Skip to content

Instantly share code, notes, and snippets.

@aj-stein-nist

aj-stein-nist/simple-example_catalog.xml

Last active January 21, 2024 22:09
Show Gist options
  • Save aj-stein-nist/c3e70a7bd144968d9c460b668be3b1f5 to your computer and use it in GitHub Desktop.
Save aj-stein-nist/c3e70a7bd144968d9c460b668be3b1f5 to your computer and use it in GitHub Desktop.
Download ZIP
Simple Catalog for Debugging
Raw
simple-example_catalog.xml
<?xml version="1.0" encoding="UTF-8"?>
<?xml-model schematypens="http://www.w3.org/2001/XMLSchema" type="application/xml" href="https://github.com/usnistgov/OSCAL/releases/download/v1.1.1/oscal_complete_schema.xsd"?>
<catalog xmlns="http://csrc.nist.gov/ns/oscal/1.0"
uuid="74c8ba1e-5cd4-4ad1-bbfd-d888e2f6c724">
<metadata>
<title>Sample Security Catalog <em>for Demonstration</em> and Testing</title>
<published>2023-10-12T00:00:00.000000-04:00</published>
<last-modified>2023-10-12T00:00:00.000000-04:00</last-modified>
<version>1.1</version>
<oscal-version>1.1.1</oscal-version>
<remarks>
<p>The following is a short excerpt from <a href="https://www.iso.org/standard/54533.html">ISO/IEC 27002:2013</a>, <em>Information technology — Security techniques — Code of practice for information security controls</em>. This work is provided here under copyright <q>fair use</q> for non-profit, educational purposes only. Copyrights for this work are held by the publisher, the International Organization for Standardization (ISO).</p>
</remarks>
</metadata>
<group id="s1">
<title>Organization of Information Security</title>
<prop name="label" value="1"/>
<group id="s1.1">
<title>Internal Organization</title>
<prop name="label" value="1.1"/>
<part id="s1.1_smt" name="overview">
<p>To establish a management framework to initiate and control the implementation and operation of information security within the organization.</p>
</part>
<control id="s1.1.1">
<title>Information security roles and responsibilities</title>
<param id="s1.1.1-prm1">
<label>a choice from a selection</label>
<select how-many="one-or-more">
<choice>initiating a device lock after <insert type="param" id-ref="s1.1.1-prm_2"/> of inactivity</choice>
<choice>requiring the user to initiate a device lock before leaving the system unattended</choice>
</select>
</param>
<param id="s1.1.1-prm_2">
<label>a duration</label>
</param>
<prop name="label" value="1.1.1"/>
<part id="s1.1.1_stm" name="statement">
<p>All information security responsibilities should be defined and allocated.</p>
<p>A value has been assigned to <insert type="param" id-ref="s1.1.1-prm1"/>.</p>
<p>A cross link has been established with a choppy syntax: <a href="#s1.2">(choppy)</a>.</p>
</part>
<part id="s1.1.1_gdn" name="guidance">
<part id="s1.1.1_gdn.1" name="item">
<p>Allocation of information security responsibilities should be done in accordance with the information security policies. Responsibilities for the protection of individual assets and for carrying out specific information security processes should be identified. Responsibilities for information security risk management activities and in particular for acceptance of residual risks should be defined. These responsibilities should be supplemented, where necessary, with more detailed guidance for specific sites and information processing facilities. Local responsibilities for the protection of assets and for carrying out specific security processes should be defined.</p>
</part>
<part id="s1.1.1_gdn.2" name="item">
<p>Individuals with allocated information security responsibilities may delegate security tasks to others. Nevertheless they remain accountable and should determine that any delegated tasks have been correctly performed.</p>
</part>
<part id="s1.1.1_gdn.3" name="item">
<p>Areas for which individuals are responsible should be stated. In particular the following should take place:</p>
<ol>
<li>the assets and information security processes should be identified and defined;</li>
<li>the entity responsible for each asset or information security process should be assigned and the details of this responsibility should be documented;</li>
<li>authorization levels should be defined and documented;</li>
<li>to be able to fulfil responsibilities in the information security area the appointed individuals should be competent in the area and be given opportunities to keep up to date with developments;</li>
<li>coordination and oversight of information security aspects of supplier relationships should be identified and documented.</li>
</ol>
</part>
</part>
<part id="s1.1.1_inf" name="information">
<prop name="label" value="Other information"/>
<p>Many organizations appoint an information security manager to take overall responsibility for the development and implementation of information security and to support the identification of controls.</p>
<p>However, responsibility for resourcing and implementing the controls will often remain with individual managers. One common practice is to appoint an owner for each asset who then becomes responsible for its day-to-day protection.</p>
</part>
</control>
<control id="s1.1.2">
<title>Segregation of duties</title>
<prop name="label" value="1.1.2"/>
<part id="s1.1.2_stm" name="statement">
<p>Conflicting duties and areas of responsibility should be segregated to reduce opportunities for unauthorized or unintentional modification or misuse of the organization’s assets.</p>
</part>
<part id="s1.1.2_gdn" name="guidance">
<part id="s1.1.2_gdn.1" name="item">
<p>Care should be taken that no single person can access, modify or use assets without authorization or detection. The initiation of an event should be separated from its authorization. The possibility of collusion should be considered in designing the controls.</p>
</part>
<part id="s1.1.2_gdn.2" name="item">
<p>Small organizations may find segregation of duties difficult to achieve, but the principle should be applied as far as is possible and practicable. Whenever it is difficult to segregate, other controls such as monitoring of activities, audit trails and management supervision should be considered.</p>
</part>
</part>
<part id="s1.1.2_inf" name="information">
<p>Segregation of duties is a method for reducing the risk of accidental or deliberate misuse of an organization’s assets.</p>
</part>
</control>
</group>
</group>
<group id="s2">
<title>Access control</title>
<prop name="label" value="2"/>
<group id="s2.1">
<title>Business requirements of access control</title>
<prop name="label" value="2.1"/>
<part id="s2.1_smt" name="overview">
<p>To limit access to information and information processing facilities.</p>
</part>
<control id="s2.1.1">
<title>Access control policy</title>
<prop name="label" value="2.1.1"/>
<part id="s2.1.1_stm" name="statement">
<p>An access control policy should be established, documented and reviewed based on business and information security requirements.</p>
</part>
<part id="s2.1.1_gdn" name="guidance">
<part id="s2.1.1_gdn.1" name="item">
<p>Asset owners should determine appropriate access control rules, access rights and restrictions for specific user roles towards their assets, with the amount of detail and the strictness of the controls reflecting the associated information security risks.</p>
</part>
<part id="s2.1.1_gdn.2" name="item">
<p>Access controls are both logical and physical and these should be considered together.</p>
</part>
<part id="s2.1.1_gdn.3" name="item">
<p>Users and service providers should be given a clear statement of the business requirements to be met by access controls.</p>
</part>
<part id="s2.1.1_gdn.4" name="item">
<p>The policy should take account of the following:</p>
<ol>
<li>security requirements of business applications;</li>
<li>policies for information dissemination and authorization, e.g. the need-to-know principle and information security levels and classification of information;</li>
<li>consistency between the access rights and information classification policies of systems and networks;</li>
<li>relevant legislation and any contractual obligations regarding limitation of access to data or services;</li>
<li>management of access rights in a distributed and networked environment which recognizes all types of connections available;</li>
<li>segregation of access control roles, e.g. access request, access authorization, access administration;</li>
<li>requirements for formal authorization of access requests;</li>
<li>requirements for periodic review of access rights;</li>
<li>removal of access rights;</li>
<li>archiving of records of all significant events concerning the use and management of user identities and secret authentication information;,</li>
<li>roles with privileged access.</li>
</ol>
</part>
</part>
<part id="s2.1.1_info" name="information">
<part id="s2.1.1_info.1" name="item">
<p>Care should be taken when specifying access control rules to consider:</p>
<ol>
<li>establishing rules based on the premise “Everything is generally forbidden unless expressly permitted” rather than the weaker rule “Everything is generally permitted unless expressly forbidden”;</li>
<li>changes in information labels that are initiated automatically by information processing facilities and those initiated at the discretion of a user;</li>
<li>changes in user permissions that are initiated automatically by the information system and those initiated by an administrator;</li>
<li>rules which require specific approval before enactment and those which do not.</li>
</ol>
</part>
<part id="s2.1.1_info.2" name="item">
<p>Access control rules should be supported by formal procedures and defined responsibilities.</p>
</part>
<part id="s2.1.1_info.3" name="item">
<p>Role based access control is an approach used successfully by many organizations to link access rights with business roles.</p>
</part>
<part id="s2.1.1_info.4" name="item">
<p>Two of the frequent principles directing the access control policy are:</p>
<ol>
<li>Need-to-know: you are only granted access to the information you need to perform your tasks (different tasks/roles mean different need-to-know and hence different access profile);</li>
<li>Need-to-use: you are only granted access to the information processing facilities (IT equipment, applications, procedures, rooms) you need to perform your task/job/role.</li>
</ol>
</part>
</part>
</control>
<control id="s2.1.2">
<title>Access to networks and network services</title>
<prop name="label" value="2.1.2"/>
<part id="s2.1.2_stm" name="statement">
<p>Users should only be provided with access to the network and network services that they have been specifically authorized to use.</p>
</part>
<part id="s2.1.2_gdn" name="guidance">
<part id="s2.1.2_gdn.1" name="item">
<p>A policy should be formulated concerning the use of networks and network services. This policy should cover:</p>
<ol>
<li>the networks and network services which are allowed to be accessed;</li>
<li>authorization procedures for determining who is allowed to access which networks and networked services;</li>
<li>management controls and procedures to protect access to network connections and network services;</li>
<li>the means used to access networks and network services (e.g. use of VPN or wireless network);</li>
<li>user authentication requirements for accessing various network services;</li>
<li>monitoring of the use of network service</li>
</ol>
</part>
<part id="s2.1.2_gdn.2" name="item">
<p>The policy on the use of network services should be consistent with the organization’s access control policy</p>
</part>
</part>
</control>
</group>
</group>
</catalog>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment