Cyber Control Readiness

Source ledger

5 sources. Every citation number above resolves to a record below. Nothing here sits behind an account.

1. [1]

   The NIST Cybersecurity Framework (CSF) 2.0 (NIST CSWP 29)(opens the original record on National Institute of Standards and Technology, U.S. Department of Commerce)

   National Institute of Standards and Technology, U.S. Department of CommerceSecondaryPrimaryJurisdiction USPublished February 26, 2024Effective February 26, 2024Last checked August 31, 2026Updates: major-revisionID nist-csf-2-0

   What this source supports (15)

   • The current edition is CSF 2.0, published February 26, 2024, available free of charge at https://doi.org/10.6028/NIST.CSWP.29.
   • CSF 2.0 organizes outcomes under six Functions: GOVERN (GV), IDENTIFY (ID), PROTECT (PR), DETECT (DE), RESPOND (RS), RECOVER (RC).
   • PR.AA-03: Users, services, and hardware are authenticated.
   • PR.AA-05: Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties.
   • PR.AT-01: Personnel are provided with awareness and training so that they possess the knowledge and skills to perform general tasks with cybersecurity risks in mind.
   • PR.DS-11: Backups of data are created, protected, maintained, and tested.
   • PR.PS-02: Software is maintained, replaced, and removed commensurate with risk.
   • DE.CM-01: Networks and network services are monitored to find potentially adverse events.
   • RS.MA-01: The incident response plan is executed in coordination with relevant third parties once an incident is declared.
   • RC.RP-03: The integrity of backups and other restoration assets is verified before using them for restoration.
   • GV.PO-01: Policy for managing cybersecurity risks is established based on organizational context, cybersecurity strategy, and priorities, and is communicated and enforced.
   • ID.IM-02: Improvements are identified from security tests and exercises, including those done in coordination with suppliers and relevant third parties.
   • The CSF does not prescribe how outcomes should be achieved; it offers a taxonomy of high-level cybersecurity outcomes usable by any organization regardless of size, sector, or maturity.
   • PR.DS-01: The confidentiality, integrity, and availability of data-at-rest are protected. PR.DS-02: The confidentiality, integrity, and availability of data-in-transit are protected.
   • Cybersecurity Supply Chain Risk Management (GV.SC) is a category within the GOVERN function, covering cyber supply chain risk management processes identified, established, managed, monitored, and improved by organizational stakeholders.

   Active
2. [2]

   Cross-Sector Cybersecurity Performance Goals, Version 2.0(opens the original record on Cybersecurity and Infrastructure Security Agency, U.S. Department of Homeland Security)

   Cybersecurity and Infrastructure Security Agency, U.S. Department of Homeland SecuritySecondaryPrimaryJurisdiction USPublished December 1, 2025Effective December 1, 2025Last checked August 31, 2026Updates: major-revisionID cisa-cpg-2-0

   What this source supports (23)

   • Cover page reads Cross-Sector Cybersecurity Performance Goals, Version 2.0, December 2025, Cybersecurity and Infrastructure Security Agency; marked TLP:CLEAR.
   • Contents are organized as 1. GOVERN, 2. IDENTIFY, 3. PROTECT, 4. DETECT, 5. RESPOND, 6. RECOVER, aligning to NIST Cybersecurity Framework version 2.0.
   • Goal 1.C MAINTAIN INCIDENT RESPONSE PLANS: organizations develop, maintain, update, and regularly exercise IR plans; IR plans should be reviewed and drilled, at a minimum, on an annual basis.
   • Goal 1.D SUPPLY CHAIN INCIDENT REPORTING AND VULNERABILITY DISCLOSURE addresses notifying a customer of security incidents and vulnerabilities within a risk-informed time frame.
   • Goal 2.C MITIGATE KNOWN VULNERABILITIES: implement a vulnerability management program to patch and mitigate misconfigured software in a timely manner, covering all organizational assets including those that face the internet.
   • Goal 3.D REVOKE CREDENTIALS FOR DEPARTING STAFF: a defined and enforced administrative process to offboard staff including revocation of all access; review user access and disable accounts when inactive for a specified period, for example 30 days.
   • Goal 3.F IMPLEMENT MULTIFACTOR AUTHENTICATION (MFA): organizations require MFA to access assets using the strongest available method; options sorted high to low are phishing-resistant MFA, then mobile app-based soft tokens, then SMS or voice only when no other options are possible; all IT accounts leverage MFA, prioritizing privileged administrative accounts.
   • Goal 3.H IMPLEMENT THE PRINCIPLES OF LEAST PRIVILEGE: user accounts do not have administrator privileges, administrators maintain separate user accounts for non-admin activity, and privileges are re-evaluated on a recurring basis to validate continued need.
   • Goal 3.J IMPLEMENT CYBERSECURITY TRAINING: new employees receive initial cybersecurity training prior to accessing computer systems, and at least annual cybersecurity training is provided for all organizational users covering recognizing social engineering, reporting suspicious activity, and basic cyber hygiene.
   • Goal 3.M ENABLE EMAIL SECURITY: on all corporate email infrastructure STARTTLS is enabled, SPF and DKIM are enabled, and DMARC is enabled and set to reject.
   • Goal 3.O MAINTAIN SYSTEM BACKUPS AND RESTORATION ABILITY: develop a list of all maintained backups including installation media, license keys, configuration information, and retention period; securely store backups offsite and offline; test backups and recovery on a recurring basis, no less than once per year; validate the integrity of backups before initiating restoration.
   • Goal 4.A ESTABLISH MALICIOUS CODE DETECTION: implement signature-based and non-signature-based mechanisms to detect and eradicate malicious code at system endpoints, organization-wide.
   • Goal 4.B IDENTIFY ADVERSE EVENTS: define clear criteria and processes for adverse events, and if an adverse event is suspected follow the protocol outlined in the incident response plan to escalate.
   • The CPGs are voluntary and strive to help small- and medium-sized organizations kickstart cybersecurity efforts by prioritizing a limited number of essential actions.
   • Goal 1.A ESTABLISH CYBERSECURITY RESPONSIBILITIES: roles, responsibilities, and authorities related to the organization's cybersecurity program are established, communicated, enforced, and aligned within the organization and external partners, and all roles and responsibilities involving cybersecurity should be documented in an organization's cybersecurity policy; scope reaches C-suite personnel, critical section leadership, physical and cybersecurity personnel, third-party contractors, vendors, and suppliers; NIST CSF 2.0 reference GV.RR-02.
   • Goal 1.B MANAGE CYBERSECURITY OVERSIGHT is a separate goal: policies for managing the cybersecurity program are reviewed at least annually, updated when changes are applied, communicated, and enforced; NIST CSF 2.0 reference GV.OV-03.
   • Goal 2.A MANAGE ORGANIZATIONAL ASSETS: maintain a regularly updated inventory of all organizational assets, meaning data, hardware, software, systems, facilities, and personnel, with IT and OT assets determined to be critical for business or operational functions updated on a more frequent basis.
   • Goal 3.K UTILIZE STRONG ENCRYPTION: use encryption, digital signatures, and cryptographic hashes to protect the confidentiality and integrity of network communications, and identify critical electronic file types and data to protect while in transit and at rest, which may include personally identifiable information and sensitive, proprietary or trade secret information.
   • Goal 2.B MITIGATE KNOWN VULNERABILITIES: implement a vulnerability management program to patch and mitigate misconfigured software in a timely manner, with a scope of all organizational assets, to include those that face the internet; monitor risk response progress through tools such as plan of action and milestones, risk registers, and risk detail reports; assign responsibilities and ensure procedures are followed. Goal 2.C is a different goal, OBTAIN INDEPENDENT VALIDATION OF CYBERSECURITY CONTROLS.
   • Goal 3.G ADMINISTRATORS MAINTAIN SEPARATE USER AND PRIVILEGED ACCOUNTS: user accounts do not have administrator privileges, administrators maintain separate user accounts for activities unrelated to their admin role, such as business email and web browsing, and privileges are re-evaluated on a recurring basis to validate continued need for a given set of permissions.
   • Goal 3.H IMPLEMENT THE PRINCIPLES OF LEAST PRIVILEGE: all user accounts, system roles, and processes operate with the minimum privileges necessary to perform their tasks, and quarterly reviews of access permissions and role assignments are performed to verify compliance with established policies.
   • Goal 3.L ENABLE EMAIL SECURITY: on all corporate email infrastructure (1) STARTTLS is enabled, (2) Sender Policy Framework (SPF) and DomainKeys Identified Mail (DKIM) are enabled, and (3) Domain-based Message Authentication, Reporting, and Conformance (DMARC) is enabled and set to reject; the stated outcome is reduced risk from spoofing, phishing, and interception. Goal 3.M is a different goal, DISABLE AUTORUN AND MACROS BY DEFAULT.
   • On small organizations the PDF says only that each organization faces unique cybersecurity challenges and that small- and medium-sized organizations may have limited budgets, staffing, and expertise; one of the stated criteria for a goal is that it be reasonably straightforward and not cost-prohibitive for small- and medium-sized entities to successfully implement. The voluntary and kickstart framing quoted in this module comes from the CISA program page, not from this PDF.

   Active
3. [3]

   Cross-Sector Cybersecurity Performance Goals (program page)(opens the original record on Cybersecurity and Infrastructure Security Agency, U.S. Department of Homeland Security)

   Cybersecurity and Infrastructure Security Agency, U.S. Department of Homeland SecuritySecondaryPrimaryJurisdiction USPublished December 1, 2025Effective December 1, 2025Last checked August 31, 2026Updates: as-neededID cisa-cpg-program-page

   What this source supports (7)

   • CISA's Cross-Sector Cybersecurity Performance Goals 2.0 are a subset of cybersecurity practices aimed at meaningfully reducing risks to critical infrastructure operations and the American people.
   • Cross-Sector CPGs 2.0 have been updated to align to the NIST Cybersecurity Framework (CSF) 2.0 functions and build upon the foundation established in version 1.0.1, with the addition of the GOVERN function.
   • Net-new goals address managed service providers (MSPs), the principle of least privileges, and incident communication procedures.
   • The CPGs are intended as a baseline set of practices broadly applicable across critical infrastructure and a benchmark for operators to measure and improve.
   • Sector-Specific Goals are available now for the Chemical, Energy (Distribution and Distributed Energy Resources), Healthcare, and Information Technology sectors, with Financial Services SSGs listed as coming.
   • A new CSET assessment module for CPG 2.0 and an updated CPG 2.0 Checklist are noted as becoming available in Q1 2026.
   • These voluntary Cross-Sector CPGs strive to help small- and medium-sized organizations kickstart their cybersecurity efforts by prioritizing investment in a limited number of essential actions with high-impact security outcomes.

   Active
4. [4]

   Cyber COPE (R) Transforming Cyber Underwriting (by Patrick Thielen)(opens the original record on Chubb)

   ChubbCarrier officialSecondaryJurisdiction USLast checked August 31, 2026Updates: Standalone whitepaper; no published revision schedule.ID chubb-cyber-cope-whitepaper

   What this source supports (4)

   • The paper defines COPE as Construction, Occupancy, Protection, and Exposures, and calls it a straightforward and effective method of examining diverse measurements to help underwriters make better decisions about property risk.
   • The paper refers to COPE as a time-tested property underwriting model.
   • The paper opens with four sample questions it says insurance companies ask so they can properly and thoroughly underwrite risks presented for coverage: how tall is your office building, how close is the nearest fire hydrant, does the building have an alarm system, and are you in a flood zone.
   • The paper states that in the 1700s the risk of fire made it difficult for many commercial property owners to secure the insurance coverage they needed, and that over time the industry adopted the COPE concept.

   Fetched today. WebFetch returned PDF binary, so the text was extracted locally with pdftotext -layout and read directly. The title page reads Cyber COPE (registered mark) Transforming Cyber Underwriting, with no colon, and credits Patrick Thielen; the registered-trademark symbol is transliterated as (R) here to keep the record ASCII. No publication date appears in the extracted text, so publishedDate is left unknown. This is a cyber underwriting paper that describes the property COPE model it is adapting; it is cited only for its description of COPE, not as a commercial property underwriting guide. It says nothing about whether carriers must use COPE or about how application forms were designed.

   Active
5. [5]

   45 CFR 164.404 - Notification to individuals (HIPAA Breach Notification Rule)(opens the original record on Cornell Legal Information Institute, reproducing the Code of Federal Regulations)

   Cornell Legal Information Institute, reproducing the Code of Federal RegulationsSecondarySecondaryJurisdiction USThird-party reproductionPublished January 25, 2013Effective March 26, 2013Last checked August 31, 2026Updates: on-amendmentID cfr-45-164-404-lii

   What this source supports (2)

   • Paragraph (b), Implementation specification: Timeliness of notification, provides that a covered entity shall provide the notification required by paragraph (a) without unreasonable delay and in no case later than 60 calendar days after discovery of a breach.
   • The 60 calendar day period runs from discovery of the breach, and is an outer limit rather than a safe harbor, because notification must also be without unreasonable delay.

   ActiveReproduction