search

intuitem / ciso-assistant-community

CISO Assistant is a one-stop-shop for GRC, covering Risk, AppSec and Audit Management and supporting +50 frameworks worldwide: NIST CSF, ISO 27001, SOC2, CIS, PCI DSS, NIS2, CMMC, PSPF, GDPR, HIPAA, Essential Eight, NYDFS-500, DORA, NIST AI RMF, 800-53, 800-171, CyFun, CJIS, AirCyber, NCSC, ECC, SCF and so much more
https://intuitem.com
GNU Affero General Public License v3.0
936 stars 98 forks source link

Adding "attributes" to security controls #581

Open cota44ur opened 1 week ago

cota44ur commented 1 week ago

Hi,

Accordingly to ISO27002:2022, would it be possible in CISO Assistant to add the following attribute to make security controls easier to categorise: -Control type (preventive, detective, corrective) -Information security properties (confidentiality, integrity, availability) -Cyber security concepts (identify, protect, detect, respond, recover)

Thank you, Kind Regards Eteinne

AndrzejRPiotrowski commented 1 week ago

Is this used somewhere elase in the CISO Assistant ? Can't You modify existing template to have it ?

cota44ur commented 1 week ago

Hi, It is not used in the CISO Assistant UI for the moment. It would be interesting et relevant to add security control types in the following screen :

ciso-assistant-applied-control

Regards

eric-intuitem commented 3 days ago

@cota44ur thanks for the suggestion. We are very keen to introduce the Cyber security concepts directly in the model. Control type can be seen as a subset of this attribute. For the CIA or other dimensions, we are envisioning a generic system of tags that would allow everyone to use custom-defined tags.

cota44ur commented 3 days ago

Hi Eric, Thank you for your proposition that fits my needs. Go on ! Etienne C.