SECU
安全控制框架 2024
控制项模式安全控制框架(SCF)是一个全面的网络安全控制框架，包含超过1000个控制要求，覆盖隐私、网络安全、数据保护、业务连续性等多个领域。SCF旨在帮助组织满足多个法规和标准的合规要求。
版本: 2024•覆盖状态: 完整覆盖 (2478/2478)•控制项/量表/总计: 1239/1239/2478•当前展示: 13 / 1239•33 个分类
THR-11Does the organization use automated mechanisms to establish behavioral baselines that capture information about user and entity behavior to enable dynamic threat discovery?控制项
Threat Management / Behavioral Baselining
存在自动化机制来建立行为基线，捕获有关用户和实体行为的信息，以实现动态威胁发现。
评估
评估状态:
评估备注:
THR-02Does the organization develop Indicators of Exposure (IOE) to understand the potential attack vectors that attackers could use to attack the organization?控制项
Threat Management / Indicators of Exposure (IOE)
存在开发暴露指标 (IOE) 的机制，以了解攻击者可用来攻击组织的潜在攻击向量。
评估
评估状态:
评估备注:
THR-05Does the organization utilize security awareness training on recognizing and reporting potential indicators of insider threat?控制项
Threat Management / Insider Threat Awareness
现有机制可利用安全意识培训来识别和报告内部威胁的潜在指标。
评估
评估状态:
评估备注:
THR-04Does the organization implement an insider threat program that includes a cross-discipline insider threat incident handling team?控制项
Threat Management / Insider Threat Program
存在实施内部威胁计划的机制，其中包括跨学科的内部威胁事件处理团队。
评估
评估状态:
评估备注:
THR-06.1Does the organization enable public submissions of discovered or potential security vulnerabilities?控制项
Threat Management / Security Disclosure Contact Information
存在允许公众提交已发现或潜在安全漏洞的机制。
评估
评估状态:
评估备注:
THR-08Does the organization embed false data or steganographic data in files to enable the organization to determine if data has been exfiltrated and provide a means to identify the individual(s) involved?控制项
Threat Management / Tainting
存在将虚假数据或隐写数据嵌入文件中的机制，使组织能够确定数据是否已被泄露，并提供识别所涉及个人的方法。
评估
评估状态:
评估备注:
THR-10Does the organization identify, assess, prioritize and document the potential impact(s) and likelihood(s) of applicable internal and external threats?控制项
Threat Management / Threat Analysis
存在识别、评估、优先排序和记录适用的内部和外部威胁的潜在影响和可能性的机制。
评估
评估状态:
评估备注:
THR-09Does the organization develop and keep current a catalog of applicable internal and external threats to the organization, both natural and manmade?控制项
Threat Management / Threat Catalog
存在机制来制定并保持当前对组织适用的内部和外部威胁的目录，包括自然的和人为的。
评估
评估状态:
评估备注:
THR-07Does the organization perform cyber threat hunting that uses Indicators of Compromise (IoC) to detect, track and disrupt threats that evade existing security controls?控制项
Threat Management / Threat Hunting
存在执行网络威胁搜寻的机制，该机制使用妥协指标 (IoC) 来检测、跟踪和破坏逃避现有安全控制的威胁。
评估
评估状态:
评估备注:
THR-03Does the organization maintain situational awareness of vulnerabilities and evolving threats by leveraging the knowledge of attacker tactics, techniques and procedures to facilitate the implementation of preventative and compensating controls?控制项
Threat Management / Threat Intelligence Feeds
现有机制通过利用攻击者策略、技术和程序的知识来保持对漏洞和不断变化的威胁的态势感知，以促进预防性和补偿性控制的实施。
评估
评估状态:
评估备注:
THR-01Does the organization implement a threat intelligence program that includes a cross-organization information-sharing capability that can influence the development of the system and security architectures, selection of security solutions, monitoring, threat hunting, response and recovery activities?控制项
Threat Management / Threat Intelligence Program
存在实施威胁情报计划的机制，其中包括跨组织信息共享能力，可以影响系统和安全架构的开发、安全解决方案的选择、监控、威胁搜寻、响应和恢复活动。
评估
评估状态:
评估备注:
THR-03.1Does the organization utilize external threat intelligence feeds to generate and disseminate organization-specific security alerts, advisories and/or directives?控制项
Threat Management / Threat Intelligence Reporting
存在利用外部威胁情报源来生成和传播组织特定的安全警报、建议和/或指令的机制。
评估
评估状态:
评估备注:
THR-06Does the organization establish a Vulnerability Disclosure Program (VDP) to assist with the secure development and maintenance of products and services that receives unsolicited input from the public about vulnerabilities in organizational systems, services and processes?控制项
Threat Management / Vulnerability Disclosure Program (VDP)
存在建立漏洞披露计划 (VDP) 的机制，以协助产品和服务的安全开发和维护，这些产品和服务接收公众主动提供的有关组织系统、服务和流程中漏洞的信息。
评估
评估状态:
评估备注: