text: SEPTEMBER 2022

text: * Rapporteur of Ad-Hoc Working Group on the European Cybersecurity Skills Framework

text: SEPTEMBER 2022

text: SEPTEMBER 2022

text: SEPTEMBER 2022

text: SEPTEMBER 2022

text: SEPTEMBER 2022

text: SEPTEMBER 2022

text: SEPTEMBER 2022

text: SEPTEMBER 2022

text: SEPTEMBER 2022

text: SEPTEMBER 2022

text: SEPTEMBER 2022

text: SEPTEMBER 2022

text: SEPTEMBER 2022

text: SEPTEMBER 2022

text: SEPTEMBER 2022

text: SEPTEMBER 2022

text: SEPTEMBER 2022

text: SEPTEMBER 2022

text: SEPTEMBER 2022

text: SEPTEMBER 2022

text: SEPTEMBER 2022

text: SEPTEMBER 2022

text: SEPTEMBER 2022

text: SEPTEMBER 2022

identifier: European Cybersecurity Skills Framework Role Profiles

amnesord:
Skills and competences (for companies)
Skills and competences
Skills development

publisher: Europeiska unionens cybersäkerhetsbyrå

sprak: en

title: European Cybersecurity Skills Framework Role Profiles

serie: rapporter

text: ECSF

type: rubrik

text: EUROPEAN CYBERSECURITY SKILLS FRAMEWORK SEPTEMBER 2022 EUROPEAN CYBERSECURITY SKILLS FRAMEWORK (ECSF)

text: ABOUT ENISA

text: The European Union Agency for Cybersecurity, ENISA, is the Union’s agency dedicated to achieving a high common level of cybersecurity across Europe. Established in 2004 and strengthened by the EU Cybersecurity Act, the European Union Agency for Cybersecurity contributes to EU cyber policy, enhances the trustworthiness of ICT products, services and processes with cybersecurity certification schemes, cooperates with Member States and EU bodies, and helps Europe prepare for the cyber challenges of tomorrow. Through knowledge sharing, capacity building and awareness raising, the Agency works together with its key stakeholders to strengthen trust in the connected economy, to boost resilience of the Union’s infrastructure, and, ultimately, to keep Europe’s society and citizens digitally secure. More information about ENISA and its work can be found here: www.enisa.europa.eu.

type: stycke

text: CONTACT

text: For contacting the editor please use euskills@enisa.europa.eu.

text: ACKNOWLEDGEMENTS

text: This framework is the result of the expert opinion and agreement in the Ad-Hoc Working Group on the skills framework composed by Agata BEKIER, Vladlena BENSON, Jutta BREYER*, Fabio DI FRANCO, Sara GARCIA, Athanasios GRAMMATOPOULOS, Markku KORKIAKOSKI, Csaba KRASZNAY, Haralambos MOURATIDIS, Christina GEORGHIADOU, Erwin ORYE*, Edmundas PIESARSKAS, Nineta POLEMI*, Paresh RATHOD*, Antonio SANNINO, Fred VAN NOORD, Richard WIDH, Nina OLESEN and Jan HAJNY.

text: Fabio DI FRANCO and Athanasios GRAMMATOPOULOS led this activity for ENISA.

text: LEGAL NOTICE

text: This publication represents the views and interpretations of ENISA, unless stated otherwise. It does not endorse a regulatory obligation of ENISA or of ENISA bodies pursuant to the

text: Regulation (EU) No 2019/881

text: ENISA has the right to alter, update or remove the publication or any of its contents. It is intended for information purposes only and it must be accessible free of charge. All references to it or its use as a whole or partially must contain ENISA as its source.

text: Third-party sources are quoted as appropriate. ENISA is not responsible or liable for the content of the external sources including external websites referenced in this publication.

text: Neither ENISA nor any person acting on its behalf is responsible for the use that might be made of the information contained in this publication.

text: ENISA maintains its intellectual property rights in relation to this publication.

text: COPYRIGHT NOTICE

text: © European Union Agency for Cybersecurity (ENISA), 2022

text: This publication is licenced under CC-BY 4.0 “Unless otherwise noted, the reuse of this document is authorised under the Creative Commons Attribution 4.0 International (CC BY 4.0)

text: EUROPEAN CYBERSECURITY SKILLS FRAMEWORK (ECSF)

text: licence (https://creativecommons.org/licenses/by/4.0/). This means that reuse is allowed, provided that appropriate credit is given and any changes are indicated”. For any use or reproduction of photos or other material that is not under the ENISA copyright, permission must be sought directly from the copyright holders. ISBN: 978-92-9204-584-5 – DOI: 10.2824/859537

text: TABLE OF CONTENTS

text: 1. OVERVIEW 4 2. PROFILES 5

text: 2.1 CHIEF INFORMATION SECURITY OFFICER (CISO) 5

text: 2.2 CYBER INCIDENT RESPONDER 7

text: 2.3 CYBER LEGAL, POLICY & COMPLIANCE OFFICER 9

text: 2.4 CYBER THREAT INTELLIGENCE SPECIALIST 11

text: 2.5 CYBERSECURITY ARCHITECT 13

text: 2.6 CYBERSECURITY AUDITOR 15

text: 2.7 CYBERSECURITY EDUCATOR 17

text: 2.8 CYBERSECURITY IMPLEMENTER 18

text: 2.9 CYBERSECURITY RESEARCHER 19

text: 2.10CYBERSECURITY RISK MANAGER 20

text: 2.11DIGITAL FORENSICS INVESTIGATOR 21

text: 2.12PENETRATION TESTER 22

text: 3. DELIVERABLES LIBRARY 24 EUROPEAN CYBERSECURITY SKILLS FRAMEWORK (ECSF)

text: 1. OVERVIEW

text: Chief Information Cyber Incident Cyber Legal, Policy and Security Officer (CISO) Responder Compliance Officer Cyber Threat Cybersecurity Cybersecurity Intelligence Specialist Architect Auditor Cybersecurity Cybersecurity Cybersecurity Educator Implementer Researcher Cybersecurity Risk Digital Forensics Penetration Manager Investigator Tester EUROPEAN CYBERSECURITY SKILLS FRAMEWORK (ECSF)

text: 2. PROFILES

text: 2.1 CHIEF INFORMATION SECURITY OFFICER (CISO)

text: Profile Title Chief Information Security Officer (CISO)

text: Alternative Title(s) Cybersecurity Programme Director Information Security Officer (ISO) Information Security Manager Head of Information Security IT/ICT Security Officer

text: Summary statement Manages an organisation’s cybersecurity strategy and its implementation to ensure that digital systems, services and assets are adequately secure and protected.

text: Mission Defines, maintains and communicates the cybersecurity vision, strategy, policies and procedures. Manages the implementation of the cybersecurity policy across the organisation. Assures information exchange with external authorities and professional bodies.

text: Deliverable(s) • Cybersecurity Strategy • Cybersecurity Policy

text: Main task(s) • Define, implement, communicate and maintain cybersecurity goals, requirements, strategies, policies, aligned with the business strategy to support the organisational objectives • Prepare and present cybersecurity vision, strategies and policies for approval by the senior management of the organisation and ensure their execution • Supervise the application and improvement of the Information Security Management System (ISMS) • Educate senior management about cybersecurity risks, threats and their impact to the organisation • Ensure the senior management approves the cybersecurity risks of the organisation • Develop cybersecurity plans • Develop relationships with cybersecurity-related authorities and communities • Report cybersecurity incidents, risks, findings to the senior management • Monitor advancement in cybersecurity • Secure resources to implement the cybersecurity strategy • Negotiate the cybersecurity budget with the senior management • Ensure the organisation’s resiliency to cyber incidents • Manage continuous capacity building within the organisation • Review, plan and allocate appropriate cybersecurity resources

text: Key skill(s) • Assess and enhance an organisation’s cybersecurity posture • Analyse and implement cybersecurity policies, certifications, standards, methodologies and frameworks • Analyse and comply with cybersecurity-related laws, regulations and legislations • Implement cybersecurity recommendations and best practices • Manage cybersecurity resources • Develop, champion and lead the execution of a cybersecurity strategy • Influence an organisation’s cybersecurity culture • Design, apply, monitor and review Information Security Management System (ISMS) either directly or by leading its outsourcing • Review and enhance security documents, reports, SLAs and ensure the security objectives • Identify and solve cybersecurity-related issues • Establish a cybersecurity plan • Communicate, coordinate and cooperate with internal and external stakeholders • Anticipate required changes to the organisation’s information security strategy and formulate new plans

text: • Define and apply maturity models for cybersecurity management • Anticipate cybersecurity threats, needs and upcoming challenges • Motivate and encourage people

text: Key knowledge • Cybersecurity policies • Cybersecurity standards, methodologies and frameworks • Cybersecurity recommendations and best practices • Cybersecurity related laws, regulations and legislations • Cybersecurity-related certifications • Ethical cybersecurity organisation requirements • Cybersecurity maturity models • Cybersecurity procedures • Resource management • Management practices • Risk management standards, methodologies and frameworks

text: e-Competences A.7. Technology Trend Monitoring Level 4 (from e-CF) D.1. Information Security Strategy Development Level 5 E.3. Risk Management Level 4 E.8. Information Security Management Level 4 E.9. IS-Governance Level 5

text: EUROPEAN CYBERSECURITY SKILLS FRAMEWORK (ECSF) 2.2 CYBER INCIDENT RESPONDER

text: Profile Title Cyber Incident Responder

text: Alternative Title(s) Cyber Incident Handler Cyber Crisis Expert Incident Response Engineer Security Operations Center (SOC) Analyst Cyber Fighter /Defender Security Operation Analyst (SOC Analyst) Cybersecurity SIEM Manager

text: Summary statement Monitor the organisation’s cybersecurity state, handle incidents during cyber-attacks and assure the continued operations of ICT systems.

text: Mission Monitors and assesses systems’ cybersecurity state. Analyses, evaluates and mitigates the impact of cybersecurity incidents. Identifies cyber incidents root causes and malicious actors. According to the organisation’s Incident Response Plan, restores systems’ and processes’ functionalities to an operational state, collecting evidences and documenting actions taken.

text: Deliverable(s) • Incident Response Plan • Cyber Incident Report

text: Main task(s) • Contribute to the development, maintenance and assessment of the Incident Response Plan • Develop, implement and assess procedures related to incident handling • Identify, analyse, mitigate and communicate cybersecurity incidents • Assess and manage technical vulnerabilities • Measure cybersecurity incidents detection and response effectiveness • Evaluate the resilience of the cybersecurity controls and mitigation actions taken after a cybersecurity or data breach incident • Adopt and develop incident handling testing techniques • Establish procedures for incident results analysis and incident handling reporting • Document incident results analysis and incident handling actions • Cooperate with Secure Operation Centres (SOCs) and Computer Security Incident Response Teams (CSIRTs) • Cooperate with key personnel for reporting of security incidents according to applicable legal framework

text: Key skill(s) • Practice all technical, functional and operational aspects of cybersecurity incident handling and response • Collect, analyse and correlate cyber threat information originating from multiple sources • Work on operating systems, servers, clouds and relevant infrastructures • Work under pressure • Communicate, present and report to relevant stakeholders • Manage and analyse log files

text: Key knowledge • Incident handling standards, methodologies and frameworks • Incident handling recommendations and best practices • Incident handling tools • Incident handling communication procedures • Operating systems security • Computer networks security • Cyber threats • Cybersecurity attack procedures • Computer systems vulnerabilities • Cybersecurity-related certifications • Cybersecurity related laws, regulations and legislations • Secure Operation Centres (SOCs) operation • Computer Security Incident Response Teams (CSIRTs) operation

text: e-Competences A.7. Technology Trend Monitoring Level 3 (from e-CF) B.2. Component Integration Level 2

text: B.3. Testing Level 3 B.5. Documentation Production Level 3 C.4. Problem Management Level 4

text: EUROPEAN CYBERSECURITY SKILLS FRAMEWORK (ECSF) 2.3 CYBER LEGAL, POLICY & COMPLIANCE OFFICER

text: Profile Title Cyber Legal, Policy & Compliance Officer

text: Alternative Title(s) Data Protection Officer (DPO) Privacy Protection Officer Cyber Law Consultant Cyber Legal Advisor Information Governance Officer Data Compliance Officer Cybersecurity Legal Officer IT/ICT Compliance Manager Governance Risk Compliance (GRC) Consultant

text: Summary statement Manages compliance with cybersecurity-related standards, legal and regulatory frameworks based on the organisation’s strategy and legal requirements.

text: Mission Oversees and assures compliance with cybersecurity- and data-related legal, regulatory frameworks and policies in line with the organisation’s strategy and legal requirements. Contributes to the organisation’s data protection related actions. Provides legal advice in the development of the organisation’s cybersecurity governance processes and recommended remediation strategies/solutions to ensure compliance.

text: Deliverable(s) • Compliance Manual • Compliance Report

text: Main task(s) • Ensure compliance with and provide legal advice and guidance on data privacy and data protection standards, laws and regulations • Identify and document compliance gaps • Conduct privacy impact assessments and develop, maintain, communicate and train upon the privacy policies, procedures • Enforce and advocate organisation’s data privacy and protection program • Ensure that data owners, holders, controllers, processors, subjects, internal or external partners and entities are informed about their data protection rights, obligations and responsibilities • Act as a key contact point to handle queries and complaints regarding data processing • Assist in designing, implementing, auditing and compliance testing activities in order to ensure cybersecurity and privacy compliance • Monitor audits and data protection related training activities • Cooperate and share information with authorities and professional groups • Contribute to the development of the organisation’s cybersecurity strategy, policy and procedures • Develop and propose staff awareness training to achieve compliance and foster a culture of data protection within the organization • Manage legal aspects of information security responsibilities and third-party relations

text: Key skill(s) • Comprehensive understanding of the business strategy, models and products and ability to factor into legal, regulatory and standards’ requirements • Carry out working-life practices of the data protection and privacy issues involved in the implementation of the organisational processes, finance and business strategy • Lead the development of appropriate cybersecurity and privacy policies and procedures that complement the business needs and legal requirements; further ensure its acceptance, comprehension and implementation and communicate it between the involved parties • Conduct, monitor and review privacy impact assessments using standards, frameworks, acknowledged methodologies and tools • Explain and communicate data protection and privacy topics to stakeholders and users • Understand, practice and adhere to ethical requirements and standards • Understand legal framework modifications implications to the organisation’s cybersecurity and data protection strategy and policies • Collaborate with other team members and colleagues

text: Key knowledge • Cybersecurity related laws, regulations and legislations

text: • Cybersecurity standards, methodologies and frameworks • Cybersecurity policies • Legal, regulatory and legislative compliance requirements, recommendations and best practices • Privacy impact assessment standards, methodologies and frameworks

text: e-Competences A.1. Information Systems and Business Strategy Level 4 (from e-CF) Alignment D.1. Information Security Strategy Development Level 4 E.8. Information Security Management Level 3 E.9. IS-Governance Level 4

text: EUROPEAN CYBERSECURITY SKILLS FRAMEWORK (ECSF) 2.4 CYBER THREAT INTELLIGENCE SPECIALIST

text: Profile Title Cyber Threat Intelligence Specialist

text: Alternative Title(s) Cyber Intelligence Analyst Cyber Threat Modeller

text: Summary statement Collect, process, analyse data and information to produce actionable intelligence reports and disseminate them to target stakeholders.

text: Mission Manages cyber threat intelligence life cycle including cyber threat information collection, analysis and production of actionable intelligence and dissemination to security stakeholders and the CTI community, at a tactical, operational and strategic level. Identifies and monitors the Tactics, Techniques and Procedures (TTPs) used by cyber threat actors and their trends, track threat actors’ activities and observe how non-cyber events can influence cyber-related actions.

text: Deliverable(s) • Cyber Threat Intelligence Manual • Cyber Threat Report

text: Main task(s) • Develop, implement and manage the organisation's cyber threat intelligence strategy • Develop plans and procedures to manage threat intelligence • Translate business requirements into Intelligence Requirements • Implement threat intelligence collection, analysis and production of actionable intelligence and dissemination to security stakeholders • Identify and assess cyber threat actors targeting the organisation • Identify, monitor and assess the Tactics, Techniques and Procedures (TTPs) used by cyber threat actors by analysing open-source and proprietary data, information and intelligence • Produce actionable reports based on threat intelligence data • Elaborate and advise on mitigation plans at the tactical, operational and strategic level • Coordinate with stakeholders to share and consume intelligence on relevant cyber threats • Leverage intelligence data to support and assist with threat modelling, recommendations for Risk Mitigation and cyber threat hunting • Articulate and communicate intelligence openly and publicly at all levels • Convey the proper security severity by explaining the risk exposure and its consequences to non-technical stakeholders

text: Key skill(s) • Collaborate with other team members and colleagues • Collect, analyse and correlate cyber threat information originating from multiple sources • Identify threat actors TTPs and campaigns • Automate threat intelligence management procedures • Conduct technical analysis and reporting • Identify non-cyber events with implications on cyber-related activities • Model threats, actors and TTPs • Communicate, coordinate and cooperate with internal and external stakeholders • Communicate, present and report to relevant stakeholders • Use and apply CTI platforms and tools

text: Key knowledge • Operating systems security • Computer networks security • Cybersecurity controls and solutions • Computer programming • Cyber Threat Intelligence (CTI) sharing standards, methodologies and frameworks • Responsible information disclosure procedures • Cross-domain and border-domain knowledge related to cybersecurity • Cyber threats • Cyber threat actors • Cybersecurity attack procedures • Advanced and persistent cyber threats (APT) • Threat actors Tactics, Techniques and Procedures (TTPs) • Cybersecurity-related certifications

text: e-Competences B.5. Documentation Production Level 3 (from e-CF) D.7. Data Science and Analytics Level 4 D.10. Information and Knowledge Management Level 4 E.4. Relationship Management Level 3 E.8. Information Security Management Level 4

text: EUROPEAN CYBERSECURITY SKILLS FRAMEWORK (ECSF) 2.5 CYBERSECURITY ARCHITECT

text: Profile Title Cybersecurity Architect

text: Alternative Title(s) Cybersecurity Solutions Architect Cybersecurity Designer Data Security Architect

text: Summary statement Plans and designs security-by-design solutions (infrastructures, systems, assets, software, hardware and services) and cybersecurity controls.

text: Mission Designs solutions based on security-by-design and privacy-by-design principles. Creates and continuously improves architectural models and develops appropriate architectural documentation and specifications. Coordinate secure development, integration and maintenance of cybersecurity components in line with standards and other related requirements.

text: Deliverable(s) • Cybersecurity Architecture Diagram • Cybersecurity Requirements Report

text: Main task(s) • Design and propose a secure architecture to implement the organisation’s strategy • Develop organisation’s cybersecurity architecture to address security and privacy requirements • Produce architectural documentation and specifications • Present high-level security architecture design to stakeholders • Establish a secure environment during the development lifecycle of systems, services and products • Coordinate the development, integration and maintenance of cybersecurity components ensuring the cybersecurity specifications • Analyse and evaluate the cybersecurity of the organisation’s architecture • Assure the security of the solution architectures through security reviews and certification • Collaborate with other teams and colleagues • Evaluate the impact of cybersecurity solutions on the design and performance of the organisation’s architecture • Adapt the organisation’s architecture to emerging threats • Assess the implemented architecture to maintain an appropriate level of security

text: Key skill(s) • Conduct user and business security requirements analysis • Draw cybersecurity architectural and functional specifications • Decompose and analyse systems to develop security and privacy requirements and identify effective solutions • Design systems and architectures based on security and privacy by design and by defaults cybersecurity principles • Guide and communicate with implementers and IT/OT personnel • Communicate, present and report to relevant stakeholders • Propose cybersecurity architectures based on stakeholder’s needs and budget • Select appropriate specifications, procedures and controls • Build resilience against points of failure across the architecture • Coordinate the integration of security solutions

text: Key knowledge • Cybersecurity-related certifications • Cybersecurity recommendations and best practices • Cybersecurity standards, methodologies and frameworks • Cybersecurity-related requirements analysis • Secure development lifecycle • Security architecture reference models • Cybersecurity-related technologies • Cybersecurity controls and solutions • Cybersecurity risks • Cyber threats • Cybersecurity trends • Legal, regulatory and legislative compliance requirements, recommendations and best practices • Legacy cybersecurity procedures • Privacy-Enhancing Technologies (PET)

text: • Privacy-by-design standards, methodologies and frameworks

text: e-Competences A.5. Architecture Design Level 5 (from e-CF) A.6. Application Design Level 3 B.1. Application Development Level 3 B.3. Testing Level 3 B.6. ICT Systems Engineering Level 4

text: EUROPEAN CYBERSECURITY SKILLS FRAMEWORK (ECSF) 2.6 CYBERSECURITY AUDITOR

text: Profile Title Cybersecurity Auditor

text: Alternative Title(s) Information Security Auditor (IT or Legal Auditor) Governance Risk Compliance (GRC) Auditor Cybersecurity Audit Manager Cybersecurity Procedures and Processes Auditor Information Security Risk and Compliance Auditor Data Protection Assessment Analyst

text: Summary statement Perform cybersecurity audits on the organisation’s ecosystem. Ensuring compliance with statutory, regulatory, policy information, security requirements, industry standards and best practices.

text: Mission Conducts independent reviews to assess the effectiveness of processes and controls and the overall compliance with the organisation's legal and regulatory frameworks policies. Evaluates, tests and verifies cybersecurity-related products (systems, hardware, software and services), functions and policies ensuring, compliance with guidelines, standards and regulations.

text: Deliverable(s) • Cybersecurity Audit Plan • Cybersecurity Audit Report

text: Main task(s) • Develop the organisation's auditing policy, procedures, standards and guidelines • Establish the methodologies and practices used for systems auditing • Establish the target environment and manage auditing activities • Define audit scope, objectives and criteria to audit against • Develop an audit plan describing the frameworks, standards, methodology, procedures and auditing tests • Review target of evaluation, security objectives and requirements based on the risk profile • Audit compliance with cybersecurity-related applicable laws and regulations • Audit conformity with cybersecurity-related applicable standards • Execute the audit plan and collect evidence and measurements • Maintain and protect the integrity of audit records • Develop and communicate conformity assessment, assurance, audit, certification and maintenance reports • Monitor risk remediation activities

text: Key skill(s) • Organise and work in a systematic and deterministic way based on evidence • Follow and practice auditing frameworks, standards and methodologies • Apply auditing tools and techniques • Analyse business processes, assess and review software or hardware security, as well as technical and organisational controls • Decompose and analyse systems to identify weaknesses and ineffective controls • Communicate, explain and adapt legal and regulatory requirements and business needs • Collect, evaluate, maintain and protect auditing information • Audit with integrity, being impartial and independent

text: Key knowledge • Cybersecurity controls and solutions • Legal, regulatory and legislative compliance requirements, recommendations and best practices • Monitoring, testing and evaluating cybersecurity controls' effectiveness • Conformity assessment standards, methodologies and frameworks • Auditing standards, methodologies and frameworks • Cybersecurity standards, methodologies and frameworks • Auditing-related certification • Cybersecurity-related certifications

text: e-Competences B.3. Testing Level 4 (from e-CF) B.5. Documentation Production Level 3 E.3. Risk Management Level 4 E.6 ICT Quality Management Level 4

text: E.8. Information Security Management Level 4

text: EUROPEAN CYBERSECURITY SKILLS FRAMEWORK (ECSF) 2.7 CYBERSECURITY EDUCATOR

text: Profile Title Cybersecurity Educator

text: Alternative Title(s) Cybersecurity Awareness Specialist Cybersecurity Trainer Faculty in Cybersecurity (Professor, Lecturer)

text: Summary statement Improves cybersecurity knowledge, skills and competencies of humans.

text: Mission Designs, develops and conducts awareness, training and educational programmes in cybersecurity and data protection-related topics. Uses appropriate teaching and training methods, techniques and instruments to communicate and enhance the cybersecurity culture, capabilities, knowledge and skills of human resources. Promotes the importance of cybersecurity and consolidates it into the organisation.

text: Deliverable(s) • Cybersecurity Awareness Program • Cybersecurity Training Material

text: Main task(s) • Develop, update and deliver cybersecurity and data protection curricula and educational material for training and awareness based on content, method, tools, trainees need • Organise, design and deliver cybersecurity and data protection awareness-raising activities, seminars, courses, practical training • Monitor, evaluate and report training effectiveness • Evaluate and report trainee’s performance • Finding new approaches for education, training and awareness-raising • Design, develop and deliver cybersecurity simulations, virtual labs or cyber range environments • Provide guidance on cybersecurity certification programs for individuals • Continuously maintain and enhance expertise; encourage and empower continuous enhancement of cybersecurity capacities and capabilities building

text: Key skill(s) • Identify needs in cybersecurity awareness, training and education • Design, develop and deliver learning programmes to cover cybersecurity needs • Develop cybersecurity exercises including simulations using cyber range environments • Provide training towards cybersecurity and data protection professional certifications • Utilise existing cybersecurity-related training resources • Develop evaluation programs for the awareness, training and education activities • Communicate, present and report to relevant stakeholders • Identify and select appropriate pedagogical approaches for the intended audience • Motivate and encourage people

text: Key knowledge • Pedagogical standards, methodologies and frameworks • Cybersecurity awareness, education and training programme development • Cybersecurity-related certifications • Cybersecurity education and training standards, methodologies and frameworks • Cybersecurity related laws, regulations and legislations • Cybersecurity recommendations and best practices • Cybersecurity standards, methodologies and frameworks • Cybersecurity controls and solutions

text: e-Competences D.3. Education and Training Provision Level 3 (from e-CF) D.9. Personnel Development Level 3 E.8. Information Security Management Level 3

text: EUROPEAN CYBERSECURITY SKILLS FRAMEWORK (ECSF) 2.8 CYBERSECURITY IMPLEMENTER

text: Profile Title Cybersecurity Implementer

text: Alternative Title(s) Information Security Implementer Cybersecurity Solutions Expert Cybersecurity Developer Cybersecurity Engineer Development, Security & Operations (DevSecOps) Engineer

text: Summary statement Develop, deploy and operate cybersecurity solutions (systems, assets, software, controls and services) on infrastructures and products.

text: Mission Provides cybersecurity-related technical development, integration, testing, implementation, operation, maintenance, monitoring and support of cybersecurity solutions. Ensures adherence to specifications and conformance requirements, assures sound performance and resolves technical issues required in the organisation’s cybersecurity-related solutions (systems, assets, software, controls and services), infrastructures and products.

text: Deliverable(s) • Cybersecurity Solutions

text: Main task(s) • Develop, implement, maintain, upgrade, test cybersecurity products • Provide cybersecurity-related support to users and customers • Integrate cybersecurity solutions and ensure their sound operation • Securely configure systems, services and products • Maintain and upgrade the security of systems, services and products • Implement cybersecurity procedures and controls • Monitor and assure the performance of the implemented cybersecurity controls • Document and report on the security of systems, services and products • Work close with the IT/OT personnel on cybersecurity-related actions • Implement, apply and manage patches to products to address technical vulnerabilities

text: Key skill(s) • Communicate, present and report to relevant stakeholders • Integrate cybersecurity solutions to the organisation’s infrastructure • Configure solutions according to the organisation’s security policy • Assess the security and performance of solutions • Develop code, scripts and programmes • Identify and solve cybersecurity-related issues • Collaborate with other team members and colleagues

text: Key knowledge • Secure development lifecycle • Computer programming • Operating systems security • Computer networks security • Cybersecurity controls and solutions • Offensive and defensive security practices • Secure coding recommendations and best practices • Cybersecurity recommendations and best practices • Testing standards, methodologies and frameworks • Testing procedures • Cybersecurity-related technologies

text: e-Competences A.5. Architecture Design Level 3 (from e-CF) A.6. Application Design Level 3 B.1. Application Development Level 3 B.3. Testing Level 3 B.6. ICT Systems Engineering Level 4

text: EUROPEAN CYBERSECURITY SKILLS FRAMEWORK (ECSF) 2.9 CYBERSECURITY RESEARCHER

text: Profile Title Cybersecurity Researcher

text: Alternative Title(s) Cybersecurity Research Engineer Chief Research Officer (CRO) in cybersecurity Senior Research Officer in cybersecurity Research and Development (R&D) Officer in cybersecurity Scientific Staff in cybersecurity Research and Innovation Officer/Expert in cybersecurity Research Fellow in cybersecurity

text: Summary statement Research the cybersecurity domain and incorporate results in cybersecurity solutions.

text: Mission Conducts fundamental/basic and applied research and facilitates innovation in the cybersecurity domain through cooperation with other stakeholders. Analyses trends and scientific findings in cybersecurity.

text: Deliverable(s) • Publication in Cybersecurity

text: Main task(s) • Analyse and assess cybersecurity technologies, solutions, developments and processes • Conduct research, innovation and development work in cybersecurity-related topics• Manifest and generate research and innovation ideas • Advance the current state-of-the-art in cybersecurity-related topics • Assist in the development of innovative cybersecurity-related solutions • Conduct experiments and develop a proof of concept, pilots and prototypes for cybersecurity solutions • Select and apply frameworks, methods, standards, tools and protocols including a building and testing a proof of concept to support projects • Contributes towards cutting-edge cybersecurity business ideas, services and solutions • Assist in cybersecurity-related capacity building including awareness, theoretical training, practical training, testing, mentoring, supervising and sharing • Identify cross-sectoral cybersecurity achievements and apply them in a different context or propose innovative approaches and solutions • Lead or participate in the innovation processes and projects including project management and budgeting • Publish and present scientific works and research and development results

text: Key skill(s) • Generate new ideas and transfer theory into practice • Decompose and analyse systems to identify weaknesses and ineffective controls • Decompose and analyse systems to develop security and privacy requirements and identify effective solutions • Monitor new advancements in cybersecurity-related technologies • Communicate, present and report to relevant stakeholders • Identify and solve cybersecurity-related issues • Collaborate with other team members and colleagues

text: Key knowledge • Cybersecurity-related research, development and innovation (RDI) • Cybersecurity standards, methodologies and frameworks • Legal, regulatory and legislative requirements on releasing or using cybersecurity related technologies • Multidiscipline aspect of cybersecurity • Responsible information disclosure procedures

text: e-Competences A.7. Technology Trend Monitoring Level 5 (from e-CF) A.9. Innovating Level 5 D.7. Data Science and Analytics Level 4 C.4. Problem Management Level 3 D.10. Information and Knowledge Management Level 3

text: EUROPEAN CYBERSECURITY SKILLS FRAMEWORK (ECSF) 2.10 CYBERSECURITY RISK MANAGER

text: Profile Title Cybersecurity Risk Manager

text: Alternative Title(s) Information Security Risk Analyst Cybersecurity Risk Assurance Consultant Cybersecurity Risk Assessor Cybersecurity Impact Analyst Cyber Risk Manager

text: Summary statement Manage the organisation's cybersecurity-related risks aligned to the organisation’s strategy. Develop, maintain and communicate the risk management processes and reports.

text: Mission Continuously manages (identifies, analyses, assesses, estimates, mitigates) the cybersecurity-related risks of ICT infrastructures, systems and services by planning, applying, reporting and communicating risk analysis, assessment and treatment. Establishes a risk management strategy for the organisation and ensures that risks remain at an acceptable level for the organisation by selecting mitigation actions and controls.

text: Deliverable(s) • Cybersecurity Risk Assessment Report • Cybersecurity Risk Remediation Action Plan

text: Main task(s) • Develop an organisation’s cybersecurity risk management strategy • Manage an inventory of organisation’s assets • Identify and assess cybersecurity-related threats and vulnerabilities of ICT systems • Identification of threat landscape including attackers’ profiles and estimation of attacks’ potential • Assess cybersecurity risks and propose most appropriate risk treatment options, including security controls and risk mitigation and avoidance that best address the organisation’s strategy • Monitor effectiveness of cybersecurity controls and risk levels • Ensure that all cybersecurity risks remain at an acceptable level for the organisation’s assets • Develop, maintain, report and communicate complete risk management cycle

text: Key skill(s) • Implement cybersecurity risk management frameworks, methodologies and guidelines and ensure compliance with regulations and standards • Analyse and consolidate organisation’s quality and risk management practices • Enable business assets owners, executives and other stakeholders to make riskinformed decisions to manage and mitigate risks • Build a cybersecurity risk-aware environment • Communicate, present and report to relevant stakeholders • Propose and manage risk-sharing options

text: Key knowledge • Risk management standards, methodologies and frameworks • Risk management tools • Risk management recommendations and best practices • Cyber threats • Computer systems vulnerabilities • Cybersecurity controls and solutions • Cybersecurity risks • Monitoring, testing and evaluating cybersecurity controls' effectiveness • Cybersecurity-related certifications • Cybersecurity-related technologies

text: e-Competences E.3. Risk Management Level 4 (from e-CF) E.5. Process Improvement Level 3 E.7. Business Change Management Level 4 E.9. IS-Governance Level 4

text: EUROPEAN CYBERSECURITY SKILLS FRAMEWORK (ECSF) 2.11 DIGITAL FORENSICS INVESTIGATOR

text: Profile Title Digital Forensics Investigator

text: Alternative Title(s) Digital Forensics Analyst Cybersecurity & Forensic Specialist Computer Forensics Consultant

text: Summary statement Ensure the cybercriminal investigation reveals all digital evidence to prove the malicious activity.

text: Mission Connects artefacts to natural persons, captures, recovers, identifies and preserves data, including manifestations, inputs, outputs and processes of digital systems under investigation. Provides analysis, reconstruction and interpretation of the digital evidence based on a qualitative opinion. Presents an unbiased qualitative view without interpreting the resultant findings.

text: Deliverable(s) • Digital Forensics Analysis Results • Electronic Evidence

text: Main task(s) • Develop digital forensics investigation policy, plans and procedures • Identify, recover, extract, document and analyse digital evidence • Preserve and protect digital evidence and make it available to authorised stakeholders • Inspect environments for evidence of unauthorised and unlawful actions • Systematically and deterministic document, report and present digital forensic analysis findings and results • Select and customise forensics testing, analysing and reporting techniques

text: Key skill(s) • Work ethically and independently; not influenced and biased by internal or external actors • Collect information while preserving its integrity • Identify, analyse and correlate cybersecurity events • Explain and present digital evidence in a simple, straightforward and easy to understand way • Develop and communicate, detailed and reasoned investigation reports

text: Key knowledge • Digital forensics recommendations and best practices • Digital forensics standards, methodologies and frameworks • Digital forensics analysis procedures • Testing procedures • Criminal investigation procedures, standards, methodologies and frameworks • Cybersecurity related laws, regulations and legislations • Malware analysis tools • Cyber threats • Computer systems vulnerabilities • Cybersecurity attack procedures • Operating systems security • Computer networks security • Cybersecurity-related certifications

text: e-Competences A.7. Technology Trend Monitoring Level 3 (from e-CF) B.3. Testing Level 4 B.5. Documentation Production Level 3 E.3. Risk Management Level 3

text: EUROPEAN CYBERSECURITY SKILLS FRAMEWORK (ECSF) 2.12 PENETRATION TESTER

text: Profile Title Penetration Tester

text: Alternative Title(s) Pentester Ethical Hacker Vulnerability Analyst Cybersecurity Tester Offensive Cybersecurity Expert Defensive Cybersecurity Expert Red Team Expert Red Teamer

text: Summary statement Assess the effectiveness of security controls, reveals and utilise cybersecurity vulnerabilities, assessing their criticality if exploited by threat actors.

text: Mission Plans, designs, implements and executes penetration testing activities and attack scenarios to evaluate the effectiveness of deployed or planned security measures. Identifies vulnerabilities or failures on technical and organisational controls that affect the confidentiality, integrity and availability of ICT products (e.g. systems, hardware, software and services).

text: Deliverable(s) • Vulnerability Assessment Results Report • Penetration Testing Report

text: Main task(s) • Identify, analyse and assess technical and organisational cybersecurity vulnerabilities • Identify attack vectors, uncover and demonstrate exploitation of technical cybersecurity vulnerabilities • Test systems and operations compliance with regulatory standards • Select and develop appropriate penetration testing techniques • Organise test plans and procedures for penetration testing • Establish procedures for penetration testing result analysis and reporting • Document and report penetration testing results to stakeholders • Deploy penetration testing tools and test programs

text: Key skill(s) • Develop codes, scripts and programmes • Perform social engineering • Identify and exploit vulnerabilities • Conduct ethical hacking • Think creatively and outside the box • Identify and solve cybersecurity-related issues • Communicate, present and report to relevant stakeholders • Use penetration testing tools effectively • Conduct technical analysis and reporting • Decompose and analyse systems to identify weaknesses and ineffective controls • Review codes assess their security

text: Key knowledge • Cybersecurity attack procedures • Information technology (IT) and operational technology (OT) appliances • Offensive and defensive security procedures • Operating systems security • Computer networks security • Penetration testing procedures • Penetration testing standards, methodologies and frameworks • Penetration testing tools • Computer programming • Computer systems vulnerabilities • Cybersecurity recommendations and best practices • Cybersecurity-related certifications

text: e-Competences B.2. Component Integration Level 4 (from e-CF) B.3. Testing Level 4 B.4. Solution Deployment Level 2 B.5. Documentation Production Level 3

text: E.3. Risk Management Level 4

text: 3. DELIVERABLES LIBRARY

text: The list of deliverables provides some indicative and practical examples of the deliverable(s) / output(s) of each role profile. The deliverables listed are offered as examples as the list is not exhaustive, and thus mat not cover every aspect of each profile.

text: Profile Title Deliverable Description

text: Chief Information Security Cybersecurity Strategy Cybersecurity Strategy is a plan of actions designed to Officer (CISO) improve the security and resilience of an organisation’s infrastructures and services.

text: Chief Information Security Cybersecurity Policy A policy listing rules to ensure the organisation’s Officer (CISO) cybersecurity.

text: Cyber Incident Responder Incident Response Plan A set of documented procedures detailing the steps that should be taken in each phase of an incident response (Preparation, Detection and Analysis, Containment, Eradication and Recovery, Post-Incident Activity).

text: Cyber Incident Responder Cyber Incident Report A report providing details on one or more cyber incidents.

text: Cyber Legal, Policy & Compliance Manual A manual providing a thorough understanding of the Compliance Officer regulatory compliance obligations of an organisation. It may include internal policies or procedures to ensure compliance with laws, regulations and/or standards.

text: Cyber Legal, Policy & Compliance Report A report presenting the current state of the compliance Compliance Officer posture of an organisation.

text: Cyber Threat Intelligence Cyber Threat Intelligence A manual presenting tools and/or methodologies for Specialist Manual (or Handbook) cyber threat intelligence gathering and/or sharing.

text: Cyber Threat Intelligence Cyber Threat Report A report identifying prime threats, major trends Specialist observed with respect to threats, threat actors and/or attack techniques. The report may also include relevant mitigation measures.

text: Cybersecurity Architect Cybersecurity Architecture A visual representation of an organisation’s Diagram cybersecurity system architecture used to protect assets against cyber-attacks.

text: Cybersecurity Architect Cybersecurity A report listing a set of requirements needed for Requirements Report ensuring the cybersecurity of a system.

text: Cybersecurity Auditor Cybersecurity Audit Plan A plan that presents the overall strategy and the procedures an auditor will follow to conduct a cybersecurity audit.

text: Cybersecurity Auditor Cybersecurity Audit A report providing a thorough understanding of the Report level of security of a system, assessing its cybersecurity strengths and weaknesses. It may also provide remediation actions to improve the overall cybersecurity of the system.

text: Cybersecurity Educator Cybersecurity Awareness A program of activities to raise awareness on Program cybersecurity-related issues (e.g. lectures on attacks

text: and threats) helping organisations prevent and mitigate related cybersecurity risks.

text: Cybersecurity Educator Cybersecurity Training Material providing explaining cybersecurity-related Material concepts, methodologies and tools for training or upskilling individuals. It might include Handbooks for teachers, Toolsets for students and/or Virtual Images to support hands on training sessions.

text: Cybersecurity Implementer Cybersecurity Solutions Cybersecurity solutions might include tools and services that aim to protect organizations against cyber-attacks.

text: Cybersecurity Researcher Publication in Academic publication releasing findings and results of Cybersecurity research in the cybersecurity context. The purpose of the publication might be to advance the technology and/or develop new innovated solutions.

text: Cybersecurity Risk Cybersecurity Risk A report listing the results of the identification, Manager Assessment Report analysis, and evaluation of cybersecurity risks of a system. It might also include controls to mitigate or reduce identified risks to an acceptable level.

text: Cybersecurity Risk Cybersecurity Risk An action plan listing activities related to the Manager Remediation Action Plan implementation of mitigation measures aiming at reducing cybersecurity risks.

text: Digital Forensics Digital Forensics Analysis Results of the analysis of digital data uncovering Investigator Results potential evidence of malicious incidents and identifying possible threat actors.

text: Digital Forensics Electronic Evidence Potential evidence derived from data contained in or Investigator produced by any device, the functioning of which depends on a software program or data stored on or transmitted over a computer system or network. (e.g. accurate collection of logs)

text: Penetration Tester Vulnerability Assessment A report listing and assessing the criticality of Results Report vulnerabilities uncovered in a system during a (usually automatic) vulnerability scanning. The report might also suggest basic remediation actions.

text: Penetration Tester Penetration Testing A report providing a detailed and comprehensive Report analysis of a system's vulnerabilities identified during a security testing. The report might also include suggested remediation actions.

text: -N -EN -510 -22 -09 TP

text: ABOUT ENISA

text: ISBN: 978-92-9204-584-5 DOI: 10.2824/859537


identifier: Example Assessment Templates

nummer: example-assessment-templates

title: Example Assessment Templates

text: IT Business Continuity Management

text: January 10 An approach for Small Medium Sized Organizations – Annexes G - H - Templates About ENISA The European Network and Information Security Agency (ENISA) is an EU agency created to advance the functioning of the internal market. ENISA is a centre of excellence for the European Member States and European institutions in network and information security, giving advice and recommendations and acting as a switchboard of information for good practices. Moreover, the agency facilitates contacts between the European institutions, the Member States and private business and industry actors. Contact details:

text: For contacting ENISA or for general enquiries on BCP for SMEs, please use the following details:

text: e-mail: Dr. L. Marinos, Senior Expert — louis.marinos@enisa.europa.eu Charalambos Koutsouris, Seconded National Expert, charalampos.koutsouris@enisa.europa.eu Internet: http://www.enisa.europa.eu/

text: Legal notice Notice must be taken that this publication represents the views and interpretations of the authors and editors, unless stated otherwise. This publication should not be construed to be an action of ENISA or the ENISA bodies unless adopted pursuant to the ENISA

text: Regulation (EC) No 460/2004

text: . This publication does not necessarily represent state-of the-art and it might be updated from time to time. Third-party sources are quoted as appropriate. ENISA is not responsible for the content of the external sources including external websites referenced in this publication. © European Network and Information Security Agency (ENISA), 2010 Document Revision: 1.0 This publication is intended for educational and information purposes only. Neither ENISA nor any person acting on its behalf is responsible for the use that might be made of the information contained in this publication. Reproduction is authorised provided the source is acknowledged.

text: BCM: An approach for SMEs BCM: An approach for SMEs – Templates Annex G - H

text: Annex G – Useful Templates

text: This section of the report presents the necessary templates which the Assessment Teams should use in order to execute the proposed Business Continuity Management approach. For each template the Name and description of the template is provided as well the phase(s) and step(s) where the template is used / reused.

text: Risk Profile Evaluation Table – Phase 1, Step 1

text: Risk Areas High Medium Low

text: Legal and The organization handles The organization handles personal The organization does not Regulatory sensitive/personal customer customer information as defined handle personal data of information as defined by the EU by the EU Data Protection Law. individuals other than those Data Protection Law. Loss and / or destruction of the employed by the organization. Retention of the aforementioned aforementioned data will lead to Retention of the data is mandatory by Government legal fines from Regulatory Bodies. aforementioned data is not Regulations. Loss and / or Failure to meet agreed SLAs with mandatory by Government destruction of this data will lead to corporate customers regarding Regulations. Loss and / or significant legal fines from availability of product and / or destruction of the data will not Regulatory Bodies. service offerings may result in non- lead to legal fines from Failure to meet agreed SLAs with frivolous lawsuits. Regulatory Bodies. corporate customers regarding Failure to meet agreed SLAs availability of product and / or with corporate customers service offerings will result in non- regarding availability of product frivolous lawsuits. and / or service offerings may result in frivolous lawsuits.

text: Productivity Services and operational processes Services and operational processes Services and operational are highly dependent on are highly dependent on processes are not directly information systems, applications information systems, applications dependent on information and third party services. and third party services. systems, applications and third Interruptions to the provisioning of Interruptions to the provisioning of party services. these services or to operational these services or to operational Interruptions to the provisioning processes will generate intolerable processes have severe impact. of these services or to direct or indirect impact to However the organization can operational processes is productivity. Significant expenses continue operations by switching tolerable since the organization and effort are required to resume to backup (e.g. manual) is performing most critical business and recover from market procedures for a limited period of operations with other means loss. time without significantly affecting (e.g. manually) or can continue Provision of these services with its productivity. operations by switching to manual procedures at the agreed manual procedures for a period quality is not possible. of time without affecting its productivity.

text: Financial Unavailability of products and Unavailability of products and Unavailability of products and Stability services of less than one day lead services of less than one day lead services of less than one day to a major one time financial loss to a significant one time financial lead to no or marginal one time and cannot be tolerated. loss. financial loss. Yearly revenues are directly Yearly revenues are indirectly Yearly revenues are not directly related to the continuous and related to the continuous and or indirectly related to the uninterrupted provision of on-line uninterrupted provision of online continuous and uninterrupted services (i.e. sales are performed services (i.e. products and Services provision of on-line services. online). are supported with on-line Unavailability of online presence

text: BCM: An approach for SMEs

text: Unavailability of online presence services). will not lead to direct or indirect will lead to direct financial loss as Unavailability of online presence financial loss as services major services are provided by will not lead to direct financial loss provided online can be provided using e-business applications. as services provided on-line can be by using alternative means (e.g. Fines that may incur due to non- provided by using alternative semi-automated, manually, compliance with legal and means (e.g. semi-automated, etc.). regulatory requirements may lead manually, etc.). No or marginal fines will incur to intolerable financial loss. Fines that may incur due to non- due to non-compliance with compliance with legal and legal and regulatory regulatory requirements are requirements. If any, they possible but will not affect financial cannot affect financial stability. stability.

text: Reputation and Unavailability of service has direct Unavailability of service has direct Unavailability of service cannot Loss of impact on reputation, resulting impact on reputation, resulting have impact on reputation, Customer thus in significant loss of thus in considerable loss of remaining thus unnoticed or Confidence customers using products and customers using products and marginally noticed by services though automated services though automated customers. interfaces. interfaces.

text: Table 1: Risk Profile Evaluation Table Risk Profile Selection Table – Phase 1, Step 2 – Phase 3, Step 1

text: The risk profile selection table is the output the organizational risk determined by the Assessment Team during step 1 illustrating the identified risk levels in the predefined risk areas; the highest risk identified in a risk class defines the overall business risk profile.

text: Risk Profile Selection Table

text: Risk Areas Risk Level Risk Profile

text: Legal and Regulatory

text: Productivity

text: Financial Stability

text: Reputation and Loss of Customer Confidence

text: Table 2: Risk Profile Selection BCM: An approach for SMEs – Templates Annex G - H Critical Business Function Profile Card – Phase 2, Step 1

text: Critical Business Function Profile Card Critical Business Function Recovery Priority Who controls the function Who is responsible for delivering the function? Who is the user? (Who benefits / needs this function? / why is it critical?) How is it used?

text: Table 3: Detailsof the critical Business Function “Finance” Critical Business Function Table – Business Continuity Scope – Phase 2, Step 1

text: The Assessment Team compiles a table listing the corporate critical business functions along with the rationale for selection and the recovery priority of each business function. Critical Business Function – Business Continuity Scope Critical Business Function Rationale for Selection Recovery Priority (High, Medium, Low) Production Customer Relationship Human Resource Finance New Product Acquisition / Development.

text: Table 4: Critical Business Functions of example organisation BCM: An approach for SMEs Business Function Supporting IT Assets – Phase 2, Step 2

text: The Assessment Team selects the asset types, which are used to provide the selected critical business function(s) to the organization’s employees identified during phase 2, step 1. The Assessment Team ends up with a matrix -for each identified critical business function- identifying the supporting assets used to provide the organization’s business function(s).

text: Critical Business Function Supporting IT Assets Critical Business Function Name Supporting Assets Hardware Network Back Office Application Client Facing Applications People Data Facilities

text: Table 5: Critical Business Function Supporting IT Assets BCM: An approach for SMEs – Templates Annex G - H Hardware/Network/Application Asset Identification Card – Phase 2, Step 3

text: The Assessment Teams produce asset identification cards in order to gather information produced during phase 2, steps 1 and 2. These cards will be used to select the appropriate asset based controls –Phase 3, Step 2- for the protection of the organization’s critical assets. Asset Identification Card Card Creation/Update Date Asset Category Asset Name Asset Description Asset Owner Asset Location Asset Maintainer Aggregated Recovery Priority Supported Business Func#1 Assets role /usage in function Recovery Priority Requirement Asset users Supported Business Func#2 Assets role /usage in function Recovery Priority Requirement Asset users

text: Table 6: Hardware/Network/Application Asset Identification Card BCM: An approach for SMEs Data Asset Identification Card – Phase 2, Step 3 – Phase 3, Step 2

text: Data Asset Identification Card Card Creation/Update Date Asset Category Asset Name Asset Description Asset Owner Asset Storage Location Asset Maintainer Aggregated Recovery Priority Supported Business Func#1 Assets role /usage in function Recovery Priority Requirement Asset users

text: Table 7: Data Asset Identification Card BCM: An approach for SMEs – Templates Annex G - H People Asset Identification Card – Phase 2, Step 3 – Phase 3, Step 2

text: People / Suppliers Identification Card Card Creation/Update Date Name Organization and address (if not a company employee) Department Title (Role) Key BCM Responsibilities (If contractual obligations exist, put a reference to the contract) Office Telephone FAX Mobile Home Telephone E-mail

text: Table 8: People Identification Card BCM: An approach for SMEs Facilities Asset Identification Card – Phase 2, Step 3 – Phase 3, Step 2

text: Facilities Identification Card Card Creation/Update Date Asset Category Asset Name Asset Description Asset Owner Asset Location Asset Maintainer Aggregated Recovery Priority Supported Business Func#1 Supported Business Func#2 Supported Business Func#3 Supported Business Func#4 Supported Business Func#5

text: Table 9: Facilities Asset Identification Card BCM: An approach for SMEs – Templates Annex G - H Asset Requirements Analysis Summary – Phase 2, Step 3

text: IT Asset Function#1 Function#2 Function#3 Aggregated Expedited Finance Customer Recovery Service Relationship Priority Contract Management Fulfilment Hardware

text: Client Facing Application

text: People / Suppliers

text: Data

text: Facilities

text: Table 10: Asset Requirements Analysis Summary BCM: An approach for SMEs Organisational Continuity Controls – Phase 3, Step 1

text: Organizational Continuity Controls Card

text: Risk Areas High Medium Low

text: Legal and Regulatory

text: (SP1) SP1.1 SP1.1 (SP2) (SP2) SP3.4 SP3.4 (SP4) (SP4) SP2.3 SP5.1

text: Productivity

text: (SP1) (SP2) SP2.1 (SP2) SP3.4 (SP3) SP2.2 (SP4) (SP4) SP5.2 (SP5)

text: Financial Stability

text: (SP1) (SP2) SP2.1 (SP2) (SP4) SP5.2 (SP4)

text: Reputation and Loss of Customer

text: (SP1) SP2.2 SP2.7

text: Confidence

text: (SP2) SP2.3 (SP4) (SP4) SP3.4

text: Table 11: Organizational Continuity Controls Asset Continuity Control Casrds – Phase 3, Step 2

text: Asset Continuity Control Cards

text: Asset Category High Risk Cards Medium Risk Cards Low Risk Cards

text: Hardware & Network CCC-1HN CCC-2HN CCC-3HN Application CCC-1A CCC-2A CCC-3A

text: (Back Office – Client Facing)

text: People CCC-1P CCC-2P CCC-3P Data CCC-1D CCC-2D CCC-3D Facilities CCC-1F CCC-2F CCC-3F

text: Table 12: Asset Continuity Control Cards BCM: An approach for SMEs – Templates Annex G - H List of Asset Selected Controls– Phase 3, Step 3

text: Asset Based Continuity Controls

text: Control Asset & Priority Rationale for Selection

text: Table 13: List of Asset Selected Controls BCM: An approach for SMEs Organizational Controls Gap Analysis Table – Phase 4, Step 1

text: The gap analysis table is the output of the gap analysis exercise performed by the Assessment Teams during phase 4, step 1. The table summarizes the results from the evaluation of the organization's current business continuity practices compared to the selected controls described on control cards.

text: Organizational Continuity Controls

text: Control Asset Control Description Do we currently follow the controls included in the control cards?

text: Table 14: Organizational Controls Gap Analysis List Asset Controls Gap Analysis Table – Phase 4, Step 1

text: Asset Based Continuity Controls

text: Control Asset & Priority Do we currently follow the controls included in the control cards?

text: Table 15: Asset Gap Analysis List BCM: An approach for SMEs – Templates Annex G - H Organizational Controls Actions List – Phase 4, Step 2

text: Following the gap analysis, the Assessment Team reads the controls (Annex A, B) and decides whether the organization will implement or not the continuity controls. This activity is documented into the Actions List table along with the necessary actions that the organization should execute for the implementation of the selected controls.

text: Organizational Continuity Controls

text: Control Asset Control Description Activity needed, Outcome expected, Deliverable Documentation

text: Table 16: Organizational Controls Actions List – Example Asset Based Controls Actions List – Phase 4, Step 2

text: Asset Based Continuity Controls

text: Control Asset & Priority Activity needed, Outcome expected, Deliverable Documentation

text: Table 17: Asset Actions List – Example BCM: An approach for SMEs Controls Prioritization Matrix – Phase 4, Step 2

text: Controls Prioritization Matrix

text: Asset Hardware & Applications Data People Facilities Categories Network

text: ty Low Low Low Medium Medium High ri o ri P Medium Medium Medium Medium Medium High ry ve o ec High High High High High High R

text: Table 18: Controls Prioritization Matrix BC Controls Implementation Plan – Phase 4, Step 2

text: The Assessment Team produces the controls implementation plan, prioritizing the necessary actions (phase 4, step 1) towards the controls implementation. The plan also includes the responsible party for the controls implementation and the expected date of their integration within the organization.

text: BC Controls Implementation Plan

text: Control Responsible External support Milestones Implementation required Mm/Dd Priority

text: Table 19: BC Controls Implementation plan BCM: An approach for SMEs – Templates Annex G - H Business Continuity Plan – Phase 4, Step 3

text: The Business Continuity Plan Template is produced by the execution of the proposed BCM approach. The Plan is created gradually as the Assessment Team executes the various steps. The BCP template exists as a separate document build from the example assessment of a fictitious company. The assessment steps taken to build this BCP are described in chapter 5 of this BCM approach’s main document.

text: BCM: An approach for SMEs

text: Annex H – Asset Types List

text: Asset Category Description Asset (types)

text: Hardware Information systems that process and store information. Server Systems are a combination of information, software, and Laptop hardware assets. Any host, client, server, or network can be Workstation considered a system. Critical systems are those identified as essential for the continuous provision of the business service Storage and product offerings, those that store critical business Security Devices (firewall, IDS / IPS, antiinformation (customer or business proprietary) or these that spam etc) are exposed to the outside world for business functions or Network services. Devices important to the organization’s networks. Routers, Routers switches, and modems are all examples of this class of Gateways component. Wireless components/devices, such as cell phones and wireless access points that staff members use to access Switches information (for example, email). Typically, critical networks Wireless Access Points are those that are used to support essential critical applications or systems or those that are shared with third party and usually Network Segment (e.g. cabling and un-trusted networks. equipment between two computers) Other (SAT, Laser)

text: People People in the organization, including business, administration, Chief Technology / Information Director HR and IT. Critical people are those that play a key role the delivery of product and operational processes. Importance Information Technology Manager should be given to critical roles that are considered irreplaceable or constitute a single point of failure. Database Development & Administration (manager, analyst, architect, administrator etc.)

text: Programming / Software Engineering (manager, engineer, programmer, tester etc.) Technical Support (Help Desk Operator, technician etc.) Systems Analysis & Integration (manager, analyst, integrator, specialist etc.)

text: Technical Writing (manager, writer, publication specialist etc.)

text: Network Design & Administration (manager, analyst, architect, administrator, technician etc.)

text: WEB Development & Administration (manager, developer, designer, administrator etc.)

text: Back office Applications that are key to or part of daily business Financial Control Applications operations. Disruption of such applications typically results in Customer Care severe hindering or even unavailability of all dependent Logistics business processes. ERP CRM

text: BCM: An approach for SMEs – Templates Annex G - H

text: Email Internet Custom Application Intranet Industry Application Instant messaging Security Software (antivirus, proxy, IDS) Document Management System Client Facing Applications that are key to or part of the product and service E-commerce Applications offerings. Disruption of such applications typically results in Internet Service Provisioning – Static, severe hindering or even unavailability of all dependent customer facing (i.e. front office) business services. Public IP addresses, DNS service registration and management. Email Service Provisioning Web Portal Web Site

text: Application / Data Hosting FAX (including incoming call numbers) Incoming telephone numbers and DDIs Telecommunication Services (i.e. Phone over IP, Mobile telephony, SMS / MMS) Data Data used by the organization in order to perform its business Customer Personal Data operations, generated within the organization or imported by Customer Financial Data third parties and/or customers. Corporate Employee Personal Data Corporate Employee Financial Data Corporate Financial Data Corporate Marketing Data Corporate Sales Data System Technical / Transaction Data System manuals Facilities All physical venues/locations including buildings, offices and Headquarters rooms that the organization uses in order to provide its service/product offerings. Secondary Premises Branch Offices Offices Data Canter

text: Table 20: Asset List


identifier: Example Asset Identification Cards

nummer: example-asset-identification-cards

title: Example Asset Identification Cards

text: © European Network and Information Security Agency (ENISA), 2010

text: Part of the ENISA deliverable IT Business Continuity Management “An Approach for SMEs”

text: Annex K – Critical Assets Identification Cards

text: Hardware

text: Asset Identification Card Card Creation/Update Date 18/12/2009 Asset Category Hardware Asset Name Tech-Laptop1 A laptop prepared to match the needs of technicians during field work. It provides access to medical equipment diagnosis Asset Description applications and service manuals. In addition it is used as a desktop replacement for use in the office. Asset Owner Technician1 Asset Location Office, on-the-road Asset Maintainer External IT Expert, Technician2, Technician1 Aggregated Recovery Priority High Supported Business Func#1 Expedited Service Contract Fulfilment Test medical equipment, read manuals, prepare spare part Assets role /usage in function supply requests and repair reports High. One of the Tech-Laptop1 or Tech Laptop2 must be Recovery Priority Requirement available and in good operating condition Asset users Technician1 Supported Business Func#2 - Assets role /usage in function Recovery Priority Requirement Asset users

text: Asset Identification Card Card Creation/Update Date 18/12/2009 Asset Category Hardware Asset Name Tech-Laptop2 Asset Description A laptop prepared to much the needs of technicians during field work. It provides access to medical equipment diagnosis applications and service manuals. In addition it is used as a desktop replacement for use in the office. Asset Owner Technician1 Asset Location Office, on-the-road Asset Maintainer External IT Expert, Technician2, Aggregated Recovery Priority High Supported Business Func#1 Expedited Service Contract Fulfilment Assets role /usage in function Test medical equipment, read manuals, prepare spare part supply requests and repair reports Recovery Priority Requirement High. One of the Tech-Laptop1 or Tech Laptop2 must be available and in good operating condition Asset users Technician2 Supported Business Func#2 - Assets role /usage in function Recovery Priority Requirement Asset users

text: Asset Identification Card Card Creation/Update Date 19/12/2009 Asset Category Hardware Asset Name Desktop-Sales1 Asset Description The salesman desktop providing access to office productivity applications, email communication and data stored on the corporate servers. Asset Owner Salesman1 Asset Location Office building / Room 2 / Sales1 desk

text: Aggregated Recovery Priority HIGH Supported Business Func#1 Expedited Service Contract Fulfilment Assets role /usage in function Access of customer Expedited service contracts and authorise customer service request, Manage technicians expedited service appointment schedule. Email communication Recovery Priority Requirement HIGH Asset users Salesman1 Supported Business Func#2 - Assets role /usage in function Recovery Priority Requirement Asset users

text: Asset Identification Card Card Creation/Update Date 18/12/2009 Asset Category Hardware Asset Name Desktop-Sales2 Asset Description The salesman desktop providing access to office productivity applications, email communication and data stored on the corporate servers. Asset Owner Salesman2 Asset Location Office building / Room 2 / Sales2 desk Asset Maintainer External IT Expert, Technician2

text: Aggregated Recovery Priority HIGH Supported Business Func#1 Expedited Service Contract Fulfilment Assets role /usage in function Access of customer Expedited service contracts and authorise customer service request, Manage technicians expedited service appointment schedule. Email communication Recovery Priority Requirement HIGH Asset users Salesman2 Supported Business Func#2 - Assets role /usage in function Recovery Priority Requirement Asset users

text: Asset Identification Card Card Creation/Update Date 18/12/2009 Asset Category Hardware Asset Name Office-PBX

text: Asset Description The Office PBX handles the company’s fixed-lines. The handsets are considered part of the PBX although we use ordinary handsets and not the PBX specific handsets that offer extra functionality. Asset Owner Secretary Asset Location Office/ Room1 Asset Maintainer PBX Supplier Aggregated Recovery Priority HIGH Supported Business Func#1 Expedited Service Contract Fulfilment Assets role /usage in function Customers calling to register their expedited support request are routed to the salesmen. Alternatively customers may call salesmen on their mobile phones. Recovery Priority Requirement HIGH Asset users Technician1, Technician2, Salesman1, Salesman2, Secretary, customers Supported Business Func#2 Customer Relationships Management Assets role /usage in function New or existing customers calling to request a service of product. Recovery Priority Requirement Medium Asset users Salesman1, Salesman2, Secretary, customers Supported Business Func#3 Finance Assets role /usage in function Daily communications with suppliers and customers. Recovery Priority Requirement Medium Asset users Customers and all function users

text: Asset Identification Card Card Creation/Update Date 18/12/2009 Asset Category Hardware Asset Name Financial control application server Asset Description This server holds the financial data and transactions. It hosts the financial control applications and allows the application’s users to access /update the warehouse stock and issue invoices (If relevant include brand/model and vendor / supplier.) Asset Owner Company owner Asset Location Owner’s office Asset Maintainer External IT Expert Aggregated Recovery Priority Medium Supported Business Func#1 Finance Assets role /usage in function Provides the platform for the Financial control Application Recovery Priority Requirement Medium Asset users Company Owner, Accountant, Secretary. It is most of the time used remotely from their own computers. Supported Business Func#2 - Assets role /usage in function Recovery Priority Requirement Asset users

text: Asset Identification Card Card Creation/Update Date 19/11/2009 Asset Category Hardware Asset Name Owner-Laptop Asset Description The personal laptop of the company’s owner. Used for all daily activities, like email communication, funds/financial management, business contacts, ... Asset Owner Company owner Asset Location Office, on-the-road Asset Maintainer External IT Expert, Technician2 Aggregate Recovery Priority Medium Supported Business Func#1 Finance Assets role /usage in function Holds funding agreements and other financial information. Used to prepare agreements and keep contact information of suppliers and customers. Recovery Priority Requirement Medium Asset users Company Owner Supported Business Func#2 Customer Relationship management Assets role /usage in function Used for contact management and drafting marketing plans. Recovery Priority Requirement Medium Asset users Company Owner

text: Asset Identification Card Card Creation/Update Date 19/11/2009 Asset Category Hardware Asset Name Secretary-Desktop-PC Asset Description The desktop pc of the secretary providing access to office productivity applications and finance function application and data. Used for all daily activities, like email communication, financial management, orders to suppliers, etc Asset Owner Secretary Asset Location Office, room 3 Asset Maintainer External IT Expert, Technician2 Aggregate Recovery Priority Medium Supported Business Func#1 Finance Assets role /usage in function Used to prepare Faxes for ordering supplies, spare parts and equipment. Keeps track of the order process and delivery schedules to customers. Recovery Priority Requirement Medium Asset users Secretary Supported Business Func#2 Assets role /usage in function Recovery Priority Requirement Asset users

text: Asset Identification Card Card Creation/Update Date 18/11/2009 Asset Category Hardware Asset Name Accountant-Computer Asset Description This computer is owned and used solely (to our knowledge) by the accountant. It keeps of copy of financial information of our company to be processed and then used to update the financial control application of the company. Financial reports are prepared on this computer. Asset Owner Accountant Asset Location Accountants office Asset Maintainer Accountant Aggregate Recovery Priority Medium Supported Business Func#1 Finance Assets role /usage in function It keeps of copy of financial information of our company to be processed and then used to update the financial control application of the company. Financial reports are prepared on this computer. Recovery Priority Requirement Medium Asset users Accountant Supported Business Func#2 - Assets role /usage in function Recovery Priority Requirement Asset users

text: Asset Identification Card Card Creation/Update Date 18/11/2009 Asset Category Hardware Asset Name Office Ethernet Switch Asset Description The device is used to network the 11 computers in the office and the internet router Asset Owner Company-owner Asset Location Office, room1 Asset Maintainer External IT Expert, Technician2 Aggregate Recovery Priority High Supported Business Func#1 Finance Assets role /usage in function Allows accessing of functions data stored in others computers and sending/receiving emails Recovery Priority Requirement Medium Asset users All function’s users Supported Business Func#2 Expedited Service Contract Fulfilment Assets role /usage in function Allows accessing of functions data stored in others computers and sending/receiving emails Recovery Priority Requirement High Asset users All function’s users Supported Business Func#3 Customer Relationship management Assets role /usage in function Allows accessing of functions data stored in others computers and sending/receiving emails, accessing the internet to update the web site. Recovery Priority Requirement Medium Asset users All function’s users

text: Asset Identification Card Card Creation/Update Date 18/11/2009 Asset Category Hardware Asset Name Internet Router Asset Description Provide access to the internet and firewall protection Asset Owner Company-owner Asset Location Office, room1 Asset Maintainer External IT Expert, Technician2 Aggregate Recovery Priority Medium Supported Business Func#1 Finance Assets role /usage in function Used to exchange order and product information with suppliers and customers Recovery Priority Requirement Medium Asset users All function’s users Supported Business Func#2 Customer Relationship management Assets role /usage in function Used to exchange order and product information with suppliers and customers and update the web site. Recovery Priority Requirement Medium Asset users All function’s users Supported Business Func#3 Expedited Service Contract Fulfilment Assets role /usage in function Allows exchange of internal workflow documents (e.g. spare part requests) Recovery Priority Requirement High Asset users All function’s users

text: Application

text: Asset Identification Card: Hardware/Application/Network :VersionNo:03 Card Creation/Update Date 18/12/2009 Asset Category Application Asset Name Medical-Equipment-problem-diagnosis-application-vendor1

text: Asset Description Application to diagnose problems on Vendor1’s xyz series of medical equipment Asset Owner Technician1 Asset Location Laptop-Tech1, Laptop-Tech2 Asset Maintainer External IT Expert, Technician2 Aggregated Recovery Priority HIGH Supported Business Func#1 Expedited Service Contract Fulfilment Assets role /usage in function Application to diagnose problems on Vendor1’s xyz series of medical equipment Recovery Priority Requirement HIGH Asset users Technician1, Technician2 Supported Business Func#2 - Assets role /usage in function Recovery Priority Requirement Asset users

text: Asset Identification Card: Hardware/Application/Network :VersionNo:03 Card Creation/Update Date 18/12/2009 Asset Category Application Asset Name Medical-Equipment-problem-diagnosis-application-vendor2 Asset Description Application to diagnose problems on Vendor2’s xyz series of medical equipment Asset Owner Technician1 Asset Location Laptop-Tech1, Laptop-Tech2 Asset Maintainer External IT Expert, Technician2 Aggregated Recovery Priority HIGH Supported Business Func#1 Expedited Service Contract Fulfilment Assets role /usage in function Application to diagnose problems on Vendor2’s xyz series of medical equipment Recovery Priority Requirement HIGH Asset users Technician1, Technician2 Supported Business Func#2 - Assets role /usage in function Recovery Priority Requirement Asset users

text: Asset Identification Card Card Creation/Update Date 18/12/2009 Asset Category Application Asset Name Email Service Asset Description Internet Email used for internal workflows and communication with customers, vendors, suppliers, Etc. Asset Owner Technician1 Asset Location The Internet, Email Hosting Services LTD. Asset Maintainer Email Hosting Services LTD Aggregated Recovery Priority HIGH Supported Business Func#1 Expedited Service Contract Fulfilment Assets role /usage in function Exchange documents, including spare part requests, service reports. Document exchanges are not time critical. When rapid action is required then phone communication is preceding the document exchange. Recovery Priority Requirement HIGH Asset users Technician1, Technician2 Supported Business Func#3 Finance Assets role /usage in function Supports internal workflow and external communication Recovery Priority Requirement Medium Asset users All function’s users Supported Business Func#3 Customer Relationship Management Assets role /usage in function Supports internal workflow and external communication Recovery Priority Requirement Medium Asset users All function’s users

text: Asset Identification Card Card Creation/Update Date 18/12/2009 Asset Category Application Asset Name Company fixed-line phone numbers Asset Description Company fixed-line phones 0044 (0) 1223 234234 0044 (0) 1223 234235 Asset Owner Secretary Asset Location The phone numbers are assigned to the Company-PBX Asset Maintainer The telephone company Aggregated Recovery Priority HIGH Supported Business Func#1 Expedited Service Contract Fulfilment Assets role /usage in function Customers call to register their expedited support request Recovery Priority Requirement HIGH Asset users Customers, Salesman1, Salesman2 Supported Business Func#2 Finance Assets role /usage in function Same as office PBX Recovery Priority Requirement Asset users Supported Business Func#3 Customer Relationship management Assets role /usage in function Same as office PBX Recovery Priority Requirement Asset users

text: Asset Identification Card Card Creation/Update Date 18/12/2009 Asset Category Application Asset Name FAX Asset Description Company FAX number 0044 (0) 1223 234236 Asset Owner Secretary Asset Location The phone number is assigned to the Company FAX located in Office /room2 Asset Maintainer The telephone company Aggregated Recovery Priority Medium Supported Business Func#1 Finance Assets role /usage in function Mainly used for communication with equipment suppliers and less frequently with customers Recovery Priority Requirement Medium Asset users Customers, Secretary Supported Business Func#2 Assets role /usage in function Recovery Priority Requirement Asset users

text: Asset Identification Card Card Creation/Update Date 18/12/2009 Asset Category Application Asset Name Mobile-Phone-Tech1 Asset Description Business mobile phone for voice and SMS communication. Asset Owner Technician1 Asset Location Always with Technician1 Asset Maintainer Technician1 Aggregated Recovery Priority HIGH Supported Business Func#1 Expedited Service Contract Fulfilment Assets role /usage in function Communicate with Office, other technician, salesman, finance for spare part order(secretary) and customers Recovery Priority Requirement HIGH Asset users Technician1 Supported Business Func#2 - Assets role /usage in function Recovery Priority Requirement Asset users

text: Asset Identification Card Card Creation/Update Date 18/12/2009 Asset Category Application Asset Name Mobile-Phone-Tech2 Asset Description Business mobile phone for voice and SMS communication. Asset Owner Technician2 Asset Location Always with Technician2 Asset Maintainer Technician2 Aggregated Recovery Priority HIGH Supported Business Func#1 Expedited Service Contract Fulfilment Assets role /usage in function Communicate with Office, other technician, salesman, finance for spare part order(secretary) and customers Recovery Priority Requirement HIGH Asset users Technician2 Supported Business Func#2 - Assets role /usage in function Recovery Priority Requirement Asset users

text: Asset Identification Card Card Creation/Update Date 18/12/2009 Asset Category Application Asset Name Mobile-Phone-Salesman1 Asset Description Business mobile phone for voice and SMS communication. Asset Owner Salesman1 Asset Location Always with Saleman1 Asset Maintainer Saleman1 Aggregated Recovery Priority HIGH Supported Business Func#1 Expedited Service Contract Fulfilment Assets role /usage in function Communicate with Office, other technician, salesman, finance for spare part order(secretary) and customers Recovery Priority Requirement HIGH Asset users Saleman1 Supported Business Func#2 Customer Relationships Management Assets role /usage in function Receive customer communication or resolve issues with orders handled by finance when not in office. Recovery Priority Requirement Medium Asset users Salesman1

text: Asset Identification Card Card Creation/Update Date 18/12/2009 Asset Category Application Asset Name Mobile-Phone-Salesman2 Asset Description Business mobile phone for voice and SMS communication. Asset Owner Salesman2 Asset Location Always with Saleman2 Asset Maintainer Saleman2 Aggregated Recovery Priority HIGH Supported Business Func#1 Expedited Service Contract Fulfilment Assets role /usage in function Communicate with Office, other technician, salesman, finance for spare part order(secretary) and customers Recovery Priority Requirement HIGH Asset users Saleman2 Supported Business Func#2 Customer Relationships Management Assets role /usage in function Receive customer communication or resolve issues with orders handled by finance when not in office. Recovery Priority Requirement Medium Asset users Salesman2

text: Asset Identification Card Card Creation/Update Date 18/12/2009 Asset Category Application Asset Name Internet Service Provisioning Asset Description Used for all internal workflows supported by email. It is also used for communication with suppliers, customers and for web site updates. Asset Owner Company-Owner Asset Location Managed on the Internet router Asset Maintainer The Internet Service Provider. Aggregated Recovery Priority HIGH Supported Business Func#1 Expedited Service Contract Fulfilment Assets role /usage in function Communicate with Office, other technician, salesman, finance for spare part order(secretary) and customers Recovery Priority Requirement HIGH Asset users All function’s users Supported Business Func#2 Customer Relationships Management Assets role /usage in function Support functions workflow and external communication Recovery Priority Requirement Medium Asset users Salesman1, Salesman2, Company-owner Supported Business Func#3 Finance Assets role /usage in function Support functions workflow and external communication Recovery Priority Requirement Medium Asset users All function’s users.

text: Asset Identification Card Card Creation/Update Date 18/12/2009 Asset Category Application Asset Name Web Site Asset Description One of the marketing tools of the company. It contains static web pages advertising out products and contact information for the interested prospective customers (phone and email) Asset Owner Company-Owner Asset Location Web hosting provider Asset Maintainer Web hosting provider Aggregated Recovery Priority Medium Supported Business Func#1 Customer Relationships Management Assets role /usage in function Marketing tools of the company. Provide contact information Recovery Priority Requirement Medium Asset users Supported Business Func#2 Assets role /usage in function Recovery Priority Requirement

text: Asset Identification Card Card Creation/Update Date 18/12/2009 Asset Category Application Asset Name Financial control application Asset Description The application that holds the financial data and transactions. Allows client to access /update the warehouse stock and issue invoices Asset Owner Company owner Asset Location Financial control application server Asset Maintainer Financial control software supplier Aggregated Recovery Priority Medium Supported Business Func #1 Finance Assets role /usage in function Provides automation for the Finance function Recovery Priority Requirement Medium Asset users Company Owner, Accountant, Secretary. It is most of the time used remotely from their own computers. Supported Business Func #2 - Assets role /usage in function Recovery Priority Requirement Asset users

text: Asset Identification Card Card Creation/Update Date 18/12/2009 Asset Category Application Asset Name Office Productivity Applications Asset Description Used for all daily tasks and workflows. Preparing documents and spreadsheets, sending email and browsing the internet Asset Owner Company owner Asset Location On every computer system Asset Maintainer Technician2, External IT Expert Aggregated Recovery Priority The same assigned to each individual computer system Supported Business Func #1 Finance Assets role /usage in function Recovery Priority Requirement Medium Asset users Supported Business Func #2 Customer Relationships Management Assets role /usage in function Recovery Priority Requirement Medium Asset users Supported Business Func #2 Expedited Service Contract Fulfilment Assets role /usage in function Recovery Priority Requirement High Asset users

text: Data

text: Data Asset Identification Card Card Creation/Update Date 18/12/2009 Asset Category Data Asset Name Expedited Service Customer database Asset Description The list of the customers of this service including start and end dates of service provision. Asset Owner Company owner Asset Primary Storage Location Desktop-Sales2 - C:\SharedDocuments\ExpeditedServiceCustomers.csv

text: Asset Maintainer External IT Expert

text: Aggregate Recovery Priority High Supported Business Func#1 Expedited Service Contract Fulfilment Assets role /usage in function The list of the customers of this service including start and end dates of service provision. Recovery Priority Requirement High Asset users Salesman1, Salesman2 Supported Business Func#2 Assets role /usage in function Recovery Priority Requirement Asset users

text: Data Asset Identification Card Card Creation/Update Date Asset Category Data Asset Name Technicians work Planning Asset Description The planned repairs and maintenance schedule for the technicians. This is an essential planning tool for prioritising and scheduling execution of all technical work in a timely manner. Asset Owner Technician1 Asset Primary Storage Location Desktop-Sales2 - C:\SharedDocuments\TechWorkPlanning.csv Additional copies of the plan are stored in technicians’ laptops for reference. Technicians will copy the updated version as required. Asset Maintainer Salesman2 Aggregated Recovery Priority High Supported Business Func#1 Expedited Service Contract Fulfilment Assets role /usage in function Used to plan effectively and meet the tight repair times required by customers in this class of service. Recovery Priority Requirement High Asset users Salesman1, Salesman2, Technician1, Technician2 Supported Business Func#2 - Assets role /usage in function Recovery Priority Requirement Asset users

text: Data Asset Identification Card Card Creation/Update Date Asset Category Data Asset Name Medical equipment service manuals Asset Description Equipment specific service manuals. Indispensable tool for problem diagnosis, spare part identification and repair procedures. Asset Owner Technician1 Asset Primary Storage Location Laptop-Tech1 - C:\MyDocuments\ServiceManual Laptop-Tech2 - C:\MyDocuments\ServiceManual Asset Maintainer Technician1 Aggregated Recovery Priority High Supported Business Func#1 Expedited Service Contract Fulfilment Assets role /usage in function Technicians must have these manuals to perform effectively Recovery Priority Requirement High Asset users Technician1, Technician2 Supported Business Func#2 - Assets role /usage in function Recovery Priority Requirement Asset users

text: Data Asset Identification Card Card Creation/Update Date 18/12/2009 Asset Category Data Asset Name Spare part requests Asset Description Documents requesting spare parts required for equipment repairs. Once the service request is fulfilled this document becomes part of the service report. Asset Owner Technician1 Asset Storage Location Data scattered depending on the technician requesting the item. Laptop-Tech1 - C:\MyDocuments\ Laptop-Tech2 - C:\MyDocuments\ Asset Maintainer Technician1, Technician2 Aggregated Recovery Priority High Supported Business Func#1 Expedited Service Contract Fulfilment Assets role /usage in function Technicians must have these requests to track the availability of spare parts and keep the expedited repairs on schedule. Recovery Priority Requirement High Asset users Technician1, Technician2 Supported Business Func#2 Technical Support function Assets role /usage in function Technicians must have these requests to be able to schedule their normal repairs schedule. Recovery Priority Requirement Not critical business function Asset users Technician1, Technician2

text: Data Asset Identification Card Card Creation/Update Date 18/12/2009 Asset Category Data Asset Name Order Progress Tracking Asset Description A spreadsheet for tracking the state of supplies and equipment requests placed by technicians and salesman. Asset Owner Company Owner Asset Storage Location Desktop-Secretary – C:\MyDocuments\ Asset Maintainer External IT Expert Aggregated Recovery Priority Medium Supported Business Func#1 Finance Assets role /usage in function Required for tracking order status for spare parts, supplies and equipment. Recovery Priority Requirement Medium Asset users Secretary

text: Data Asset Identification Card Card Creation/Update Date Asset Category Data Asset Name Supplier Agreements and Contact information Asset Description Agreements for collaboration and product distribution for medical equipment. Included are contact details for orders and other issues Asset Owner Company owner Asset Storage Location Owner-Laptop (Folder MyDocuments\Suppliers) Secondary storage Secretary Desktop PC (Folder MyDocuments\Suppliers) Asset Maintainer External IT Expert Aggregated Recovery Priority Medium Supported Business Func#1 Finance Assets role /usage in function Recovery Priority Requirement Asset users Company Owner, Secretary Supported Business Func#2 Sales / Customer Relationship Assets role /usage in function Used to check with suppliers availability of products before committing to the customer Recovery Priority Requirement Asset users

text: People / Suppliers

text: People / Suppliers Identification Card Card Creation/Update Date 18/12/2009 Name External IT Expert Organization and address IT Valued Ltd.

text: (if not a company employee)

text: Department - Title -

text: (Role)

text: Key BCM Responsibilities (If contractual obligations exist, put a reference to the contract

text: Office Telephone +44 4556 445545 FAX +44 4556 445546 Mobile +44 4556 445547

text: Home Telephone

text: E-mail expert@itvalue.co.uk

text: People / Suppliers Identification Card Card Creation/Update Date 18/12/2009 Name Financial control software supplier Organization and address FCSS LTD

text: (if not a company employee)

text: Department - Title -

text: (Role)

text: Key BCM Responsibilities Financial control software. Onsite support contract in two

text: (If contractual obligations exist, put

text: business days and phone support during business hours.

text: a reference to the contract

text: Home Telephone

text: E-mail support@fcss.foo

text: People / Suppliers Identification Card Card Creation/Update Date 18/12/2009 Name John Stuart Organization and address Medical-Equipment-diagnosis-software1 Supplier

text: (if not a company employee)

text: Department - Title -

text: (Role)

text: Key BCM Responsibilities Provide software updates and business hours phone support

text: Home Telephone

text: E-mail john@meds1.foo

text: People / Suppliers Identification Card Card Creation/Update Date 18/12/2009 Name ISP Customer Support Organization and address Internet service provider

text: (if not a company employee)

text: Department - Title -

text: (Role)

text: Key BCM Responsibilities Standard ADSL service for business

text: Mobile

text: Home Telephone

text: E-mail support@isp.foo

text: Facilities

text: Facilities Identification Card Card Creation/Update Date 18/12/2009 Asset Category Facilities Asset Name Company Offices Asset Description The operating location of the company. Includes offices, IT and warehouse Asset Owner Warehouse Man Asset Location 12, Lisle st., Newcastle, UK Asset Maintainer Warehouse Man Aggregated Recovery Priority High Supported Business Func#1 Expedited Service Contract Fulfilment Supported Business Func#2 Finance Supported Business Func#3 Customer Relationship Management Supported Business Func#4 Supported Business Func#5