3.2.2

DE.CM-2: Is the physical IT equipment monitored to detect potential cloud security?

LOW

· ISA 62443-2-1:2009 4.3.3.3.8

· NIST SP 800-53 Rev. 4 CA-7, PE-3, PE-6, PE-20

Cloud Provider/ Administrator/ Logging

Sub Metric

Met_3.2.2

3.2.3

DE.CM-3: Personnel activity is monitored to detect any breaches and non-repudiation activities?

LOW

· ISA 62443-3-3:2013 SR 6.2

· NIST SP 800-53 Rev. 4 AC-2, AU-12, AU-13, CA-7, CM-10, CM-11

Administrator/ Logging

Sub Metric

Met_3.2.3

3.2.7

DE.CM-7: Is the cloud environment monitored for unauthorised users or connections?

MEDIUM

· NIST SP 800-53 Rev. 4 AU-12, CA-7, CM-3, CM-8, PE-3, PE-6, PE-20, SI-4

Administrator/ Logging

Sub Metric

Met_3.2.7

3.2.8

DE.CM-8: Are vulnerability scans regularly performed on the cloud environment?

MEDIUM

· COBIT 5 BAI03.10

· ISA 62443-2-1:2009 4.2.3.1, 4.2.3.7

· ISO/IEC 27001:2013 A.12.6.1

· NIST SP 800-53 Rev. 4 RA-5

Cloud Provider/ Administrator/

Sub Metric

Met_3.2.8

3.3

Detection Processes (3.3): Threat detection methods and procedures are maintained and tested to ensure timely and adequate awareness of unusual or irregular events.

Metric

Met_3.3

3.3.1

DE.DP-1: Does the SME and cloud provider define the roles and responsibilities for all the users to enable accountability for their actions?

LOW

· CCS CSC 5

· COBIT 5 DSS05.01

· ISA 62443-2-1:2009 4.4.3.1

· ISO/IEC 27001:2013 A.6.1.1

· NIST SP 800-53 Rev. 4 CA-2, CA-7, PM-14

Cloud Provider/ Administrator/

Sub Metric

Met_3.3.1

3.3.2

DE.DP-2: Do the threat detection measures conform to all relevant requirements?

MEDIUM

· ISA 62443-2-1:2009 4.4.3.2

· ISO/IEC 27001:2013 A.18.1.4

· NIST SP 800-53 Rev. 4 CA-2, CA-7, PM-14, SI-4

Cloud Provider/ Administrator/

Sub Metric

Met_3.3.2

3.3.3

DE.DP-3: Are the above-mentioned measures tested?

LOW

· ISA 62443-3-3:2013 SR 3.3

· ISO/IEC 27001:2013 A.14.2.8

· NIST SP 800-53 Rev. 4 CA-2, CA-7, PE-3, PM-14, SI-3, SI-4

Cloud Provider/ Administrator/

Sub Metric

Met_3.3.3

3.3.4

DE.DP-4: Are the above-mentioned measures communicated to the SME personnel?

MEDIUM

· COBIT 5 APO12.06

· ISA 62443-2-1:2009 4.3.4.5.9

· ISA 62443-3-3:2013 SR 6.1

· ISO/IEC 27001:2013 A.16.1.2

· NIST SP 800-53 Rev. 4 AU-6, CA-2, CA-7, RA-5, SI-4

Cloud Provider/ Administrator/

Sub Metric

Met_3.3.4

3.3.5

DE.DP-5: Are the above-mentioned measures and processes continuously improved?

LOW

· COBIT 5 APO11.06, DSS04.05

· ISA 62443-2-1:2009 4.4.3.4

· ISO/IEC 27001:2013 A.16.1.6

· NIST SP 800-53 Rev. 4, CA-2, CA-7, PL-2, RA-5, SI-4, PM-14

Cloud Provider/ Administrator/

Sub Metric

Met_3.3.5

4

RESPOND TO SECURITY EVENTS IN THE CLOUD

Group Metric

Met₄

4.1

Response Planning (4.1): Response procedures and measures are executed and maintained, to ensure timely response to detected cloud security incidents.

Metric

Met_4.1