[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"frameworks-index":3},{"items":4},[5,11,17,22,28,33,38,43,48,53,58,63,68,74,79,85,90,95,100,105,110,115,120,125,130,135,138,143,148,153,158,163,168,172,177,182,187,192,197,202,207,212,217,222,227,232,237,243,248,252,257,261,266,271,277,282,287,292,297,302,308,313,318,323,329,334,338,342,347,352,357,361,367,372,377,382,388,393,398,402,407,412,417,422,427,433,437,442,447,452,457,462,467,472,475,480,485,490,494,499,504,509,514,518,522,527,532,537,541,546,551,555,560,565,569,574,577,582,586,590,593,597,601,606,611,616,620,624,629,633,637,642,647,652,656,661,665,668,673,677,682,686,690,695,700,704,708,713,717,721,725,730,734,738,743,747,751,756,760,765,769,774,778,782,787,791,795,799,803,806,811,815,819,823,827,831,835,839,843,848,852,856,860,864,868,872,877,881,885,889,892,896,901,905,909,912,916,921,925,929,933,937,940,944,948,952,956,961,965,969,973,977,981,986,990,994,998,1002,1006,1010,1014,1018,1023,1027,1031,1035,1040,1044,1047,1051,1055,1059,1063,1068,1072,1076,1080,1084,1088,1092,1097,1101,1105,1109,1113,1118,1121,1125,1129,1133,1137,1141,1145,1150,1154,1158,1162,1166,1170,1174,1178,1183,1187,1191,1195,1199,1203,1207,1211,1215,1220,1224,1228,1232,1236,1240,1244,1248,1252,1256,1260,1264,1267,1270,1275,1279,1283,1287,1290,1294,1298,1302,1306,1310,1314,1318,1322,1326,1331,1335,1339,1343,1347,1351,1355,1359,1363,1367,1371,1375,1379,1383,1387,1391,1395,1399,1403,1407,1411,1415,1419,1423,1428,1432,1436,1440,1444,1448,1452,1456,1460,1464,1468,1472,1476,1480,1484,1488,1492,1496,1500,1504,1508,1513,1517,1521,1525,1529,1533,1537,1541,1544,1548,1552,1556,1559,1563,1567,1571,1574,1578,1582,1586,1590,1594,1598,1602,1606,1610,1614,1618,1622,1626,1630,1634,1638,1642,1646,1650,1654,1659,1661,1665,1669,1673,1677,1681,1685,1690,1694,1698,1700,1704,1707,1711,1715,1719,1723,1728,1732,1736,1738,1742,1746,1750,1754,1758,1762,1766,1770,1774,1778,1780,1784,1788,1792,1796,1800,1804,1808,1812,1816,1820,1824,1826,1830,1834,1838,1840,1844,1847,1851,1855,1859,1863,1867,1869,1872,1877,1880,1882,1884,1888,1891,1895,1899,1903,1907,1911,1915,1919,1923,1927,1931,1935,1937,1941,1945,1949,1953,1957,1961,1965,1969,1973,1977,1981,1983,1987,1991,1995,1997,2000,2002,2004,2006,2008,2010,2011,2012,2014,2016,2018,2020,2022,2024,2028,2032,2036,2038,2040,2042,2045,2047,2049,2053,2057,2061,2065,2069,2073,2077,2081,2085,2089,2093,2097,2101,2105,2109,2113,2117,2121,2125,2129,2133,2137,2141,2145,2149,2153,2157,2161,2165,2169,2173,2177,2181,2185,2189,2193,2195,2197,2201,2205,2208,2212,2214,2218,2222,2226,2228,2230],{"family":6,"item":7,"code":8,"title":9,"citations":10},"cis","7","Control 7","Continuous Vulnerability Management",2577,{"family":12,"item":13,"code":14,"title":15,"citations":16},"gdpr","32","Article 32","Security of processing",2391,{"family":18,"item":19,"code":20,"title":20,"citations":21},"itil","overview","ITIL",2370,{"family":23,"item":24,"code":25,"title":26,"citations":27},"nist-800-53","si-2","SI-2","Flaw Remediation",1770,{"family":6,"item":29,"code":30,"title":31,"citations":32},"6","Control 6","Access Control Management",1658,{"family":6,"item":34,"code":35,"title":36,"citations":37},"12","Control 12","Network Infrastructure Management",1592,{"family":6,"item":39,"code":40,"title":41,"citations":42},"3","Control 3","Data Protection",1542,{"family":6,"item":44,"code":45,"title":46,"citations":47},"13","Control 13","Network Monitoring and Defense",1398,{"family":23,"item":49,"code":50,"title":51,"citations":52},"ac-2","AC-2","Account Management",1394,{"family":6,"item":54,"code":55,"title":56,"citations":57},"2","Control 2","Inventory and Control of Software Assets",1377,{"family":6,"item":59,"code":60,"title":61,"citations":62},"4","Control 4","Secure Configuration of Enterprise Assets and Software",956,{"family":23,"item":64,"code":65,"title":66,"citations":67},"ac-6","AC-6","Least Privilege",914,{"family":69,"item":70,"code":71,"title":72,"citations":73},"nist-sp","800-40","SP 800-40","SP 800-40 Rev. 4: Guide to Enterprise Patch Management Planning: Preventive Maintenance for Technology",908,{"family":6,"item":75,"code":76,"title":77,"citations":78},"14","Control 14","Security Awareness and Skills Training",900,{"family":80,"item":81,"code":82,"title":83,"citations":84},"nist-csf","de-cm","DE.CM-1","Continuous Monitoring",869,{"family":23,"item":86,"code":87,"title":88,"citations":89},"si-3","SI-3","Malicious Code Protection",831,{"family":23,"item":91,"code":92,"title":93,"citations":94},"ra-5","RA-5","Vulnerability Monitoring and Scanning",824,{"family":23,"item":96,"code":97,"title":98,"citations":99},"sc-7","SC-7","Boundary Protection",821,{"family":69,"item":101,"code":102,"title":103,"citations":104},"800-161","SP 800-161","SP 800-161 Rev. 1: Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations",800,{"family":23,"item":106,"code":107,"title":108,"citations":109},"ac-3","AC-3","Access Enforcement",790,{"family":12,"item":111,"code":112,"title":113,"citations":114},"5","Article 5(1)(f)","Principles relating to processing of personal data",775,{"family":6,"item":116,"code":117,"title":118,"citations":119},"16","Control 16","Application Software Security",770,{"family":6,"item":121,"code":122,"title":123,"citations":124},"8","Control 8","Audit Log Management",740,{"family":12,"item":126,"code":127,"title":128,"citations":129},"25","Article 25","Data protection by design and by default",689,{"family":23,"item":131,"code":132,"title":133,"citations":134},"ir-4","IR-4","Incident Handling",678,{"family":6,"item":111,"code":136,"title":51,"citations":137},"Control 5",581,{"family":80,"item":139,"code":140,"title":141,"citations":142},"pr-ds","PR.DS-1","Data Security",561,{"family":144,"item":19,"code":145,"title":146,"citations":147},"nist-ai-rmf","AI RMF 1.0","AI Risk Management Framework (AI RMF 1.0)",556,{"family":12,"item":149,"code":150,"title":151,"citations":152},"33","Article 33","Notification of a personal data breach to the supervisory authority",522,{"family":80,"item":154,"code":155,"title":156,"citations":157},"pr-ac","PR.AC-1","Identity Management, Authentication and Access Control (CSF 1.1)",517,{"family":23,"item":159,"code":160,"title":161,"citations":162},"si-4","SI-4","System Monitoring",508,{"family":23,"item":164,"code":165,"title":166,"citations":167},"ac-17","AC-17","Remote Access",494,{"family":23,"item":169,"code":170,"title":171,"citations":167},"at-2","AT-2","Literacy Training and Awareness",{"family":173,"item":173,"code":174,"title":175,"citations":176},"owasp","OWASP","OWASP (Open Worldwide Application Security Project)",491,{"family":178,"item":19,"code":179,"title":180,"citations":181},"nist-privacy","Privacy Framework","NIST Privacy Framework",469,{"family":6,"item":183,"code":184,"title":185,"citations":186},"17","Control 17","Incident Response Management",457,{"family":80,"item":188,"code":189,"title":190,"citations":191},"id-ra","ID.RA-1","Risk Assessment",436,{"family":23,"item":193,"code":194,"title":195,"citations":196},"ia-5","IA-5","Authenticator Management",378,{"family":69,"item":198,"code":199,"title":200,"citations":201},"800-82","SP 800-82","SP 800-82 Rev. 3: Guide to Operational Technology (OT) Security",369,{"family":23,"item":203,"code":204,"title":205,"citations":206},"au-6","AU-6","Audit Record Review, Analysis, and Reporting",355,{"family":69,"item":208,"code":209,"title":210,"citations":211},"800-218","SP 800-218","SP 800-218: Secure Software Development Framework (SSDF) Version 1.1",338,{"family":6,"item":213,"code":214,"title":215,"citations":216},"9","Control 9","Email and Web Browser Protections",332,{"family":23,"item":218,"code":219,"title":220,"citations":221},"cm-6","CM-6","Configuration Settings",315,{"family":6,"item":223,"code":224,"title":225,"citations":226},"10","Control 10","Malware Defenses",305,{"family":23,"item":228,"code":229,"title":230,"citations":231},"sa-12","SA-12","Supply Chain Protection",304,{"family":233,"item":19,"code":234,"title":235,"citations":236},"slsa","SLSA","SLSA (Supply-chain Levels for Software Artifacts)",294,{"family":238,"item":239,"code":240,"title":241,"citations":242},"iso","27701","ISO\u002FIEC 27701","ISO\u002FIEC 27701: Privacy information management systems",287,{"family":6,"item":244,"code":245,"title":246,"citations":247},"11","Control 11","Data Recovery",283,{"family":69,"item":249,"code":250,"title":251,"citations":247},"800-61","SP 800-61","SP 800-61 Rev. 3: Incident Response Recommendations and Considerations for Cybersecurity Risk Management",{"family":23,"item":253,"code":254,"title":255,"citations":256},"cm-7","CM-7","Least Functionality",279,{"family":12,"item":29,"code":258,"title":259,"citations":260},"Article 6","Lawfulness of processing",275,{"family":80,"item":262,"code":263,"title":264,"citations":265},"rs-mi","RS.MI-3","Mitigation (CSF 1.1)",274,{"family":23,"item":267,"code":268,"title":269,"citations":270},"si-7","SI-7","Software, Firmware, and Information Integrity",273,{"family":272,"item":273,"code":274,"title":275,"citations":276},"cisa","kev","KEV","Known Exploited Vulnerabilities (KEV) Catalog",268,{"family":23,"item":278,"code":279,"title":280,"citations":281},"au-12","AU-12","Audit Record Generation",266,{"family":6,"item":283,"code":284,"title":285,"citations":286},"15","Control 15","Service Provider Management",262,{"family":80,"item":288,"code":289,"title":290,"citations":291},"id-am","ID.AM-2","Asset Management",258,{"family":80,"item":293,"code":294,"title":295,"citations":296},"pr-ip","PR.IP-12","Information Protection Processes and Procedures (CSF 1.1)",253,{"family":6,"item":298,"code":299,"title":300,"citations":301},"1","Control 1","Inventory and Control of Enterprise Assets",242,{"family":303,"item":304,"code":305,"title":306,"citations":307},"iso-27001","a-8-8","Annex A 8.8","ISO\u002FIEC 27001:2022 Annex A 8.8: Management of technical vulnerabilities",240,{"family":12,"item":309,"code":310,"title":311,"citations":312},"28","Article 28","Processor",235,{"family":23,"item":314,"code":315,"title":316,"citations":317},"si-10","SI-10","Information Input Validation",229,{"family":80,"item":319,"code":320,"title":321,"citations":322},"id-sc","ID.SC-4","Supply Chain Risk Management (CSF 1.1)",219,{"family":324,"item":325,"code":326,"title":327,"citations":328},"iec-62443","3-3","62443-3-3","IEC 62443-3-3: System security requirements and security levels",215,{"family":12,"item":330,"code":331,"title":332,"citations":333},"35","Article 35","Data protection impact assessment",210,{"family":23,"item":335,"code":336,"title":337,"citations":333},"ir-6","IR-6","Incident Reporting",{"family":69,"item":339,"code":340,"title":341,"citations":333},"800-63","SP 800-63","SP 800-63: Digital Identity Guidelines",{"family":80,"item":343,"code":344,"title":345,"citations":346},"pr-at","PR.AT-1","Awareness and Training",209,{"family":23,"item":348,"code":349,"title":350,"citations":351},"ia-2","IA-2","Identification and Authentication (Organizational Users)",200,{"family":23,"item":353,"code":354,"title":355,"citations":356},"sc-28","SC-28","Protection of Information at Rest",194,{"family":12,"item":44,"code":358,"title":359,"citations":360},"Article 13","Information to be provided where personal data are collected from the data subject",182,{"family":362,"item":363,"code":364,"title":365,"citations":366},"hipaa","security-rule","Security Rule","HIPAA Security Rule",181,{"family":173,"item":368,"code":369,"title":370,"citations":371},"top10-2021-a06","A06:2021","A06:2021 Vulnerable and Outdated Components",175,{"family":23,"item":373,"code":374,"title":375,"citations":376},"cm-8","CM-8","System Component Inventory",173,{"family":23,"item":378,"code":379,"title":380,"citations":381},"au-2","AU-2","Event Logging",167,{"family":383,"item":384,"code":385,"title":386,"citations":387},"mitre-attack","t1566","T1566","Phishing",160,{"family":6,"item":389,"code":390,"title":391,"citations":392},"18","Control 18","Penetration Testing",153,{"family":238,"item":394,"code":395,"title":396,"citations":397},"27036","ISO\u002FIEC 27036","ISO\u002FIEC 27036: Cybersecurity, Supplier relationships",141,{"family":12,"item":213,"code":399,"title":400,"citations":401},"Article 9","Processing of special categories of personal data",133,{"family":272,"item":403,"code":404,"title":405,"citations":406},"bod-22-01","BOD 22-01","BOD 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities",130,{"family":23,"item":408,"code":409,"title":410,"citations":411},"pt-2","PT-2","Authority to Process Personally Identifiable Information",129,{"family":23,"item":413,"code":414,"title":415,"citations":416},"sa-9","SA-9","External System Services",126,{"family":238,"item":418,"code":419,"title":420,"citations":421},"42001","ISO\u002FIEC 42001","ISO\u002FIEC 42001: Artificial intelligence management system",122,{"family":383,"item":423,"code":424,"title":425,"citations":426},"t1078","T1078","Valid Accounts",120,{"family":428,"item":429,"code":430,"title":431,"citations":432},"nerc-cip","cip-007","CIP-007-6","CIP-007: Systems Security Management",119,{"family":383,"item":19,"code":434,"title":435,"citations":436},"ATT&CK","MITRE ATT&CK",117,{"family":23,"item":438,"code":439,"title":440,"citations":441},"ac-4","AC-4","Information Flow Enforcement",116,{"family":173,"item":443,"code":444,"title":445,"citations":446},"asvs","ASVS","OWASP Application Security Verification Standard (ASVS)",115,{"family":80,"item":448,"code":449,"title":450,"citations":451},"rs-rp","RS.RP-1","Response Planning (CSF 1.1)",111,{"family":69,"item":453,"code":454,"title":455,"citations":456},"800-124","SP 800-124","SP 800-124 Rev. 2: Guidelines for Managing the Security of Mobile Devices in the Enterprise",110,{"family":383,"item":458,"code":459,"title":460,"citations":461},"t1190","T1190","Exploit Public-Facing Application",106,{"family":238,"item":463,"code":464,"title":465,"citations":466},"27035","ISO\u002FIEC 27035","ISO\u002FIEC 27035: Information security incident management",103,{"family":23,"item":468,"code":469,"title":470,"citations":471},"cm-2","CM-2","Baseline Configuration",100,{"family":12,"item":7,"code":473,"title":474,"citations":471},"Article 7","Conditions for consent",{"family":80,"item":476,"code":477,"title":478,"citations":479},"de-ae","DE.AE-2","Adverse Event Analysis",97,{"family":23,"item":481,"code":482,"title":483,"citations":484},"sa-11","SA-11","Developer Testing and Evaluation",93,{"family":23,"item":486,"code":487,"title":488,"citations":489},"cm-3","CM-3","Configuration Change Control",92,{"family":12,"item":183,"code":491,"title":492,"citations":493},"Article 17","Right to erasure ('right to be forgotten')",90,{"family":80,"item":495,"code":496,"title":497,"citations":498},"rs-co","RS.CO-2","Incident Response Reporting and Communication",89,{"family":23,"item":500,"code":501,"title":502,"citations":503},"sc-8","SC-8","Transmission Confidentiality and Integrity",88,{"family":12,"item":505,"code":506,"title":507,"citations":508},"30","Article 30","Records of processing activities",84,{"family":510,"item":511,"code":512,"title":513,"citations":508},"pci-dss","requirement-6","Requirement 6.3","Requirement 6: Develop and Maintain Secure Systems and Software",{"family":12,"item":283,"code":515,"title":516,"citations":517},"Article 15","Right of access by the data subject",82,{"family":12,"item":519,"code":520,"title":521,"citations":517},"34","Article 34","Communication of a personal data breach to the data subject",{"family":69,"item":523,"code":524,"title":525,"citations":526},"800-207","SP 800-207","SP 800-207: Zero Trust Architecture",81,{"family":12,"item":528,"code":529,"title":530,"citations":531},"83","Article 83","General conditions for imposing administrative fines",79,{"family":23,"item":533,"code":534,"title":535,"citations":536},"si-12","SI-12","Information Management and Retention",74,{"family":428,"item":538,"code":539,"title":540,"citations":536},"cip-005","CIP-005","CIP-005: Electronic Security Perimeter(s)",{"family":69,"item":542,"code":543,"title":544,"citations":545},"800-50","SP 800-50","SP 800-50 Rev. 1: Building a Cybersecurity and Privacy Learning Program",73,{"family":23,"item":547,"code":548,"title":549,"citations":550},"cp-9","CP-9","System Backup",70,{"family":324,"item":19,"code":552,"title":553,"citations":554},"62443","IEC 62443 series",69,{"family":383,"item":556,"code":557,"title":558,"citations":559},"t1068","T1068","Exploitation for Privilege Escalation",68,{"family":23,"item":561,"code":562,"title":563,"citations":564},"ac-7","AC-7","Unsuccessful Logon Attempts",66,{"family":173,"item":566,"code":567,"title":568,"citations":564},"top10-2021-a03","A03:2021","A03:2021 Injection",{"family":383,"item":570,"code":571,"title":572,"citations":573},"t1059","T1059","Command and Scripting Interpreter",65,{"family":12,"item":34,"code":575,"title":576,"citations":573},"Article 12","Transparent information, communication and modalities for the exercise of the rights of the data subject",{"family":12,"item":578,"code":579,"title":580,"citations":581},"22","Article 22","Automated individual decision-making, including profiling",63,{"family":173,"item":583,"code":584,"title":585,"citations":581},"top10-2021-a05","A05:2021","A05:2021 Security Misconfiguration",{"family":12,"item":19,"code":587,"title":588,"citations":589},"GDPR","General Data Protection Regulation (GDPR)",55,{"family":23,"item":591,"code":592,"title":83,"citations":589},"ca-7","CA-7",{"family":12,"item":59,"code":594,"title":595,"citations":596},"Article 4(11)","Definitions",54,{"family":23,"item":598,"code":599,"title":190,"citations":600},"ra-3","RA-3",53,{"family":238,"item":602,"code":603,"title":604,"citations":605},"29101","ISO\u002FIEC 29101","ISO\u002FIEC 29101: Privacy architecture framework",51,{"family":324,"item":607,"code":608,"title":609,"citations":610},"2-1","62443-2-1","IEC 62443-2-1: Security program requirements for IACS asset owners",48,{"family":272,"item":612,"code":613,"title":614,"citations":615},"cpg","CPGs","Cross-Sector Cybersecurity Performance Goals (CPGs)",46,{"family":617,"item":213,"code":399,"title":618,"citations":619},"eu-ai-act","Risk management system",45,{"family":23,"item":621,"code":622,"title":623,"citations":619},"sc-18","SC-18","Mobile Code",{"family":69,"item":625,"code":626,"title":627,"citations":628},"800-137","SP 800-137","SP 800-137: Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations",44,{"family":12,"item":630,"code":631,"title":632,"citations":628},"24","Article 24","Responsibility of the controller",{"family":383,"item":634,"code":635,"title":636,"citations":628},"t1071","T1071","Application Layer Protocol",{"family":383,"item":638,"code":639,"title":640,"citations":641},"t1539","T1539","Steal Web Session Cookie",42,{"family":383,"item":643,"code":644,"title":645,"citations":646},"t1219","T1219","Remote Access Tools",41,{"family":80,"item":648,"code":649,"title":650,"citations":651},"rs-an","RS.AN-1","Incident Analysis",39,{"family":173,"item":653,"code":654,"title":655,"citations":651},"top10-2021-a08","A08:2021","A08:2021 Software and Data Integrity Failures",{"family":303,"item":657,"code":658,"title":659,"citations":660},"a-5-34","Annex A 5.34","ISO\u002FIEC 27001:2022 Annex A 5.34: Privacy and protection of PII",38,{"family":23,"item":662,"code":663,"title":664,"citations":660},"ac-20","AC-20","Use of External Systems",{"family":12,"item":75,"code":666,"title":667,"citations":660},"Article 14","Information to be provided where personal data have not been obtained from the data subject",{"family":383,"item":669,"code":670,"title":671,"citations":672},"t1566-001","T1566.001","Spearphishing Attachment",37,{"family":383,"item":674,"code":675,"title":676,"citations":672},"t1486","T1486","Data Encrypted for Impact",{"family":23,"item":678,"code":679,"title":680,"citations":681},"pt-1","PT-1","Policy and Procedures",36,{"family":173,"item":683,"code":684,"title":685,"citations":681},"top10-2021-a01","A01:2021","A01:2021 Broken Access Control",{"family":23,"item":687,"code":688,"title":689,"citations":681},"sa-15","SA-15","Development Process, Standards, and Tools",{"family":383,"item":691,"code":692,"title":693,"citations":694},"t1195","T1195","Supply Chain Compromise",35,{"family":69,"item":696,"code":697,"title":698,"citations":699},"800-57","SP 800-57","SP 800-57: Recommendation for Key Management",34,{"family":383,"item":701,"code":702,"title":703,"citations":699},"t1566-002","T1566.002","Spearphishing Link",{"family":12,"item":705,"code":706,"title":707,"citations":699},"37","Article 37","Designation of the data protection officer",{"family":383,"item":709,"code":710,"title":711,"citations":712},"t1562-001","T1562.001","Disable or Modify Tools",32,{"family":69,"item":714,"code":715,"title":716,"citations":712},"800-188","SP 800-188","SP 800-188: De-Identifying Government Datasets: Techniques and Governance",{"family":383,"item":718,"code":719,"title":720,"citations":712},"t1528","T1528","Steal Application Access Token",{"family":383,"item":722,"code":723,"title":724,"citations":712},"t1204-002","T1204.002","Malicious File",{"family":23,"item":726,"code":727,"title":728,"citations":729},"sr-3","SR-3","Supply Chain Controls and Processes",30,{"family":23,"item":731,"code":732,"title":733,"citations":729},"si-8","SI-8","Spam Protection",{"family":23,"item":735,"code":736,"title":737,"citations":729},"sc-39","SC-39","Process Isolation",{"family":23,"item":739,"code":740,"title":741,"citations":742},"ir-8","IR-8","Incident Response Plan",29,{"family":69,"item":744,"code":745,"title":746,"citations":742},"800-171","SP 800-171","SP 800-171 Rev. 3: Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations",{"family":510,"item":748,"code":749,"title":750,"citations":742},"requirement-3","Requirement 3.4","Requirement 3: Protect Stored Account Data",{"family":383,"item":752,"code":753,"title":754,"citations":755},"t1102","T1102","Web Service",28,{"family":12,"item":757,"code":758,"title":759,"citations":755},"58","Article 58","Powers",{"family":173,"item":761,"code":762,"title":763,"citations":764},"scvs","SCVS","OWASP Software Component Verification Standard (SCVS)",27,{"family":383,"item":766,"code":767,"title":768,"citations":764},"t1027","T1027","Obfuscated Files or Information",{"family":23,"item":770,"code":771,"title":772,"citations":773},"ia-3","IA-3","Device Identification and Authentication",26,{"family":23,"item":775,"code":776,"title":777,"citations":773},"au-9","AU-9","Protection of Audit Information",{"family":69,"item":779,"code":780,"title":781,"citations":773},"800-34","SP 800-34","SP 800-34 Rev. 1: Contingency Planning Guide for Federal Information Systems",{"family":362,"item":783,"code":784,"title":785,"citations":786},"breach-notification","§164.400","HIPAA Breach Notification Rule",25,{"family":12,"item":788,"code":789,"title":790,"citations":786},"82","Article 82","Right to compensation and liability",{"family":80,"item":792,"code":793,"title":794,"citations":786},"rc-rp","RC.RP-1","Recovery Planning (CSF 1.1)",{"family":510,"item":796,"code":797,"title":798,"citations":786},"requirement-8","Requirement 8.2","Requirement 8: Identify Users and Authenticate Access to System Components",{"family":23,"item":800,"code":801,"title":802,"citations":786},"sr-6","SR-6","Supplier Assessments and Reviews",{"family":23,"item":804,"code":805,"title":391,"citations":786},"ca-8","CA-8",{"family":12,"item":807,"code":808,"title":809,"citations":810},"44","Article 44","General principle for transfers",24,{"family":383,"item":812,"code":813,"title":814,"citations":810},"t1574-002","T1574.002","DLL Side-Loading",{"family":383,"item":816,"code":817,"title":818,"citations":810},"t1557","T1557","Adversary-in-the-Middle",{"family":69,"item":820,"code":821,"title":822,"citations":810},"800-190","SP 800-190","SP 800-190: Application Container Security Guide",{"family":23,"item":824,"code":825,"title":826,"citations":810},"pt-5","PT-5","Privacy Notice",{"family":12,"item":828,"code":829,"title":830,"citations":810},"21","Article 21","Right to object",{"family":69,"item":832,"code":833,"title":834,"citations":810},"800-208","SP 800-208","SP 800-208: Recommendation for Stateful Hash-Based Signature Schemes",{"family":80,"item":836,"code":837,"title":838,"citations":810},"pr-pt","PR.PT-4","Protective Technology (CSF 1.1)",{"family":69,"item":840,"code":841,"title":842,"citations":810},"800-177","SP 800-177","SP 800-177 Rev. 1: Trustworthy Email",{"family":69,"item":844,"code":845,"title":846,"citations":847},"800-193","SP 800-193","SP 800-193: Platform Firmware Resiliency Guidelines",23,{"family":849,"item":828,"code":829,"title":850,"citations":851},"nis2","Cybersecurity risk-management measures",22,{"family":23,"item":853,"code":854,"title":855,"citations":851},"pt-3","PT-3","Personally Identifiable Information Processing Purposes",{"family":857,"item":19,"code":858,"title":859,"citations":851},"mitre-atlas","ATLAS","MITRE ATLAS (Adversarial Threat Landscape for AI Systems)",{"family":383,"item":861,"code":862,"title":863,"citations":851},"t1059-001","T1059.001","PowerShell",{"family":383,"item":865,"code":866,"title":867,"citations":851},"t1555","T1555","Credentials from Password Stores",{"family":23,"item":869,"code":870,"title":871,"citations":851},"ps-3","PS-3","Personnel Screening",{"family":23,"item":873,"code":874,"title":875,"citations":876},"ia-8","IA-8","Identification and Authentication (Non-organizational Users)",21,{"family":23,"item":878,"code":879,"title":880,"citations":876},"sc-5","SC-5","Denial-of-service Protection",{"family":80,"item":882,"code":883,"title":884,"citations":876},"gv-oc","GV.OC","Organizational Context",{"family":383,"item":886,"code":887,"title":888,"citations":876},"t1203","T1203","Exploitation for Client Execution",{"family":23,"item":890,"code":891,"title":680,"citations":876},"ir-1","IR-1",{"family":23,"item":893,"code":894,"title":895,"citations":876},"cp-2","CP-2","Contingency Plan",{"family":69,"item":897,"code":898,"title":899,"citations":900},"800-213","SP 800-213","SP 800-213: IoT Device Cybersecurity Guidance for the Federal Government: Establishing IoT Device Cybersecurity Requirements",20,{"family":383,"item":902,"code":903,"title":904,"citations":900},"t1036","T1036","Masquerading",{"family":510,"item":906,"code":907,"title":908,"citations":900},"requirement-10","Requirement 10","Requirement 10: Log and Monitor All Access to System Components and Cardholder Data",{"family":617,"item":19,"code":910,"title":911,"citations":900},"AI Act","Artificial Intelligence Act (Regulation (EU) 2024\u002F1689)",{"family":173,"item":913,"code":914,"title":915,"citations":900},"top10-2021-a07","A07:2021","A07:2021 Identification and Authentication Failures",{"family":23,"item":917,"code":918,"title":919,"citations":920},"ia-4","IA-4","Identifier Management",19,{"family":80,"item":922,"code":923,"title":924,"citations":920},"gv-sc","GV.SC","Cybersecurity Supply Chain Risk Management",{"family":23,"item":926,"code":927,"title":928,"citations":920},"ac-12","AC-12","Session Termination",{"family":383,"item":930,"code":931,"title":932,"citations":920},"t1572","T1572","Protocol Tunneling",{"family":383,"item":934,"code":935,"title":936,"citations":920},"t1055","T1055","Process Injection",{"family":12,"item":121,"code":938,"title":939,"citations":920},"Article 8","Conditions applicable to child's consent in relation to information society services",{"family":173,"item":941,"code":942,"title":943,"citations":920},"samm","SAMM","OWASP Software Assurance Maturity Model (SAMM)",{"family":857,"item":945,"code":946,"title":947,"citations":920},"aml-t0051","AML.T0051","LLM Prompt Injection",{"family":23,"item":949,"code":950,"title":951,"citations":920},"pe-3","PE-3","Physical Access Control",{"family":383,"item":953,"code":954,"title":955,"citations":920},"t1090","T1090","Proxy",{"family":510,"item":957,"code":958,"title":959,"citations":960},"requirement-12","Requirement 12.6","Requirement 12: Support Information Security with Organizational Policies and Programs",18,{"family":383,"item":962,"code":963,"title":964,"citations":960},"t1505-003","T1505.003","Web Shell",{"family":383,"item":966,"code":967,"title":968,"citations":960},"t1071-001","T1071.001","Web Protocols",{"family":303,"item":970,"code":971,"title":972,"citations":960},"a-5-19","Annex A 5.19","ISO\u002FIEC 27001:2022 Annex A 5.19: Information security in supplier relationships",{"family":510,"item":974,"code":975,"title":976,"citations":960},"requirement-7","Requirement 7.1","Requirement 7: Restrict Access to System Components and Cardholder Data by Business Need to Know",{"family":303,"item":978,"code":979,"title":980,"citations":960},"a-8-3","Annex A 8.3","ISO\u002FIEC 27001:2022 Annex A 8.3: Information access restriction",{"family":173,"item":982,"code":983,"title":984,"citations":985},"top10-2021-a02","A02:2021","A02:2021 Cryptographic Failures",17,{"family":23,"item":987,"code":988,"title":989,"citations":985},"sa-22","SA-22","Unsupported System Components",{"family":69,"item":991,"code":992,"title":993,"citations":985},"800-83","SP 800-83","SP 800-83 Rev. 1: Guide to Malware Incident Prevention and Handling for Desktops and Laptops",{"family":238,"item":995,"code":996,"title":997,"citations":985},"29147","ISO\u002FIEC 29147","ISO\u002FIEC 29147: Vulnerability disclosure",{"family":69,"item":999,"code":1000,"title":1001,"citations":985},"800-66","SP 800-66","SP 800-66 Rev. 2: Implementing the HIPAA Security Rule: A Cybersecurity Resource Guide",{"family":23,"item":1003,"code":1004,"title":1005,"citations":985},"sc-12","SC-12","Cryptographic Key Establishment and Management",{"family":23,"item":1007,"code":1008,"title":1009,"citations":985},"ia-12","IA-12","Identity Proofing",{"family":23,"item":1011,"code":1012,"title":1013,"citations":985},"si-5","SI-5","Security Alerts, Advisories, and Directives",{"family":324,"item":1015,"code":1016,"title":1017,"citations":985},"4-2","62443-4-2","IEC 62443-4-2: Technical security requirements for IACS components",{"family":383,"item":1019,"code":1020,"title":1021,"citations":1022},"t1204","T1204","User Execution",16,{"family":324,"item":1024,"code":1025,"title":1026,"citations":1022},"2-4","62443-2-4","IEC 62443-2-4: Security program requirements for IACS service providers",{"family":69,"item":1028,"code":1029,"title":1030,"citations":1022},"800-115","SP 800-115","SP 800-115: Technical Guide to Information Security Testing and Assessment",{"family":510,"item":1032,"code":1033,"title":1034,"citations":1022},"requirement-11","Requirement 11.4","Requirement 11: Test Security of Systems and Networks Regularly",{"family":12,"item":1036,"code":1037,"title":1038,"citations":1039},"26","Article 26","Joint controllers",15,{"family":238,"item":1041,"code":1042,"title":1043,"citations":1039},"30111","ISO\u002FIEC 30111","ISO\u002FIEC 30111: Vulnerability handling processes",{"family":1045,"item":19,"code":1046,"title":1046,"citations":1039},"soc2","SOC 2",{"family":23,"item":1048,"code":1049,"title":1050,"citations":1039},"sc-20","SC-20","Secure Name\u002FAddress Resolution Service (Authoritative Source)",{"family":12,"item":1052,"code":1053,"title":1054,"citations":1039},"88","Article 88","Processing in the context of employment",{"family":12,"item":1056,"code":1057,"title":1058,"citations":1039},"46","Article 46","Transfers subject to appropriate safeguards",{"family":303,"item":1060,"code":1061,"title":1062,"citations":1039},"a-8-5","Annex A 8.5","ISO\u002FIEC 27001:2022 Annex A 8.5: Secure authentication",{"family":383,"item":1064,"code":1065,"title":1066,"citations":1067},"t1189","T1189","Drive-by Compromise",14,{"family":69,"item":1069,"code":1070,"title":1071,"citations":1067},"800-184","SP 800-184","SP 800-184: Guide for Cybersecurity Event Recovery",{"family":383,"item":1073,"code":1074,"title":1075,"citations":1067},"t1176","T1176","Software Extensions",{"family":23,"item":1077,"code":1078,"title":1079,"citations":1067},"ir-5","IR-5","Incident Monitoring",{"family":23,"item":1081,"code":1082,"title":1083,"citations":1067},"ca-3","CA-3","Information Exchange",{"family":23,"item":1085,"code":1086,"title":1087,"citations":1067},"sa-10","SA-10","Developer Configuration Management",{"family":303,"item":1089,"code":1090,"title":1091,"citations":1067},"a-5-15","Annex A 5.15","ISO\u002FIEC 27001:2022 Annex A 5.15: Access control",{"family":23,"item":1093,"code":1094,"title":1095,"citations":1096},"ca-2","CA-2","Control Assessments",13,{"family":1098,"item":19,"code":1099,"title":1100,"citations":1096},"eu-cra","Article 11","Cyber Resilience Act (Regulation (EU) 2024\u002F2847)",{"family":383,"item":1102,"code":1103,"title":1104,"citations":1096},"t1543","T1543","Create or Modify System Process",{"family":303,"item":1106,"code":1107,"title":1108,"citations":1096},"a-5-33","Annex A 5.33","ISO\u002FIEC 27001:2022 Annex A 5.33: Protection of records",{"family":303,"item":1110,"code":1111,"title":1112,"citations":1096},"a-8-24","Annex A 8.24","ISO\u002FIEC 27001:2022 Annex A 8.24: Use of cryptography",{"family":303,"item":1114,"code":1115,"title":1116,"citations":1117},"a-6-3","Annex A 6.3","ISO\u002FIEC 27001:2022 Annex A 6.3: Information security awareness, education and training",12,{"family":80,"item":19,"code":1119,"title":1120,"citations":1117},"CSF","NIST Cybersecurity Framework",{"family":303,"item":1122,"code":1123,"title":1124,"citations":1117},"a-8-2","Annex A 8.2","ISO\u002FIEC 27001:2022 Annex A 8.2: Privileged access rights",{"family":383,"item":1126,"code":1127,"title":1128,"citations":1117},"t1566-004","T1566.004","Spearphishing Voice",{"family":383,"item":1130,"code":1131,"title":1132,"citations":1117},"t1195-002","T1195.002","Compromise Software Supply Chain",{"family":23,"item":1134,"code":1135,"title":1136,"citations":1117},"ps-7","PS-7","External Personnel Security",{"family":23,"item":1138,"code":1139,"title":1140,"citations":1117},"cp-10","CP-10","System Recovery and Reconstitution",{"family":383,"item":1142,"code":1143,"title":1144,"citations":1117},"t1014","T1014","Rootkit",{"family":383,"item":1146,"code":1147,"title":1148,"citations":1149},"t1041","T1041","Exfiltration Over C2 Channel",11,{"family":383,"item":1151,"code":1152,"title":1153,"citations":1149},"t1496","T1496","Resource Hijacking",{"family":69,"item":1155,"code":1156,"title":1157,"citations":1149},"800-30","SP 800-30","SP 800-30 Rev. 1: Guide for Conducting Risk Assessments",{"family":69,"item":1159,"code":1160,"title":1161,"citations":1149},"800-204","SP 800-204","SP 800-204: Security Strategies for Microservices-based Application Systems",{"family":12,"item":1163,"code":1164,"title":1165,"citations":1149},"85","Article 85","Processing and freedom of expression and information",{"family":383,"item":1167,"code":1168,"title":1169,"citations":1149},"t1550-001","T1550.001","Application Access Token",{"family":69,"item":1171,"code":1172,"title":1173,"citations":1149},"800-122","SP 800-122","SP 800-122: Guide to Protecting the Confidentiality of Personally Identifiable Information (PII)",{"family":23,"item":1175,"code":1176,"title":1177,"citations":1149},"ac-19","AC-19","Access Control for Mobile Devices",{"family":69,"item":1179,"code":1180,"title":1181,"citations":1182},"800-41","SP 800-41","SP 800-41 Rev. 1: Guidelines on Firewalls and Firewall Policy",10,{"family":383,"item":1184,"code":1185,"title":1186,"citations":1182},"t1567","T1567","Exfiltration Over Web Service",{"family":69,"item":1188,"code":1189,"title":1190,"citations":1182},"800-150","SP 800-150","SP 800-150: Guide to Cyber Threat Information Sharing",{"family":383,"item":1192,"code":1193,"title":1194,"citations":1182},"t1218","T1218","System Binary Proxy Execution",{"family":303,"item":1196,"code":1197,"title":1198,"citations":1182},"a-8-15","Annex A 8.15","ISO\u002FIEC 27001:2022 Annex A 8.15: Logging",{"family":23,"item":1200,"code":1201,"title":1202,"citations":1182},"mp-6","MP-6","Media Sanitization",{"family":383,"item":1204,"code":1205,"title":1206,"citations":1182},"t1621","T1621","Multi-Factor Authentication Request Generation",{"family":238,"item":1208,"code":1209,"title":1210,"citations":1182},"27799","ISO\u002FIEC 27799","ISO 27799: Health informatics: Information security management in health using ISO\u002FIEC 27002",{"family":23,"item":1212,"code":1213,"title":1214,"citations":1182},"sr-11","SR-11","Component Authenticity",{"family":1216,"item":19,"code":1217,"title":1218,"citations":1219},"cmmc","CMMC","Cybersecurity Maturity Model Certification (CMMC)",9,{"family":12,"item":1221,"code":1222,"title":1223,"citations":1219},"77","Article 77","Right to lodge a complaint with a supervisory authority",{"family":383,"item":1225,"code":1226,"title":1227,"citations":1219},"t1530","T1530","Data from Cloud Storage",{"family":383,"item":1229,"code":1230,"title":1231,"citations":1219},"t1048","T1048","Exfiltration Over Alternative Protocol",{"family":383,"item":1233,"code":1234,"title":1235,"citations":1219},"t1598","T1598","Phishing for Information",{"family":383,"item":1237,"code":1238,"title":1239,"citations":1219},"t1110","T1110","Brute Force",{"family":303,"item":1241,"code":1242,"title":1243,"citations":1219},"a-8-20","Annex A 8.20","ISO\u002FIEC 27001:2022 Annex A 8.20: Networks security",{"family":12,"item":1245,"code":1246,"title":1247,"citations":1219},"31","Article 31","Cooperation with the supervisory authority",{"family":510,"item":1249,"code":1250,"title":1251,"citations":1219},"requirement-9","Requirement 9","Requirement 9: Restrict Physical Access to Cardholder Data",{"family":23,"item":1253,"code":1254,"title":1255,"citations":1219},"sc-23","SC-23","Session Authenticity",{"family":383,"item":1257,"code":1258,"title":1259,"citations":1219},"t1071-004","T1071.004","DNS",{"family":857,"item":1261,"code":1262,"title":1263,"citations":1219},"aml-t0054","AML.T0054","LLM Jailbreak",{"family":12,"item":223,"code":1265,"title":1266,"citations":1219},"Article 10","Processing of personal data relating to criminal convictions and offences",{"family":303,"item":19,"code":1268,"title":1269,"citations":1219},"ISO\u002FIEC 27001","ISO\u002FIEC 27001:2022 Information security, cybersecurity and privacy protection: Information security management systems: Requirements",{"family":80,"item":1271,"code":1272,"title":1273,"citations":1274},"gv-rm","GV.RM","Risk Management Strategy",8,{"family":383,"item":1276,"code":1277,"title":1278,"citations":1274},"t1185","T1185","Browser Session Hijacking",{"family":383,"item":1280,"code":1281,"title":1282,"citations":1274},"t1552","T1552","Unsecured Credentials",{"family":23,"item":1284,"code":1285,"title":1286,"citations":1274},"pt-7","PT-7","Specific Categories of Personally Identifiable Information",{"family":617,"item":111,"code":1288,"title":1289,"citations":1274},"Article 5","Prohibited AI practices",{"family":23,"item":1291,"code":1292,"title":1293,"citations":1274},"sc-30","SC-30","Concealment and Misdirection",{"family":23,"item":1295,"code":1296,"title":1297,"citations":1274},"ac-22","AC-22","Publicly Accessible Content",{"family":12,"item":1299,"code":1300,"title":1301,"citations":1274},"57","Article 57(4)","Tasks",{"family":383,"item":1303,"code":1304,"title":1305,"citations":1274},"t1053-005","T1053.005","Scheduled Task",{"family":303,"item":1307,"code":1308,"title":1309,"citations":1274},"a-8-10","Annex A 8.10","ISO\u002FIEC 27001:2022 Annex A 8.10: Information deletion",{"family":69,"item":1311,"code":1312,"title":1313,"citations":1274},"800-111","SP 800-111","SP 800-111: Guide to Storage Encryption Technologies for End User Devices",{"family":383,"item":1315,"code":1316,"title":1317,"citations":1274},"t1548","T1548","Abuse Elevation Control Mechanism",{"family":23,"item":1319,"code":1320,"title":1321,"citations":1274},"pt-4","PT-4","Consent",{"family":23,"item":1323,"code":1324,"title":1325,"citations":1274},"ps-4","PS-4","Personnel Termination",{"family":383,"item":1327,"code":1328,"title":1329,"citations":1330},"t1114","T1114","Email Collection",7,{"family":69,"item":1332,"code":1333,"title":1334,"citations":1330},"800-131","SP 800-131","SP 800-131A Rev. 2: Transitioning the Use of Cryptographic Algorithms and Key Lengths",{"family":69,"item":1336,"code":1337,"title":1338,"citations":1330},"800-155","SP 800-155","SP 800-155: BIOS Integrity Measurement Guidelines (Draft)",{"family":23,"item":1340,"code":1341,"title":1342,"citations":1330},"mp-4","MP-4","Media Storage",{"family":69,"item":1344,"code":1345,"title":1346,"citations":1330},"800-128","SP 800-128","SP 800-128: Guide for Security-Focused Configuration Management of Information Systems",{"family":69,"item":1348,"code":1349,"title":1350,"citations":1330},"800-90","SP 800-90","SP 800-90A Rev. 1: Recommendation for Random Number Generation Using Deterministic Random Bit Generators",{"family":383,"item":1352,"code":1353,"title":1354,"citations":1330},"t1568","T1568","Dynamic Resolution",{"family":857,"item":1356,"code":1357,"title":1358,"citations":1330},"aml-t0043","AML.T0043","Craft Adversarial Data",{"family":303,"item":1360,"code":1361,"title":1362,"citations":1330},"a-6-4","Annex A 6.4","ISO\u002FIEC 27001:2022 Annex A 6.4: Disciplinary process",{"family":510,"item":1364,"code":1365,"title":1366,"citations":1330},"requirement-1","Requirement 1","Requirement 1: Install and Maintain Network Security Controls",{"family":23,"item":1368,"code":1369,"title":1370,"citations":1330},"ir-7","IR-7","Incident Response Assistance",{"family":383,"item":1372,"code":1373,"title":1374,"citations":1330},"t1555-003","T1555.003","Credentials from Web Browsers",{"family":383,"item":1376,"code":1377,"title":1378,"citations":1330},"t1070","T1070","Indicator Removal",{"family":69,"item":1380,"code":1381,"title":1382,"citations":1330},"800-163","SP 800-163","SP 800-163 Rev. 1: Vetting the Security of Mobile Applications",{"family":383,"item":1384,"code":1385,"title":1386,"citations":1330},"t1078-004","T1078.004","Cloud Accounts",{"family":23,"item":1388,"code":1389,"title":1390,"citations":1330},"at-3","AT-3","Role-based Training",{"family":383,"item":1392,"code":1393,"title":1394,"citations":1330},"t1210","T1210","Exploitation of Remote Services",{"family":383,"item":1396,"code":1397,"title":1398,"citations":1330},"t1649","T1649","Steal or Forge Authentication Certificates",{"family":383,"item":1400,"code":1401,"title":1402,"citations":1330},"t1485","T1485","Data Destruction",{"family":23,"item":1404,"code":1405,"title":1406,"citations":1330},"mp-3","MP-3","Media Marking",{"family":428,"item":1408,"code":1409,"title":1410,"citations":1330},"cip-010","CIP-010-4","CIP-010: Configuration Change Management and Vulnerability Assessments",{"family":383,"item":1412,"code":1413,"title":1414,"citations":1330},"t1547","T1547","Boot or Logon Autostart Execution",{"family":23,"item":1416,"code":1417,"title":1418,"citations":1330},"sc-13","SC-13","Cryptographic Protection",{"family":238,"item":1420,"code":1421,"title":1422,"citations":1330},"28000","ISO\u002FIEC 28000","ISO 28000: Security and resilience: Security management systems: Requirements",{"family":383,"item":1424,"code":1425,"title":1426,"citations":1427},"t1115","T1115","Clipboard Data",6,{"family":23,"item":1429,"code":1430,"title":1431,"citations":1427},"pl-4","PL-4","Rules of Behavior",{"family":383,"item":1433,"code":1434,"title":1435,"citations":1427},"t1003","T1003","OS Credential Dumping",{"family":383,"item":1437,"code":1438,"title":1439,"citations":1427},"t1556","T1556","Modify Authentication Process",{"family":383,"item":1441,"code":1442,"title":1443,"citations":1427},"t1059-007","T1059.007","JavaScript",{"family":383,"item":1445,"code":1446,"title":1447,"citations":1427},"t1571","T1571","Non-Standard Port",{"family":23,"item":1449,"code":1450,"title":1451,"citations":1427},"cm-11","CM-11","User-installed Software",{"family":23,"item":1453,"code":1454,"title":1455,"citations":1427},"au-3","AU-3","Content of Audit Records",{"family":383,"item":1457,"code":1458,"title":1459,"citations":1427},"t1056-001","T1056.001","Keylogging",{"family":383,"item":1461,"code":1462,"title":1463,"citations":1427},"t1566-003","T1566.003","Spearphishing via Service",{"family":383,"item":1465,"code":1466,"title":1467,"citations":1427},"t1490","T1490","Inhibit System Recovery",{"family":303,"item":1469,"code":1470,"title":1471,"citations":1427},"a-5-26","Annex A 5.26","ISO\u002FIEC 27001:2022 Annex A 5.26: Response to information security incidents",{"family":383,"item":1473,"code":1474,"title":1475,"citations":1427},"t1199","T1199","Trusted Relationship",{"family":383,"item":1477,"code":1478,"title":1479,"citations":1427},"t1555-001","T1555.001","Keychain",{"family":303,"item":1481,"code":1482,"title":1483,"citations":1427},"a-8-9","Annex A 8.9","ISO\u002FIEC 27001:2022 Annex A 8.9: Configuration management",{"family":1485,"item":19,"code":1486,"title":1487,"citations":1427},"nist-nice","SP 800-181 Rev. 1","NICE Workforce Framework for Cybersecurity (NIST SP 800-181 Rev. 1)",{"family":857,"item":1489,"code":1490,"title":1491,"citations":1427},"aml-t0010","AML.T0010","ML Supply Chain Compromise",{"family":303,"item":1493,"code":1494,"title":1495,"citations":1427},"a-8-16","Annex A 8.16","ISO\u002FIEC 27001:2022 Annex A 8.16: Monitoring activities",{"family":383,"item":1497,"code":1498,"title":1499,"citations":1427},"t1021","T1021","Remote Services",{"family":303,"item":1501,"code":1502,"title":1503,"citations":1427},"a-8-22","Annex A 8.22","ISO\u002FIEC 27001:2022 Annex A 8.22: Segregation of networks",{"family":383,"item":1505,"code":1506,"title":1507,"citations":1427},"t1611","T1611","Escape to Host",{"family":80,"item":1509,"code":1510,"title":1511,"citations":1512},"id-gv","ID.GV-2","Governance (CSF 1.1)",5,{"family":12,"item":1514,"code":1515,"title":1516,"citations":1512},"79","Article 79","Right to an effective judicial remedy against a controller or processor",{"family":12,"item":1518,"code":1519,"title":1520,"citations":1512},"78","Article 78","Right to an effective judicial remedy against a supervisory authority",{"family":238,"item":1522,"code":1523,"title":1524,"citations":1512},"29134","ISO\u002FIEC 29134","ISO\u002FIEC 29134: Guidelines for privacy impact assessment",{"family":383,"item":1526,"code":1527,"title":1528,"citations":1512},"t1610","T1610","Deploy Container",{"family":383,"item":1530,"code":1531,"title":1532,"citations":1512},"t1534","T1534","Internal Spearphishing",{"family":23,"item":1534,"code":1535,"title":1536,"citations":1512},"sa-4","SA-4","Acquisition Process",{"family":383,"item":1538,"code":1539,"title":1540,"citations":1512},"t1072","T1072","Software Deployment Tools",{"family":849,"item":19,"code":1542,"title":1543,"citations":1512},"NIS2","NIS2 Directive (Directive (EU) 2022\u002F2555)",{"family":69,"item":1545,"code":1546,"title":1547,"citations":1512},"800-187","SP 800-187","SP 800-187: Guide to LTE Security",{"family":23,"item":1549,"code":1550,"title":1551,"citations":1512},"pe-2","PE-2","Physical Access Authorizations",{"family":69,"item":1553,"code":1554,"title":1555,"citations":1512},"800-125","SP 800-125","SP 800-125: Guide to Security for Full Virtualization Technologies",{"family":23,"item":1557,"code":1558,"title":1273,"citations":1512},"pm-9","PM-9",{"family":383,"item":1560,"code":1561,"title":1562,"citations":1512},"t1657","T1657","Financial Theft",{"family":303,"item":1564,"code":1565,"title":1566,"citations":1512},"a-5-12","Annex A 5.12","ISO\u002FIEC 27001:2022 Annex A 5.12: Classification of information",{"family":23,"item":1568,"code":1569,"title":1570,"citations":1512},"ia-11","IA-11","Re-authentication",{"family":23,"item":1572,"code":1573,"title":680,"citations":1512},"ac-1","AC-1",{"family":238,"item":1575,"code":1576,"title":1577,"citations":1512},"22301","ISO\u002FIEC 22301","ISO 22301: Security and resilience: Business continuity management systems: Requirements",{"family":69,"item":1579,"code":1580,"title":1581,"citations":1512},"800-147","SP 800-147","SP 800-147: BIOS Protection Guidelines",{"family":23,"item":1583,"code":1584,"title":1585,"citations":1512},"pm-25","PM-25","Minimization of Personally Identifiable Information Used in Testing, Training, and Research",{"family":23,"item":1587,"code":1588,"title":1589,"citations":1512},"sc-3","SC-3","Security Function Isolation",{"family":303,"item":1591,"code":1592,"title":1593,"citations":1512},"a-5-17","Annex A 5.17","ISO\u002FIEC 27001:2022 Annex A 5.17: Authentication information",{"family":383,"item":1595,"code":1596,"title":1597,"citations":1512},"t1574-001","T1574.001","DLL",{"family":23,"item":1599,"code":1600,"title":1601,"citations":1512},"sc-17","SC-17","Public Key Infrastructure Certificates",{"family":69,"item":1603,"code":1604,"title":1605,"citations":1512},"800-216","SP 800-216","SP 800-216: Recommendations for Federal Vulnerability Disclosure Guidelines",{"family":12,"item":1607,"code":1608,"title":1609,"citations":1512},"38","Article 38","Position of the data protection officer",{"family":383,"item":1611,"code":1612,"title":1613,"citations":1512},"t1133","T1133","External Remote Services",{"family":383,"item":1615,"code":1616,"title":1617,"citations":1512},"t1113","T1113","Screen Capture",{"family":23,"item":1619,"code":1620,"title":1621,"citations":1512},"ir-2","IR-2","Incident Response Training",{"family":383,"item":1623,"code":1624,"title":1625,"citations":1512},"t1111","T1111","Multi-Factor Authentication Interception",{"family":303,"item":1627,"code":1628,"title":1629,"citations":1512},"a-5-29","Annex A 5.29","ISO\u002FIEC 27001:2022 Annex A 5.29: Information security during disruption",{"family":303,"item":1631,"code":1632,"title":1633,"citations":1512},"a-8-11","Annex A 8.11","ISO\u002FIEC 27001:2022 Annex A 8.11: Data masking",{"family":849,"item":1635,"code":1636,"title":1637,"citations":1512},"23","Article 23","Reporting obligations",{"family":303,"item":1639,"code":1640,"title":1641,"citations":1512},"a-5-20","Annex A 5.20","ISO\u002FIEC 27001:2022 Annex A 5.20: Addressing information security within supplier relationships",{"family":303,"item":1643,"code":1644,"title":1645,"citations":1512},"a-8-30","Annex A 8.30","ISO\u002FIEC 27001:2022 Annex A 8.30: Outsourced development",{"family":383,"item":1647,"code":1648,"title":1649,"citations":1512},"t1195-001","T1195.001","Compromise Software Dependencies and Development Tools",{"family":383,"item":1651,"code":1652,"title":1653,"citations":1512},"t1583-001","T1583.001","Domains",{"family":303,"item":1655,"code":1656,"title":1657,"citations":1658},"a-7-4","Annex A 7.4","Physical security monitoring",4,{"family":617,"item":44,"code":358,"title":1660,"citations":1658},"Transparency and provision of information to deployers",{"family":80,"item":1662,"code":1663,"title":1664,"citations":1658},"rs","RS","Respond (RS)",{"family":510,"item":1666,"code":1667,"title":1668,"citations":1658},"requirement-5","Requirement 5","Requirement 5: Protect All Systems and Networks from Malicious Software",{"family":303,"item":1670,"code":1671,"title":1672,"citations":1658},"a-6-5","Annex A 6.5","Responsibilities after termination or change of employment",{"family":12,"item":1674,"code":1675,"title":1676,"citations":1658},"39","Article 39","Tasks of the data protection officer",{"family":303,"item":1678,"code":1679,"title":1680,"citations":1658},"a-5-16","Annex A 5.16","ISO\u002FIEC 27001:2022 Annex A 5.16: Identity management",{"family":303,"item":1682,"code":1683,"title":1684,"citations":1658},"a-5-7","Annex A 5.7","ISO\u002FIEC 27001:2022 Annex A 5.7: Threat intelligence",{"family":617,"item":1686,"code":1687,"title":1688,"citations":1689},"50","Article 50","Transparency obligations for providers and deployers of certain AI systems",3,{"family":303,"item":1691,"code":1692,"title":1693,"citations":1689},"a-6-1","Annex A 6.1","Screening",{"family":303,"item":1695,"code":1696,"title":1697,"citations":1689},"a-5-18","Annex A 5.18","Access rights",{"family":617,"item":283,"code":515,"title":1699,"citations":1689},"Accuracy, robustness and cybersecurity",{"family":303,"item":1701,"code":1702,"title":1703,"citations":1689},"a-5-24","Annex A 5.24","ISO\u002FIEC 27001:2022 Annex A 5.24: Information security incident management planning and preparation",{"family":12,"item":116,"code":1705,"title":1706,"citations":1689},"Article 16","Right to rectification",{"family":303,"item":1708,"code":1709,"title":1710,"citations":1689},"a-8-25","Annex A 8.25","ISO\u002FIEC 27001:2022 Annex A 8.25: Secure development life cycle",{"family":80,"item":1712,"code":1713,"title":1714,"citations":1689},"gv-rr","GV.RR","GV.RR: Roles, Responsibilities, and Authorities",{"family":80,"item":1716,"code":1717,"title":1718,"citations":1689},"pr-aa","PR.AA-01","PR.AA: Identity Management, Authentication, and Access Control",{"family":303,"item":1720,"code":1721,"title":1722,"citations":1689},"a-7-2","Annex A 7.2","ISO\u002FIEC 27001:2022 Annex A 7.2: Physical entry",{"family":303,"item":1724,"code":1725,"title":1726,"citations":1727},"a-7-10","Annex A 7.10","Storage media",2,{"family":303,"item":1729,"code":1730,"title":1731,"citations":1727},"a-8-23","Annex A 8.23","ISO\u002FIEC 27001:2022 Annex A 8.23: Web filtering",{"family":303,"item":1733,"code":1734,"title":1735,"citations":1727},"a-8-12","Annex A 8.12","ISO\u002FIEC 27001:2022 Annex A 8.12: Data leakage prevention",{"family":617,"item":223,"code":1265,"title":1737,"citations":1727},"Data and data governance",{"family":303,"item":1739,"code":1740,"title":1741,"citations":1727},"a-8-28","Annex A 8.28","Secure coding",{"family":23,"item":1743,"code":1744,"title":1745,"citations":1727},"sc-26","SC-26","Decoys",{"family":303,"item":1747,"code":1748,"title":1749,"citations":1727},"a-8-1","Annex A 8.1","ISO\u002FIEC 27001:2022 Annex A 8.1: User endpoint devices",{"family":303,"item":1751,"code":1752,"title":1753,"citations":1727},"a-8-19","Annex A 8.19","ISO\u002FIEC 27001:2022 Annex A 8.19: Installation of software on operational systems",{"family":303,"item":1755,"code":1756,"title":1757,"citations":1727},"a-8-13","Annex A 8.13","ISO\u002FIEC 27001:2022 Annex A 8.13: Information backup",{"family":303,"item":1759,"code":1760,"title":1761,"citations":1727},"a-8-7","Annex A 8.7","ISO\u002FIEC 27001:2022 Annex A 8.7: Protection against malware",{"family":303,"item":1763,"code":1764,"title":1765,"citations":1727},"a-6-8","Annex A 6.8","Information security event reporting",{"family":80,"item":1767,"code":1768,"title":1769,"citations":1727},"pr-ir","PR.IR-01","PR.IR: Technology Infrastructure Resilience",{"family":12,"item":1771,"code":1772,"title":1773,"citations":1727},"20","Article 20","Right to data portability",{"family":173,"item":1775,"code":1776,"title":1777,"citations":1727},"top10-2021-a10","A10:2021","A10:2021 Server-Side Request Forgery (SSRF)",{"family":617,"item":75,"code":666,"title":1779,"citations":1727},"Human oversight",{"family":303,"item":1781,"code":1782,"title":1783,"citations":1727},"a-5-13","Annex A 5.13","Labelling of information",{"family":80,"item":1785,"code":1786,"title":1787,"citations":1727},"gv","GV","Govern (GV)",{"family":303,"item":1789,"code":1790,"title":1791,"citations":1727},"a-8-4","Annex A 8.4","Access to source code",{"family":303,"item":1793,"code":1794,"title":1795,"citations":1727},"a-5-21","Annex A 5.21","Managing information security in the ICT supply chain",{"family":173,"item":1797,"code":1798,"title":1799,"citations":1727},"top10-2021-a04","A04:2021","A04:2021 Insecure Design",{"family":1801,"item":213,"code":399,"title":1802,"citations":1803},"dora","Protection and prevention",1,{"family":303,"item":1805,"code":1806,"title":1807,"citations":1803},"a-5-9","Annex A 5.9","ISO\u002FIEC 27001:2022 Annex A 5.9: Inventory of information and other associated assets",{"family":69,"item":1809,"code":1810,"title":1811,"citations":1803},"800-167","SP 800-167","SP 800-167: Guide to Application Whitelisting",{"family":303,"item":1813,"code":1814,"title":1815,"citations":1803},"a-5-30","Annex A 5.30","ICT readiness for business continuity",{"family":303,"item":1817,"code":1818,"title":1819,"citations":1803},"a-5-23","Annex A 5.23","ISO\u002FIEC 27001:2022 Annex A 5.23: Information security for use of cloud services",{"family":80,"item":1821,"code":1822,"title":1823,"citations":1803},"rs-ma","RS.MA","RS.MA: Incident Management",{"family":617,"item":29,"code":258,"title":1825,"citations":1803},"Classification rules for high-risk AI systems",{"family":80,"item":1827,"code":1828,"title":1829,"citations":1803},"de","DE","Detect (DE)",{"family":303,"item":1831,"code":1832,"title":1833,"citations":1803},"a-7-9","Annex A 7.9","Security of assets off-premises",{"family":80,"item":1835,"code":1836,"title":1837,"citations":1803},"rc-co","RC.CO-3","RC.CO: Incident Recovery Communication",{"family":1801,"item":1036,"code":1037,"title":1839,"citations":1803},"Advanced testing of ICT tools, systems and processes based on TLPT",{"family":303,"item":1841,"code":1842,"title":1843,"citations":1803},"a-6-7","Annex A 6.7","Remote working",{"family":12,"item":389,"code":1845,"title":1846,"citations":1803},"Article 18","Right to restriction of processing",{"family":303,"item":1848,"code":1849,"title":1850,"citations":1803},"a-6-2","Annex A 6.2","Terms and conditions of employment",{"family":1852,"item":19,"code":1853,"title":1854,"citations":1803},"mitre-engage","Engage","MITRE Engage",{"family":80,"item":1856,"code":1857,"title":1858,"citations":1803},"gv-po","GV.PO-01","GV.PO: Policy",{"family":303,"item":1860,"code":1861,"title":1862,"citations":1803},"a-6-6","Annex A 6.6","Confidentiality or non-disclosure agreements",{"family":303,"item":1864,"code":1865,"title":1866,"citations":1803},"a-8-31","Annex A 8.31","Separation of development, test and production environments",{"family":1801,"item":111,"code":1288,"title":1868,"citations":1803},"Governance and organisation",{"family":1870,"item":19,"code":1871,"title":1871,"citations":1803},"essential-eight","Essential Eight",{"family":849,"item":1873,"code":1874,"title":1875,"citations":1876},"21-2-c","Article 21(2)(c)","Business continuity, backups and crisis management (Article 21(2)(c))",0,{"family":849,"item":1771,"code":1878,"title":1879,"citations":1876},"Article 20(2)","Governance",{"family":1801,"item":34,"code":575,"title":1881,"citations":1876},"Backup policies and procedures, restoration and recovery procedures and methods",{"family":1801,"item":244,"code":1099,"title":1883,"citations":1876},"Response and recovery",{"family":303,"item":1885,"code":1886,"title":1887,"citations":1876},"a-8-14","Annex A 8.14","Redundancy of information processing facilities",{"family":1801,"item":44,"code":1889,"title":1890,"citations":1876},"Article 13(6)","Learning and evolving",{"family":303,"item":1892,"code":1893,"title":1894,"citations":1876},"a-8-17","Annex A 8.17","Clock synchronization",{"family":303,"item":1896,"code":1897,"title":1898,"citations":1876},"a-8-18","Annex A 8.18","Use of privileged utility programs",{"family":303,"item":1900,"code":1901,"title":1902,"citations":1876},"a-7-5","Annex A 7.5","Protecting against physical and environmental threats",{"family":303,"item":1904,"code":1905,"title":1906,"citations":1876},"a-7-12","Annex A 7.12","Cabling security",{"family":303,"item":1908,"code":1909,"title":1910,"citations":1876},"a-7-13","Annex A 7.13","Equipment maintenance",{"family":80,"item":1912,"code":1913,"title":1914,"citations":1876},"gv-ov","GV.OV","GV.OV: Oversight",{"family":303,"item":1916,"code":1917,"title":1918,"citations":1876},"a-7-14","Annex A 7.14","Secure disposal or re-use of equipment",{"family":303,"item":1920,"code":1921,"title":1922,"citations":1876},"a-8-33","Annex A 8.33","Test information",{"family":303,"item":1924,"code":1925,"title":1926,"citations":1876},"a-7-7","Annex A 7.7","Clear desk and clear screen",{"family":303,"item":1928,"code":1929,"title":1930,"citations":1876},"a-5-25","Annex A 5.25","ISO\u002FIEC 27001:2022 Annex A 5.25: Assessment and decision on information security events",{"family":849,"item":1932,"code":1933,"title":1934,"citations":1876},"21-2-a","Article 21(2)(a)","Policies on risk analysis and information system security (Article 21(2)(a))",{"family":1801,"item":223,"code":1265,"title":1936,"citations":1876},"Detection",{"family":303,"item":1938,"code":1939,"title":1940,"citations":1876},"a-8-26","Annex A 8.26","Application security requirements",{"family":303,"item":1942,"code":1943,"title":1944,"citations":1876},"a-8-27","Annex A 8.27","Secure system architecture and engineering principles",{"family":303,"item":1946,"code":1947,"title":1948,"citations":1876},"a-8-32","Annex A 8.32","Change management",{"family":303,"item":1950,"code":1951,"title":1952,"citations":1876},"a-8-34","Annex A 8.34","Protection of information systems during audit testing",{"family":510,"item":1954,"code":1955,"title":1956,"citations":1876},"requirement-2","Requirement 2","Requirement 2: Apply Secure Configurations to All System Components",{"family":510,"item":1958,"code":1959,"title":1960,"citations":1876},"requirement-4","Requirement 4","Requirement 4: Protect Cardholder Data with Strong Cryptography During Transmission Over Open, Public Networks",{"family":173,"item":1962,"code":1963,"title":1964,"citations":1876},"top10-2021-a09","A09:2021","A09:2021 Security Logging and Monitoring Failures",{"family":303,"item":1966,"code":1967,"title":1968,"citations":1876},"a-5-5","Annex A 5.5","Contact with authorities",{"family":303,"item":1970,"code":1971,"title":1972,"citations":1876},"a-8-6","Annex A 8.6","Capacity management",{"family":1974,"item":19,"code":1975,"title":1976,"citations":1876},"dora-rts-ict-risk","Art. 12","Commission Delegated Regulation (EU) 2024\u002F1774 (RTS on ICT risk management framework)",{"family":849,"item":1978,"code":1979,"title":1980,"citations":1876},"21-2-f","Article 21(2)(f)","Assessing the effectiveness of measures (Article 21(2)(f))",{"family":1801,"item":121,"code":938,"title":1982,"citations":1876},"Identification",{"family":303,"item":1984,"code":1985,"title":1986,"citations":1876},"a-7-6","Annex A 7.6","Working in secure areas",{"family":303,"item":1988,"code":1989,"title":1990,"citations":1876},"a-7-8","Annex A 7.8","Equipment siting and protection",{"family":303,"item":1992,"code":1993,"title":1994,"citations":1876},"a-7-11","Annex A 7.11","Supporting utilities",{"family":617,"item":39,"code":1996,"title":595,"citations":1876},"Article 3",{"family":849,"item":54,"code":1998,"title":1999,"citations":1876},"Article 2","Scope",{"family":849,"item":39,"code":1996,"title":2001,"citations":1876},"Essential and important entities",{"family":849,"item":630,"code":631,"title":2003,"citations":1876},"Use of European cybersecurity certification schemes",{"family":849,"item":13,"code":14,"title":2005,"citations":1876},"Supervisory and enforcement measures in relation to essential entities",{"family":849,"item":149,"code":150,"title":2007,"citations":1876},"Supervisory and enforcement measures in relation to important entities",{"family":849,"item":519,"code":520,"title":2009,"citations":1876},"General conditions for imposing administrative fines on essential and important entities",{"family":1801,"item":54,"code":1998,"title":1999,"citations":1876},{"family":1801,"item":39,"code":1996,"title":595,"citations":1876},{"family":1801,"item":29,"code":258,"title":2013,"citations":1876},"ICT risk management framework",{"family":1801,"item":7,"code":473,"title":2015,"citations":1876},"ICT systems, protocols and tools",{"family":1801,"item":75,"code":666,"title":2017,"citations":1876},"Communication",{"family":1801,"item":283,"code":515,"title":2019,"citations":1876},"Further harmonisation of ICT risk management tools, methods, processes and policies",{"family":1801,"item":116,"code":1705,"title":2021,"citations":1876},"Simplified ICT risk management framework",{"family":1801,"item":389,"code":1845,"title":2023,"citations":1876},"Classification of ICT-related incidents and cyber threats",{"family":1801,"item":2025,"code":2026,"title":2027,"citations":1876},"19","Article 19","Reporting of major ICT-related incidents and voluntary notification of significant cyber threats",{"family":1801,"item":2029,"code":2030,"title":2031,"citations":1876},"27","Article 27","Requirements for testers for the carrying out of TLPT",{"family":1801,"item":2033,"code":2034,"title":2035,"citations":1876},"29","Article 29","Preliminary assessment of ICT concentration risk at entity level",{"family":1801,"item":505,"code":506,"title":2037,"citations":1876},"Key contractual provisions",{"family":1801,"item":1245,"code":1246,"title":2039,"citations":1876},"Designation of critical ICT third-party service providers",{"family":1801,"item":1686,"code":1687,"title":2041,"citations":1876},"Administrative penalties and remedial measures",{"family":617,"item":59,"code":2043,"title":2044,"citations":1876},"Article 4","AI literacy",{"family":617,"item":1036,"code":1037,"title":2046,"citations":1876},"Obligations of deployers of high-risk AI systems",{"family":617,"item":2029,"code":2030,"title":2048,"citations":1876},"Fundamental rights impact assessment for high-risk AI systems",{"family":617,"item":2050,"code":2051,"title":2052,"citations":1876},"99","Article 99","Penalties",{"family":80,"item":2054,"code":2055,"title":2056,"citations":1876},"id","ID","Identify (ID)",{"family":80,"item":2058,"code":2059,"title":2060,"citations":1876},"pr","PR","Protect (PR)",{"family":80,"item":2062,"code":2063,"title":2064,"citations":1876},"rc","RC","Recover (RC)",{"family":80,"item":2066,"code":2067,"title":2068,"citations":1876},"pr-ps","PR.PS","PR.PS: Platform Security",{"family":303,"item":2070,"code":2071,"title":2072,"citations":1876},"clause-4","Clause 4","Context of the organization",{"family":303,"item":2074,"code":2075,"title":2076,"citations":1876},"clause-5","Clause 5","Leadership",{"family":303,"item":2078,"code":2079,"title":2080,"citations":1876},"clause-6","Clause 6","Planning",{"family":303,"item":2082,"code":2083,"title":2084,"citations":1876},"clause-7","Clause 7","Support",{"family":303,"item":2086,"code":2087,"title":2088,"citations":1876},"clause-8","Clause 8","Operation",{"family":303,"item":2090,"code":2091,"title":2092,"citations":1876},"clause-9","Clause 9","Performance evaluation",{"family":303,"item":2094,"code":2095,"title":2096,"citations":1876},"clause-10","Clause 10","Improvement",{"family":303,"item":2098,"code":2099,"title":2100,"citations":1876},"a-5-1","Annex A 5.1","Policies for information security",{"family":303,"item":2102,"code":2103,"title":2104,"citations":1876},"a-5-2","Annex A 5.2","Information security roles and responsibilities",{"family":303,"item":2106,"code":2107,"title":2108,"citations":1876},"a-5-3","Annex A 5.3","Segregation of duties",{"family":303,"item":2110,"code":2111,"title":2112,"citations":1876},"a-5-4","Annex A 5.4","Management responsibilities",{"family":303,"item":2114,"code":2115,"title":2116,"citations":1876},"a-5-6","Annex A 5.6","Contact with special interest groups",{"family":303,"item":2118,"code":2119,"title":2120,"citations":1876},"a-5-8","Annex A 5.8","Information security in project management",{"family":303,"item":2122,"code":2123,"title":2124,"citations":1876},"a-5-10","Annex A 5.10","Acceptable use of information and other associated assets",{"family":303,"item":2126,"code":2127,"title":2128,"citations":1876},"a-5-11","Annex A 5.11","Return of assets",{"family":303,"item":2130,"code":2131,"title":2132,"citations":1876},"a-5-14","Annex A 5.14","Information transfer",{"family":303,"item":2134,"code":2135,"title":2136,"citations":1876},"a-5-22","Annex A 5.22","Monitoring, review and change management of supplier services",{"family":303,"item":2138,"code":2139,"title":2140,"citations":1876},"a-5-27","Annex A 5.27","Learning from information security incidents",{"family":303,"item":2142,"code":2143,"title":2144,"citations":1876},"a-5-28","Annex A 5.28","Collection of evidence",{"family":303,"item":2146,"code":2147,"title":2148,"citations":1876},"a-5-31","Annex A 5.31","Legal, statutory, regulatory and contractual requirements",{"family":303,"item":2150,"code":2151,"title":2152,"citations":1876},"a-5-32","Annex A 5.32","Intellectual property rights",{"family":303,"item":2154,"code":2155,"title":2156,"citations":1876},"a-5-35","Annex A 5.35","Independent review of information security",{"family":303,"item":2158,"code":2159,"title":2160,"citations":1876},"a-5-36","Annex A 5.36","Compliance with policies, rules and standards for information security",{"family":303,"item":2162,"code":2163,"title":2164,"citations":1876},"a-5-37","Annex A 5.37","Documented operating procedures",{"family":303,"item":2166,"code":2167,"title":2168,"citations":1876},"a-7-1","Annex A 7.1","ISO\u002FIEC 27001:2022 Annex A 7.1: Physical security perimeters",{"family":303,"item":2170,"code":2171,"title":2172,"citations":1876},"a-7-3","Annex A 7.3","Securing offices, rooms and facilities",{"family":849,"item":2174,"code":2175,"title":2176,"citations":1876},"21-2-j","Article 21(2)(j)","Multi-factor authentication and secured communications (Article 21(2)(j))",{"family":849,"item":2178,"code":2179,"title":2180,"citations":1876},"21-2-i","Article 21(2)(i)","Human resources security, access control and asset management (Article 21(2)(i))",{"family":849,"item":2182,"code":2183,"title":2184,"citations":1876},"21-2-b","Article 21(2)(b)","Incident handling (Article 21(2)(b))",{"family":849,"item":2186,"code":2187,"title":2188,"citations":1876},"21-2-h","Article 21(2)(h)","Cryptography and encryption (Article 21(2)(h))",{"family":849,"item":2190,"code":2191,"title":2192,"citations":1876},"21-2-e","Article 21(2)(e)","Security in acquisition, development and maintenance (Article 21(2)(e))",{"family":1801,"item":126,"code":127,"title":2194,"citations":1876},"Testing of ICT tools and systems",{"family":1801,"item":630,"code":631,"title":2196,"citations":1876},"General requirements for the performance of digital operational resilience testing",{"family":303,"item":2198,"code":2199,"title":2200,"citations":1876},"a-8-29","Annex A 8.29","ISO\u002FIEC 27001:2022 Annex A 8.29: Security testing in development and acceptance",{"family":303,"item":2202,"code":2203,"title":2204,"citations":1876},"clause-9-1","Clause 9.1","ISO\u002FIEC 27001:2022 Clause 9.1: Monitoring, measurement, analysis and evaluation",{"family":80,"item":2206,"code":2207,"title":2096,"citations":1876},"id-im","ID.IM-02",{"family":849,"item":2209,"code":2210,"title":2211,"citations":1876},"21-2-d","Article 21(2)(d)","Supply chain security (Article 21(2)(d))",{"family":1801,"item":309,"code":310,"title":2213,"citations":1876},"General principles on ICT third-party risk",{"family":849,"item":2215,"code":2216,"title":2217,"citations":1876},"21-2-g","Article 21(2)(g)","Basic cyber hygiene practices and cybersecurity training (Article 21(2)(g))",{"family":303,"item":2219,"code":2220,"title":2221,"citations":1876},"a-8-21","Annex A 8.21","ISO\u002FIEC 27001:2022 Annex A 8.21: Security of network services",{"family":2223,"item":19,"code":2224,"title":2225,"citations":1876},"nis2-implementing-regulation","Annex 3.2","Commission Implementing Regulation (EU) 2024\u002F2690",{"family":1801,"item":183,"code":491,"title":2227,"citations":1876},"ICT-related incident management process",{"family":849,"item":2033,"code":2034,"title":2229,"citations":1876},"Cybersecurity information-sharing arrangements",{"family":1801,"item":2231,"code":2232,"title":2233,"citations":1876},"45","Article 45","Information-sharing arrangements on cyber threat information and intelligence"]