 Navigation Services 2014 RA, RM Guideline Air transport Risk Assessment Guide org – is the global Organisation voice of air

text: traffic

text: management

text: worldwide.

text: Good Practice Guide - https://scadahacker 40 CPNI RM Guideline UK ICS Understand the Business Risk .com

text: Good Practice Guide - https://scadahacker 41 CPNI RM Guideline UK ICS Manage Third Party Risk .com

text: NOVEMBER 2018

text: Reducing Operational Risk in https://scadahacker 42 EMC 2013 RM Guideline USA Oil & Gas Oil and Gas Industry .com

text: Carnegie Mellon 1999/ https://resources.se Large 43 OCTAVE University Software Version RA,RM Method USA i.cmu.edu organizations Engineering Institut 1.0

text: Small and

text: Carnegie Mellon 2003 v 0.9 medium http://resources.sei 44 Octave-S University, SEI (Software RA,RM Method USA organizations .cmu.edu Engineering Institute) 2005 v1.0 (with 100

text: people or less)

text: Carnegie Mellon http://resources.sei 45 Octave Allegro University, SEI (Software 2007 v1.0 RA,RM Method USA All .cmu.edu Engineering Institute)

text: 1996 Big and https://clusif.fr/me 46 MEHARI CLUSIF RA, RM Method France medium size hari 2010 enterprises

text: Information Risk Analysis Information Security https://www.securi All

text: 47 2014 RA,RM Method UK Methodologies 2 (IRAM2) Forum tyforum.org

text: Committee of Sponsoring COSO – Enterprise Risk https://www.coso.o 48 Organisations of the 2004 RM Framework USA All Management rg Treadway Commission

text: Guidance on Risk Analysis Office for Civil Rights https://www.hhs.go 49 Requirements under the 2010 RA Method USA health (OCR) v HIPAA Security Rule

text: NOVEMBER 2018

text: HITRUST Common Security https://hitrustallian Version 50 HITRUST Alliance RM Framework USA Health Framework 2012 ce.net 8.1

text: http://shop.bsigrou 51 BS 31100:2011 British Standards 2011 RM Guideline International All p.com

text: AIRMIC (Association of Insurance and Risk Managers)

text: Risk Management Standard, ALARM (National Forum https://www.their 52 2002 RA, RM Guideline International All AIRMIC, ALARM, IRM: 2002 for risk management in m.org the public sector)

text: IRM (Institute of Risk Management)

text: Federal Deposit Insurance https://www.fdic.g 53 FFIEC FIL‐81‐2005 2005 RM Guideline USA Finance Corporation (FDIC) ov

text: 2000 (original American Petroleum https://global.ihs.co release) 54 API RP 581 RA,RM Method International Oil & Gas Institute (API) m rd 2016 ( 3 version)

text: st Petroleum and American Petroleum https://global.ihs.co 2013 (1 55 ANSI/API STD 780 RA Method International Petrochemical Institute (API) m edition) Industries

text: The International nd https://www.iso.or 2009 (3 56 ISO/IEC 15408 Organization for RA,RM Standard International All g edition) Standardization

text: NOVEMBER 2018

text: Cyber world Awareness

text: and Security https://www.cases.l 57 MONARC 2016 RA,RM Method Luxembourg All Enhancement Services u

text: (CASES)

text: NHS Information Risk http://www.southe 58 NHS Digital 2015 RA,RM Framework UK Health Management rnhealth.nhs.uk

text: Cyber security supply chain https://www.cybers The 59 Shell and Tennet 2015 RM Method Energy risk analysis ecurityraad.nl Netherlands

text: Finnish Ministry of the http://julkaisut.valti 60 National Risk Assessment 2016 RA Method Finland All Interior oneuvosto.fi

text: Security Risk Assessment Gas Infrastructure Europe 61 http://www.gie.eu 2014 RA, RM Method International Gas Methodology (GIE)

text: EAR/PILAR has been

text: partly funded by the http://www.pilar- 2017/vers Tool that supports 62 EAR/PILAR Centro Criptológico RA, RM Spain All tools.com ion 5.5 Magerit Nacional (Spanish

text: National Security Agency)

text: http://www.vigilant 63 vsRisk Vigilant Software 2007 RA Tool UK All software.co.uk

text: COBRA (Consultative, C & A Systems Security http://www.riskwor 64 Objective and Bi-functional 1991 RA, RM Tool UK All Ltd ld.net Risk Analysis)

text: NOVEMBER 2018

text: (introduce

text: d) Cyber Resilience Review Department of homeland https://www.us- 65 RM Tool USA All (CRR) Security cert.gov 2014

text: (major

text: revision)

text: American Water Works https://www.awwa. 2014 v1.0 66 Cyber security Tool RA/RM Tool USA Water Association org 2017 v2.0

text: 2016 https://verinice.co 67 Verinice SerNet GmbH (version RM Tool Germany All m 1.13)

text: Federal Financial FFIEC Cyber security https://www.ffiec.g 68 Institutions Examination 2015 RA Tool USA Finance Assessment Tool ov Council

text: Department of Homeland

text: Security (DHS)

text: CSET – Cyber security National Cyber security https://ics-cert.us- Version 69 RA Tool USA ICS Evaluation Tool and Communications cert.gov 8.0

text: Integration Centre

text: (NCCIC)

text: EBA Risk Assessment European Banking https://www.eba.e 70 2016 RA Tool Europe Finance Questionnaire Authority (EBA) uropa.eu

text: NSRAM (Network Security The James Madison http://www.jmu.ed 71 2004 RA Tool USA All Risk University u

text: NOVEMBER 2018

text: Assessment Modelling) (JMU) CIPP research team

text: Cyber Infrastructure Survey SECIR/Stakeholder Risk http://tampabay.iss 72 RA Tool USA All Tool (C-IST) Assessment & Mitigation a.org

text: Supply Chain Risk SECIR/Stakeholder Risk http://tampabay.iss 73 RM Tool USA All Management Review Assessment & Mitigation a.org

text: ICS-CERT Design Architecture http://tampabay.iss 74 NCCIC/ICS-CERT RA Tool USA All Review (DAR) a.org

text: ICS Network Architecture http://tampabay.iss 75 Verification and Validation NCCIC/ICS-CERT RA Tool USA All a.org (NAVV)

text: Network Risk and http://tampabay.iss 76 NCCIC/NCATS RA Tool USA All Vulnerability Assessment RVA a.org

text: Cyber Hygiene (CH) http://tampabay.iss 77 NCCIC/NCATS RA Tool USA All Evaluation a.org

text: Control Compliance https://www.syman 78 Symantec Corporation RA/RM Tool USA Data Centres Suite(CCS) 11 Risk Manager tec.com

text: http://www.counte January 79 Countermeasures Alion RA Tool USA All rmeasures.com 2006 - v8

text: SIGEA Sistemas de

text: 80 KRiO Protección de la https://www.krio.es June 2015 RA/RM Tool Spain All

text: información

text: http://www.modul 81 Modulo Risk Manager Modulo Security 5.0 RM Tool Brazil All o.com version –

text: NOVEMBER 2018

text: August

text: http://www.riskwat 2002 - 82 Riskwatch RiskWatch RM Tool USA All ch.com version 9

text: https://www.riskm Stiki – Information v5.1, May 83 RM Studio anagementstudio.c RM Tool Iceland All Security 2016 om

text: Smart Information Security CYMSOFT BILISIM http://www.cymsof R1 March 84 RM Tool Turkey All Management System (SISMS) TEKNOLOJILERI t.com 2011

text: https://www.itrust.l 85 TRICK Service itrust consulting s.àr.l. RM Tool Luxembourg All u

text: ACUITY RISK United 86 Acuity Stream www.acuityrm.com RM Tool All MANAGEMENT LLP Kingdom

text: Table 6. Risk Assessment and Risk Management Methodologies and Tools

text: NOVEMBER 2018

text: Annex B: International and National (Self) Risk Assessment/Management Standards and Frameworks

text: International Self-Risk Assessment/Management Standards and Frameworks B.1.1 ISO/IEC 27001 ISO/IEC 27001 is the international standard for information security management systems (ISMS). The ISO/IEC 27001 Standard provides a methodology which can assist OES and DSP to achieve all of their regulatory compliance objectives concerning the NIS Directive by implementing specific controls. Controls recommended by ISO/IEC 27001 are not only technological solutions but also cover people and organizational processes. There are 114 controls in Annex A covering the breadth of information security management, including areas such as physical access control, security staff awareness programmes, procedures for monitoring threats and incident management processes. The risk assessment process established by ISO/IEC 27001 follows the below procedure:  establish and maintain certain information security risk criteria;  ensure that repeated risk assessments “produce consistent, valid and comparable results;  identify risks associated with the loss of confidentiality, integrity and availability for information within the scope of the information security management system;  identify the owners of those risks; and  analyse and evaluate information security risks according to certain criteria. An ISMS is based on the outcomes of a risk assessment based on the ISO/IEC 27001. OES and DSP will need to produce a set of controls so as to minimize the identified risks resulting from the aforementioned procedure. B.1.2 OCTAVE OCTAVE (Operationally Critical Threat, Asset, and Vulnerability Evaluation) was developed by the Computer Emergency Response Team within the Software Engineering Institute. The goal of the OCTAVE suite of tools, techniques and methods is to allow “risk-based information security strategic assessment and planning” . OCTAVE gives the opportunity to small teams across business units and IT work together to address the security needs of the organization and face the security challenges. It moves an organization towards an operational risk-based view of security and addresses technology in a business context. The methodology is divided in three explicit methods. The primary OCTAVE method forms the basis for the OCTAVE foundation of knowledge. OCTAVE-S is intended for small and medium sized organizations. The main difference with the basic method is that the necessary knowledge is assumed to be known in advance by the analysis group, so the first step of collecting knowledge is omitted. Lastly, OCTAVE-Allegro offers a faster but more limited approach that focuses on information assets. This approach covers only four simplified steps: development of risk measurement criteria, creation of profiles for each critical information asset, identification of threats to these assets and finally, analysis of resulting risks in order to develop mitigation approaches. https://www.iso.org/standard/54534.html CERT (Computer Emergency Response Team). OCTAVE® (Operationally Critical Threat, Asset, and Vulnerability Evaluation). http://www.cert.org/resilience/products-services/octave/index.cfm Guidelines on assessing DSP and OES compliance to the NISD security requirements

text: NOVEMBER 2018

text: B.1.3 CRAMM CRAMM (CCTA Risk Analysis and Management Method) was developed in 1987 by a British government organization, the Central Communication and Telecommunication Agency (CCTA), now renamed into Cabinet Office. CRAMM can be used for all kinds of organizations, but it is especially intended for large organizations, like government bodies and industry . It is in use by NATO and corporations working actively on information security. CRAMM helps in justification of security investments by demonstrating need for action at management level, based on quantifiable results and countermeasures from organization. CRAMM attempts a qualitative approach that focuses on assets. It provides 10 specific and predefined asset tables which classify the assets in categories. Those tables support identification and valuation of assets . Therefore, each asset can be classified into a specific category, each with a predefined list of known vulnerabilities and threats that can exploit them. After the completion of identification and valuation of the assets, the provided dedicated tool automatically suggests a set of all possible countermeasures. However, the usefulness of the method is largely dependent on the tool which implements it. B.1.4 FAIR FAIR (Factor Analysis of Information Risk) is an international standard quantitative model for information security and operational risk and provides (a) a model for understanding, analysing and quantifying information risk in financial terms; and (b) a foundation for developing a robust approach to information risk management. The FAIR framework defines the necessary building blocks for implementing effective risk management programs. FAIR is an ontology of the factors that contribute to risk and how they affect each other. It is primarily concerned with establishing accurate probabilities for the frequency and magnitude of data loss events. B.1.5 IRAM2 IRAM2 (Information Risk Assessment Methodology 2) is a complete end-to-end approach for performing business-focused information risk assessments. IRAM2 provides the following:  simple, practical, yet rigorous risk assessment approach;  focus on the business perspective;  extended coverage of risks; and  engagement with key stakeholders. IRAM2 is supported by four IRAM2 Assistants, each accompanied by a practitioner guide, that help automate one or more phases of the methodology. B.1.6 NIST 800-30 NIST Special Publication 800-30 is a foundation pillar for developing an effective and adequate risk management program. NIST 800-30 provides both the definitions and the practical guidance required for assessing and mitigating risks identified within IT systems. Additionally, it provides information on the selection of practical and profitable security controls that can be utilized to mitigate risk for the better protection of vital information and European Network and Information Security Agency. Inventory of risk management/risk assessment methods. http://rm-inv.enisa.europa.eu/methods S.H. Houmb. Decision Support for Choice of Security Solution: The Aspect-Oriented Risk Driven Development (AORDD) Framework. PhD thesis, Norwegian University of Science and Technology, Trondheim, 2007. https://www.fairinstitute.org/fair-risk-management https://www.securityforum.org/tool/information-risk-assessment-methodology-iram2/ http://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-30r1.pdf Guidelines on assessing DSP and OES compliance to the NISD security requirements

text: NOVEMBER 2018

text: the IT systems that process this information. It is composed by well-defined and sequentially steps in order to achieve the aforementioned goals, as depicted below:  system characterization followed by thread and vulnerability identification;  control analysis and likelihood determination;  impact analysis and risk determination; and  control recommendations and documentation of the results. Each of the above steps produces an output which in turn feeds the next step of the chain. With respect to the aforementioned, this methodology moves the organization towards to better managing IT-related risks. National Self-Risk Assessment/Management Standards and Frameworks B.2.1 BSI-100-3 BSI 100-3 is a methodology for performing risk analyses to additive an existing IT-Grundschutz security concept. This methodology indicates the way of using the threats listed in the IT-Grundschutz Catalogues [GSK] to carry out a bridged analysis of risks for information processing. The methodology is required to be carried out step by step as follows:  preparing the threat summary: produce a summary of the threats to which the target objects under review are subject;  determination of additional threats: for the target objects under review there are, in some circumstances, additional isolated threats over and above those foreseen in the IT-Grundschutz Model that must be taken into consideration;  threat assessment: check whether the security measures already implemented or at least planned in the security concept provide adequate protection for each target object and threat;  handling risks: decide on how to deal with the remaining threats;  consolidation of the security concept: check the implemented security measures for each target object using specific criteria; and  feedback to the security process: Once the security concept has been consolidated, the security process, as specified in the IT-Grundschutz Methodology, can be resumed. B.2.2 MAGERIT MAGERIT (Methodology for Information Systems Risk Analysis and Management) is an open methodology for Risk Analysis and Management, developed by the Spanish Ministry of Public Administrations, offered as a framework and guide to the Public Administration. Given its open nature it is also used outside the Administration. MAGERIT was developed in response to the perception that the government and, in general, the whole society increasingly depends on information technologies, that entail certain risks that must be sensibly managed with proper measures, for achieving its service objectives. MAGERIT seeks to achieve the following objectives: (1) increase the security awareness of those responsible for information systems, (2) offer a systematic and structured method for analysing risks, (3) help in describing and selecting the appropriate measures and controls for treating the risks and (4) prepare the organization for https://www.bsi.bund.de/SharedDocs/Downloads/DE/BSI/Publikationen/ITGrundschutzstandards/BSI- Standard_1003.pdf?__blob=publicationFile&v=1 Portuguese Ministry of Public Administration. MAGERIT - version 3.0. Methodology for Information Systems Risk Analysis and Management, volume Book 1 - The Method. MINISTERIO DE ADMINISTRACIONES PÚBLICAS, 2014. Guidelines on assessing DSP and OES compliance to the NISD security requirements

text: NOVEMBER 2018

text: evaluation, audit, certification or accreditation processes, as relevant in each case. MAGERIT method has the ability to project the risk assessment process at management, operational and technical levels. It is supported by technical documents describing elements and criteria and provides regulatory compliance and compliance to IT standards, such as ISO/IEC 27001:2005, ISO/IEC 15408:2005, ISO/IEC 17799:2005 and ISO/IEC 13335:2004. Furthermore, MAGERIT can be applied as an independent risk assessment method. B.2.3 MEHARI MEHARI (Method for Harmonized Analysis of Risk) is a free, open-source information risk analysis assessment and risk management method, developed, maintained and distributed by CLUSIF - Club de la Sécurité de l’Information Français, the French association of information security professionals. MEHARI method bases its analysis on formulas and parameters. This means that MEHARI can only be used in conjunction with dedicated tools. It provides a complete risk management model, description of modular components and processes. It also provides the means to enable classification of assets, the likelihood of threats and measurement of the vulnerabilities through audit. Additionally, it analyses a generic set of risk situations and provides seriousness levels for each risk scenario. Finally, it allows an optimal selection of corrective actions in order to provide risk treatment and gives additional compliance scoring of the organization to ISO/IEC 27001:2005 controls and the ISMS process. There is a given compliance of the product with international regulations and with most of ISO information security standards. Furthermore, this method provides several indicators (e.g. Efficiency, Resiliency, Continuity aspects) in order to measure the IS maturity level. However, MEHARI risk assessment and risk management methods require in any case a good knowledge of the business internals and the handling of risk. B.2.4 MONARC MONARC uses an iterative method which enables the thorough implementation of risk management. This approach, as recommended by ISO 27005, enables the focusing on critical issues, followed by successive iterations to augment the target or further liquidate it to restrict additional risks and therefore to cover more technical aspects. The advantage of MONARC methodology lies in the capitalisation of risk analyses already performed in similar business contexts. In order to achieve its goals, MONARC consists of four (4) well-defined phases as defined below:  context establishment: take stock of the context, challenges and priorities of the company or organization that wishes to analyse its risks;  context modelling: provision of details and formalisation of to the identified assets in a diagram that displays their interdependencies.  evaluation and treatment of risks: quantification of threats, vulnerabilities and impacts to assess the risks; and  implementation and monitoring: ongoing management phase with security monitoring and recurring control of security measures. CLUSIF (Club de la Sécurité de l’Information Français). Mehari 2010: Risk analysis and treatment guide. http://www.clusif.asso.fr/fr/production/ouvrages/pdf/MEHARI-2010-Principles-Specifications.pdf, 2010. https://www.cases.lu/monarc.html Guidelines on assessing DSP and OES compliance to the NISD security requirements

text: NOVEMBER 2018

text: Annex C: Terminology and Abbreviations

text: For brevity reasons the following terms and abbreviations are used throughout the report:  OES: Operators of Essential Services.  DSP: Digital Service Providers.  NCA: National Competent Authority.  IS: Information Systems.  CIS: Critical Information Systems.  EU MS: European Union Member States.  ISO: International Organization for Standardization.  NIST: National Institute of Standards and Technology.  ISA: International Society of Automation.  IEC: International Electrotechnical Commission.  ICT: Information and Communication Technologies.

text: ENISA

text: European Union Agency for Network and Information Security 1 Vasilissis Sofias Marousi 151 24, Attiki, Greece

text: Heraklion Office

text: Science and Technology Park of Crete (ITE) Vassilika Vouton, 700 13, Heraklion, Greece TP-04-18-691-EN-N 1 Vasilissis Sofias Str, Maroussi 151 24, Attiki, Greece ISBN: 978-92-9204-264-6, Tel: +30 28 14 40 9710 DOI 10.2824/265743 info@enisa.europa.eu www.enisa.europa.eu