{"text_format":"1","workbook":"xlsx","n_sheets":6,"sheets":["How to Use","How to Score Yourself","Assessment Tool","Tool Mapped to Standards","Tool Mapped to Core Data Servic","Lookups"],"not_rendered":{"charts":0,"images":3,"macros":1,"external_links":0,"defined_names":5,"comments":0,"pivot_tables":0},"unopened":[],"bounds":{"document_bytes":16777216,"sheet_cells":100000,"rows_first":2000,"rows_last":500,"rows_between":2000,"halvings":0,"cell_chars":16384,"cell_head_chars":4096},"cells_cut":0,"cells_raw":0,"read":"whole","date_system":"1900"}

{"sheet":"How to Use","index":0,"n_rows":0,"n_cols":0,"rows_kept":0,"cut":false,"hidden":false,"merged":[]}

{"sheet":"How to Score Yourself","index":1,"n_rows":7,"n_cols":8,"rows_kept":7,"cut":false,"hidden":false,"merged":[[6,0,7,0],[6,4,7,4],[6,5,7,5],[6,6,7,6],[6,7,7,7],[6,2,7,2],[6,1,7,1]]}
[null,"ISO 21827:2008","Definitions","Original ISO text","EDUCAUSE Information Security Maturity Index (Core Data Service, Module 7)","CMMI","NIST","COBIT"]
[0,"Not Performed","There are no security controls or plans in place. The controls are nonexistent.",null,"Not Performed","Non-existent","Non-existent","Non-existent"]
[1,"Performed Informally","Base practices of the control area are generally performed on an ad hoc basis. There is general agreement within the organization that identified actions should be performed, and they are performed when required. The practices are not formally adopted, tracked, and reported on.","Base practices of the process area are generally performed. The performance of these base practices may not be rigorously planned and tracked. Performance depends on individual knowledge and effort. Work products of the process area testify to their performance. Individuals within the organization recognize that an action should be performed, and there is general agreement that this action is performed as and when required. There are identifiable work products for the process.","Absent/ad hoc","Initial","Policies","Initial/Ad-hoc"]
[2,"Planned","The base requirements for the control area are planned, implemented, and repeatable. ","Performance of the base practices in the process area is planned and tracked. Performance according to specified procedures is verified. Work products conform to specified standards and requirements.","Repeatable","Managed","Procedures  ","Repeatable but Intuitive"]
[3,"Well Defined","The primary distinction from Level 2, Planned and Tracked, is that in addition to being repeatable the processes used are more mature: documented, approved, and implemented organization-wide.","Base practices are performed according to a well-defined process using approved, tailored versions of standard, documented processes. The primary distinction from Level 2, Planned and Tracked, is that the process is planned and managed using an organization-wide standard process.","Defined","Defined","Implementation","Defined Process"]
[4,"Quantitatively Controlled","The primary distinction from Level 3, Well Defined, is that the process is measured and verified (e.g., auditable).","Detailed measures of performance are collected and analyzed. This leads to a quantitative understanding of process capability and an improved ability to predict performance. Performance is objectively managed, and the quality of work products is quantitatively known. The primary distinction from the Well Defined level is that the defined process is quantitatively understood and controlled.","Managed","Quantitatively Managed","Test","Managed & Measurable"]
[5,"Continuously Improving","The primary distinction from Level 4, Quantitatively Controlled, is that the defined, standard processes are regularly reviewed and updated. Improvements reflect an understanding of, and response to, a vulnerability's impact.","Quantitative performance goals (targets) for process effectiveness and efficiency are established based on the business goals of the organization. Continuous process improvement against these goals is enabled by quantitative feedback from performing the defined processes and from piloting innovative ideas and technologies. The primary distinction from the quantitatively controlled level is that the defined process and the standard process undergo continuous refinement and improvement, based on a quantitative understanding of the impact of changes to these processes.","Optimized","Optimized","Integration"," Optimized "]

{"sheet":"Assessment Tool","index":2,"n_rows":198,"n_cols":7,"rows_kept":198,"cut":false,"hidden":false,"merged":[[124,4,124,6],[14,4,14,6],[18,4,18,6],[22,4,22,6],[36,4,36,6],[30,4,30,6],[60,4,60,6],[68,4,68,6],[39,4,39,6],[96,4,96,6],[119,4,119,6],[122,4,122,6],[56,4,56,6],[89,4,89,6],[112,4,112,6]]}
[null,null,"This section is designed to help you benchmark your information security Program against universities of similar size, budget, and characteristics. "]
[null,null,"Annual budget of the organization\n"]
[null,null,"What is your institution's Carnegie designation?"]
[null,null,"Estimated annual budget for information security"]
[null,null,"Number of employees","2,100 to 3,000",null,null,"less than 1,000"]
[null,null,"Number of employees with information security role","1 to 5",null,null,0]
[null,null,"Number of students","10,000-20,000",null,null,"less than 5,000"]
[null,null,"Percentage of information security operations outsourced? (contractors, managed security services, cloud)","\n"]
[null,null,"Does your organization have academic or research programs in a sensitive area that may make you a target of physical or cyberattack from any groups (e.g., ITAR, human subjects, DoD-sponsored applied research, etc.)? ","no",null,null,"yes"]
[null,null,"This tool can be used to assess an enterprise information security program, department, or other.  Please select from the drop down box ->","Enterprise Information Security Program"]
[null,null,"Name of person completing assessment:"]
[null,null,"Name of department or institution (if applicable):"]
[null,null,"Date completed","Reset Worksheet ----->"]
["ISO Section Descriptions",null,"Questions","Not Performed = 0; Performed Informally = 1; \nPlanned = 2; Well Defined = 3; \nQuantitatively Controlled = 4; Continuously Improving = 5; Not Applicable = Blank\nNOTE: 5 is the highest level of maturity","Item Score","Category Score","Help"]
[null,null,"Risk Management (ISO 27005:2011)","Total Score for Risk Management ->",{"$f":"IFERROR(AVERAGE(E16:E18),\"\")","v":0}]
[null,1,"Does your institution have a risk management program? ","Not Performed",{"$f":"IF(D16=\"\",\"\",IF(D16=\"No\",0,IF(D16=\"Yes\",5)))","v":false},null,"\n\n\n"]
["Risk Management/Assessment & Treatment",2,"Does your institution have a process for identifying and assessing reasonably foreseeable internal and external risks to the security, confidentiality, and/or integrity of any electronic, paper, or other records containing sensitive information?","Not Performed",{"$f":"VLOOKUP(D17,Lookups!$A$2:$B$8,2,FALSE)","v":0}]
["Assessing Security Risks ",3,"Does your organization conduct routine risk assessments to identify the key objectives that need to be supported by your information security program? ","Not Performed",{"$f":"VLOOKUP(D18,Lookups!$A$2:$B$8,2,FALSE)","v":0}]
[null,null,"Information Security Policies (ISO 5)","Total Score for ISO 5->",{"$f":"IFERROR(AVERAGE(E20:E22),\"\")","v":0}]
[null,4,"Does your institution have an information security policy that has been approved by management?","Not Performed",{"$f":"VLOOKUP(D20,Lookups!$A$2:$B$8,2,FALSE)","v":0}]
["Information Security Policy Document",5,"Has it been published and communicated to all relevant parties? \n","Not Performed",{"$f":"VLOOKUP(D21,Lookups!$A$2:$B$8,2,FALSE)","v":0}]
["Review of Information Security Policy ",6,"Does your institution review the policy at defined intervals to encompass significant change and monitor for compliance?","Not Performed",{"$f":"VLOOKUP(D22,Lookups!$A$2:$B$8,2,FALSE)","v":0}]
[null,null,"Organization of Information Security (ISO 6) ","Total Score for ISO 6 ->",{"$f":"IFERROR(AVERAGE(E24:E30),\"\")","v":0}]
["Management Commitment to information security",7,"Does your information security function have the authority it needs to manage and ensure compliance with the information security program? ","Not Performed",{"$f":"VLOOKUP(D24,Lookups!$A$2:$B$8,2,FALSE)","v":0}]
["Information security Co-ordination",8,"Does your institution have an individual with enterprise-wide (campus) information security responsibility and authority written in their job description, or equivalent? Note: This may be the CIO, CISO, CSO, or other.","Not Performed",{"$f":"VLOOKUP(D25,Lookups!$A$2:$B$8,2,FALSE)","v":0}]
["Allocation of information security responsibilities ",9,"Is responsibility clearly assigned for all areas of the information security architecture, compliance, processes, and audits? ","Not Performed",{"$f":"VLOOKUP(D26,Lookups!$A$2:$B$8,2,FALSE)","v":0}]
["Authorization process for Information Processing facilities ",10,"Is there a formal process for having the individual with information security responsibility assess and sign off on appropriate hardware, software, and services, ensuring they follow security policies and requirements?","Not Performed",{"$f":"VLOOKUP(D27,Lookups!$A$2:$B$8,2,FALSE)","v":0}]
["Contact with authorities",11,"Does your institution maintain relationships with local authorities? \n","Not Performed",{"$f":"VLOOKUP(D28,Lookups!$A$2:$B$8,2,FALSE)","v":0}]
["Contact with special interest groups",12,"Does your institution participate with local or national security groups (e.g., REN-ISAC, EDUCAUSE, InfraGard, Information Systems Security Association, etc.)?","Not Performed",{"$f":"VLOOKUP(D29,Lookups!$A$2:$B$8,2,FALSE)","v":0}]
["Independent review of information security",13,"Does your institution have independent security reviews completed at planned intervals or when significant changes to the environment occur?","Not Performed",{"$f":"VLOOKUP(D30,Lookups!$A$2:$B$8,2,FALSE)","v":0}]
[null,null,"Human Resource Security (ISO 7)","Total Score for ISO 7 ->",{"$f":"IFERROR(AVERAGE(E32:E36),\"\")","v":0}]
["Management Responsibility",14,"Do all individuals interacting with university systems receive information security awareness training?","Not Performed",{"$f":"VLOOKUP(D32,Lookups!$A$2:$B$8,2,FALSE)","v":0}]
["Information security awareness, education and training",15,"Does your institution conduct specialized role-based training? \n","Not Performed",{"$f":"VLOOKUP(D33,Lookups!$A$2:$B$8,2,FALSE)","v":0}]
[null,16,"Do the information security programs clearly state responsibilities, liabilities, and consequences? ","Not Performed",{"$f":"VLOOKUP(D34,Lookups!$A$2:$B$8,2,FALSE)","v":0}]
["Termination responsibility",17,"Does your institution have a process for revoking system and building access and returning assigned assets? ","Not Performed",{"$f":"VLOOKUP(D35,Lookups!$A$2:$B$8,2,FALSE)","v":0}]
["Return of assets",18,"Does your institution have a process for revoking system access when there is a position change or when responsibilities change?","Not Performed",{"$f":"VLOOKUP(D36,Lookups!$A$2:$B$8,2,FALSE)","v":0}]
[null,null,"Asset Management (ISO 8) ","Total Score for ISO 8->",{"$f":"IFERROR(AVERAGE(E38:E39),\"\")","v":0}]
["Inventory of assets",19,"Has your organization identified critical information assets and the functions that rely on them? ","Not Performed",{"$f":"VLOOKUP(D38,Lookups!$A$2:$B$8,2,FALSE)","v":0}]
["Classification Guidelines",20,"Does your institution classify information to indicate the appropriate levels of information security? ","Not Performed",{"$f":"VLOOKUP(D39,Lookups!$A$2:$B$8,2,FALSE)","v":0}]
[null,null,"Access Control (ISO 9)","Total Score for ISO 9->",{"$f":"IFERROR(AVERAGE(E41:E56),\"\")","v":0}]
["Access control Policy",21,"Does your institution have an access control policy for authorizing and revoking access rights to information systems? \n\n","Not Performed",{"$f":"VLOOKUP(D41,Lookups!$A$2:$B$8,2,FALSE)","v":0}]
["User Registration",22,"Does your institution have a process in place for granting and revoking appropriate user access?\n\n","Not Performed",{"$f":"VLOOKUP(D42,Lookups!$A$2:$B$8,2,FALSE)","v":0}]
["Privilege Management (covered by #2)",null,null,"Not Performed",{"$f":"VLOOKUP(D43,Lookups!$A$2:$B$8,2,FALSE)","v":0}]
["User password management",23,"Does your institution have a password management program that follows current security standards? \n","Not Performed",{"$f":"VLOOKUP(D44,Lookups!$A$2:$B$8,2,FALSE)","v":0}]
["Review of user access rights",24,"Does your institution have procedures to regularly review users' access to ensure only needed privileges are applied? ","Not Performed",{"$f":"VLOOKUP(D45,Lookups!$A$2:$B$8,2,FALSE)","v":0}]
["User authentication for external connections",25,"Does your institution employ specific measures to secure remote access services? ","Not Performed",{"$f":"VLOOKUP(D46,Lookups!$A$2:$B$8,2,FALSE)","v":0}]
["Network Routing control",26,"Does your institution employ technologies to block or restrict unencrypted sensitive information from traveling to untrusted networks? ","Not Performed",{"$f":"VLOOKUP(D47,Lookups!$A$2:$B$8,2,FALSE)","v":0}]
["Secure Log-on procedures",27,"Does your institution have mechanisms in place to manage digital identities (accounts, keys, tokens) throughout their life cycle, from registration through termination? ","Not Performed",{"$f":"VLOOKUP(D48,Lookups!$A$2:$B$8,2,FALSE)","v":0},null,"\n"]
["User identification and authentication",28,"Is there a policy in place to restrict the sharing of passwords?","Not Performed",{"$f":"VLOOKUP(D49,Lookups!$A$2:$B$8,2,FALSE)","v":0}]
[null,29,"Does your institution prohibit use of generic accounts with privileged access to systems?","Not Performed",{"$f":"VLOOKUP(D50,Lookups!$A$2:$B$8,2,FALSE)","v":0},null,"\n"]
["Password Management system",30,"Does your institution have an authentication system in place that applies higher levels of authentication to protect resources with higher levels of sensitivity? ","Not Performed",{"$f":"VLOOKUP(D51,Lookups!$A$2:$B$8,2,FALSE)","v":0}]
["Use of system utilities",31,"Does your institution have an authorization system that enforces time limits lockout on login failure and defaults to minimum privileges? ","Not Performed",{"$f":"VLOOKUP(D52,Lookups!$A$2:$B$8,2,FALSE)","v":0}]
["Sensitive system isolation",32,"Does your institution have standards for isolating sensitive data and procedures and technologies in place to protect it from unauthorized access and tampering?","Not Performed",{"$f":"VLOOKUP(D53,Lookups!$A$2:$B$8,2,FALSE)","v":0}]
["Mobile computing and communication",33,"Does your institution have usage guidance established for mobile computing devices (regardless of ownership) that store, process, or transmit institutional data? ","Not Performed",{"$f":"VLOOKUP(D54,Lookups!$A$2:$B$8,2,FALSE)","v":0}]
[null,34,"Does your institution require encryption on mobile (i.e., laptops, tablets, etc.) computing devices?","Not Performed",{"$f":"VLOOKUP(D55,Lookups!$A$2:$B$8,2,FALSE)","v":0}]
["Teleworking",35,"Does your institution have a telework policy that addresses multifactor access and security requirements for the end point used?","Not Performed",{"$f":"VLOOKUP(D56,Lookups!$A$2:$B$8,2,FALSE)","v":0}]
[null,null,"Cryptography (ISO 10)","Total Score for ISO 10->",{"$f":"IFERROR(AVERAGE(E58:E60),\"\")","v":0}]
[null,36,"Does your institution use appropriate/vetted encryption methods to protect sensitive data in transit?","Not Performed",{"$f":"VLOOKUP(D58,Lookups!$A$2:$B$8,2,FALSE)","v":0}]
["Policy on the use of cryptographic controls",37,"Do your policies indicate when encryption should be used (e.g., at rest, in transit, with sensitive or confidential data, etc.)?","Not Performed",{"$f":"VLOOKUP(D59,Lookups!$A$2:$B$8,2,FALSE)","v":0}]
["Key Management",38,"Are standards for key management documented and employed?","Not Performed",{"$f":"VLOOKUP(D60,Lookups!$A$2:$B$8,2,FALSE)","v":0}]
[null,null,"Physical and Environmental Security (ISO 11)","Total Score for ISO 11->",{"$f":"IFERROR(AVERAGE(E62:E68),\"\")","v":0}]
["Physical entry controls",39,"Do your institution's data centers include controls to ensure that only authorized parties are allowed physical access? \n","Not Performed",{"$f":"VLOOKUP(D62,Lookups!$A$2:$B$8,2,FALSE)","v":0}]
["Protecting against external and environmental threats",40,"Does your institution have preventative measures in place to protect critical hardware and wiring from natural and man-made threats?","Not Performed",{"$f":"VLOOKUP(D63,Lookups!$A$2:$B$8,2,FALSE)","v":0}]
["Working in secure areas",41,"Does your institution have a process for issuing keys, codes, and/or cards that require appropriate authorization and background checks for access to these sensitive facilities?","Not Performed",{"$f":"VLOOKUP(D64,Lookups!$A$2:$B$8,2,FALSE)","v":0}]
["Equipment Maintenance",42,"Does your institution follow vendor-recommended guidance for maintaining equipment?","Not Performed",{"$f":"VLOOKUP(D65,Lookups!$A$2:$B$8,2,FALSE)","v":0}]
["Security of equipment off-premises",null,"Omit","Not Performed",{"$f":"VLOOKUP(D66,Lookups!$A$2:$B$8,2,FALSE)","v":0}]
["Secure disposal or reuse of equipment",43,"Does your institution have a media-sanitization process that is applied to equipment prior to disposal, reuse, or release?\n\n\n","Not Performed",{"$f":"VLOOKUP(D67,Lookups!$A$2:$B$8,2,FALSE)","v":0}]
["Removal of Property",44,"Are there processes in place to detect the unauthorized removal of equipment, information, or software?","Not Performed",{"$f":"VLOOKUP(D68,Lookups!$A$2:$B$8,2,FALSE)","v":0}]
[null,null,"Operations Security (ISO 12)","Total Score for ISO 12->",{"$f":"IFERROR(AVERAGE(E70:E89),\"\")","v":0}]
["Documented operating Procedures",45,"Does your institution maintain security configuration standards for information systems and applications? ","Not Performed",{"$f":"VLOOKUP(D70,Lookups!$A$2:$B$8,2,FALSE)","v":0}]
["Change Management",46,"Are changes to information systems tested, authorized, and reported?","Not Performed",{"$f":"VLOOKUP(D71,Lookups!$A$2:$B$8,2,FALSE)","v":0}]
["Segregation of Duties",47,"Are duties sufficiently segregated to ensure unintentional or unauthorized modification of information is detected? ","Not Performed",{"$f":"VLOOKUP(D72,Lookups!$A$2:$B$8,2,FALSE)","v":0}]
["Separation of development and Operations facilities",48,"Are production systems separated from other stages of the development life cycle?","Not Performed",{"$f":"VLOOKUP(D73,Lookups!$A$2:$B$8,2,FALSE)","v":0}]
["Capacity management",49,"Does your institution have processes in place to monitor the utilization of key system resources and to mitigate the risk of system downtime? ","Not Performed",{"$f":"VLOOKUP(D74,Lookups!$A$2:$B$8,2,FALSE)","v":0}]
["Controls against malicious code",50,"Are methods used to detect, quarantine, and eradicate known malicious code on information systems including workstations, servers, and mobile computing devices? ","Not Performed",{"$f":"VLOOKUP(D75,Lookups!$A$2:$B$8,2,FALSE)","v":0}]
[null,51,"Are methods used to detect and eradicate known malicious code transported by electronic mail, the web, or removable media?","Not Performed",{"$f":"VLOOKUP(D76,Lookups!$A$2:$B$8,2,FALSE)","v":0}]
["Information Backup",52,"Is your data backup process frequency consistent with the availability requirements of your organization? ","Not Performed",{"$f":"VLOOKUP(D77,Lookups!$A$2:$B$8,2,FALSE)","v":0}]
[null,53,"Does your institution have a process for posture checking, such as current antivirus software, firewall enabled, OS patch level, etc., of devices as they connect to your network?","Not Performed",{"$f":"VLOOKUP(D78,Lookups!$A$2:$B$8,2,FALSE)","v":0}]
[null,54,"Does your institution have a segmented network architecture to provide different levels of security based on the information's classification?\n","Not Performed",{"$f":"VLOOKUP(D79,Lookups!$A$2:$B$8,2,FALSE)","v":0}]
[null,55,"Are Internet-accessible servers protected by more than one security layer (firewalls, network IDS, host IDS, application IDS)? ","Not Performed",{"$f":"VLOOKUP(D80,Lookups!$A$2:$B$8,2,FALSE)","v":0}]
["Management of removable media",56,"Are controls in place to protect, track, and report status of media that has been removed from secure organization sites? ","Not Performed",{"$f":"VLOOKUP(D81,Lookups!$A$2:$B$8,2,FALSE)","v":0}]
["Electronic Commerce ",57,"Does your institution have a process in place to ensure data related to electronic commerce (e-commerce) traversing public networks is protected from fraudulent activity, unauthorized disclosure, or modification?","Not Performed",{"$f":"VLOOKUP(D82,Lookups!$A$2:$B$8,2,FALSE)","v":0}]
["Audit logging",58,"Are security-related activities such as hardware configuration changes, software configuration changes, access attempts, and authorization and privilege assignments automatically logged? ","Not Performed",{"$f":"VLOOKUP(D83,Lookups!$A$2:$B$8,2,FALSE)","v":0}]
["Monitoring system use",59,"Does your institution have a process for routinely monitoring logs to detect unauthorized and anomalous activities?","Not Performed",{"$f":"VLOOKUP(D84,Lookups!$A$2:$B$8,2,FALSE)","v":0}]
[null,60,"Does your institution record your log reviews (recertification/attestation)?","Not Performed",{"$f":"VLOOKUP(D85,Lookups!$A$2:$B$8,2,FALSE)","v":0}]
[null,61,"Are steps taken to secure log data to prevent unauthorized access and tampering?","Not Performed",{"$f":"VLOOKUP(D86,Lookups!$A$2:$B$8,2,FALSE)","v":0}]
["Administrator and operator logs",62,"Does your institution regularly review administrative and operative access to audit logs?","Not Performed",{"$f":"VLOOKUP(D87,Lookups!$A$2:$B$8,2,FALSE)","v":0}]
["Fault logging",63,"Are file-integrity monitoring tools used to alert personnel to unauthorized modification of critical system files, configuration files, or content files and to configure the software to perform critical file comparisons at least weekly?","Not Performed",{"$f":"VLOOKUP(D88,Lookups!$A$2:$B$8,2,FALSE)","v":0}]
["Clock synchronization",64,"Does your institution have a process to ensure synchronization of system clocks with an authoritative source (e.g., via NTP) on a periodic basis commensurate with the potential risks? ","Not Performed",{"$f":"VLOOKUP(D89,Lookups!$A$2:$B$8,2,FALSE)","v":0}]
[null,null,"Communications Security (ISO 13)","Total Score for ISO 13->",{"$f":"IFERROR(AVERAGE(E91:E96),\"\")","v":0}]
["Confidentiality agreements",65,"Does your institution require the use of confidentiality or nondisclosure agreements for employees and third parties?","Not Performed",{"$f":"VLOOKUP(D91,Lookups!$A$2:$B$8,2,FALSE)","v":0}]
[null,66,"Does your institution routinely test your restore procedures?","Not Performed",{"$f":"VLOOKUP(D92,Lookups!$A$2:$B$8,2,FALSE)","v":0}]
["Network controls",67,"Does your institution continuously monitor your wired and wireless networks for unauthorized access?","Not Performed",{"$f":"VLOOKUP(D93,Lookups!$A$2:$B$8,2,FALSE)","v":0}]
["Information exchange policies and procedures",68,"Does your institution have policies and procedures in place to protect exchanged information (within your organization and in third-party agreements) from interception, copying, modification, misrouting, and destruction?","Not Performed",{"$f":"VLOOKUP(D94,Lookups!$A$2:$B$8,2,FALSE)","v":0}]
["Remote diagnostic and configuration port protection",69,"Does your institution ensure that user access to diagnostic and configuration ports is restricted to authorized individuals and applications?","Not Performed",{"$f":"VLOOKUP(D95,Lookups!$A$2:$B$8,2,FALSE)","v":0}]
["Network connection control",70,"Does your institution employ specific measures to prevent and detect rogue access for all of your wireless LANs?","Not Performed",{"$f":"VLOOKUP(D96,Lookups!$A$2:$B$8,2,FALSE)","v":0}]
[null,null,"Systems Acquisition, Development, and Maintenance (ISO 14)","Total Score for ISO 14->",{"$f":"IFERROR(AVERAGE(E98:E112),\"\")","v":0}]
["Security Requirements of Information Systems",71,"Does your institution have a process for validating the security of purchased software products and services?","Not Performed",{"$f":"VLOOKUP(D98,Lookups!$A$2:$B$8,2,FALSE)","v":0}]
["To ensure that security is an integral part of information systems.",null,null,"Not Performed",{"$f":"VLOOKUP(D99,Lookups!$A$2:$B$8,2,FALSE)","v":0}]
["Security requirement analysis and specifications",72,"Are new information systems or enhancements to existing information systems validated against defined security requirements?","Not Performed",{"$f":"VLOOKUP(D100,Lookups!$A$2:$B$8,2,FALSE)","v":0}]
["Input data validation",73,"Have standards been established that address secure coding practices (e.g., input validation, proper error handling, session management, etc.), and take into consideration common application security vulnerabilities (e.g., CSRF, XSS, code injection, etc.)?","Not Performed",{"$f":"VLOOKUP(D101,Lookups!$A$2:$B$8,2,FALSE)","v":0}]
["Control of internal processing",74,"Are validation checks incorporated into applications to detect any corruption of information through processing errors or deliberate acts?","Not Performed",{"$f":"VLOOKUP(D102,Lookups!$A$2:$B$8,2,FALSE)","v":0}]
["Message integrity",75,"Are processes in place to check whether message integrity is required?","Not Performed",{"$f":"VLOOKUP(D103,Lookups!$A$2:$B$8,2,FALSE)","v":0}]
["Output data validation",76,"Incorrect output may occur, even in tested systems. Does your institution have validation checks to ensure data output is as expected?","Not Performed",{"$f":"VLOOKUP(D104,Lookups!$A$2:$B$8,2,FALSE)","v":0}]
["Control of Operational software",77,"Have you established procedures for maintaining source code during the development life cycle and while in production to reduce the risk of software corruption?","Not Performed",{"$f":"VLOOKUP(D105,Lookups!$A$2:$B$8,2,FALSE)","v":0}]
["Protection of system test data",78,"Does your institution apply the same security standards for sensitive test data that you apply to sensitive production data?","Not Performed",{"$f":"VLOOKUP(D106,Lookups!$A$2:$B$8,2,FALSE)","v":0}]
["Access control to program source library",79,"Does your institution restrict and monitor access to source code libraries to reduce the risk of corruption?","Not Performed",{"$f":"VLOOKUP(D107,Lookups!$A$2:$B$8,2,FALSE)","v":0}]
["Change Control Procedures",80,"Does your institution have a configuration-management process in place to ensure that changes to your critical systems are for valid business reasons and have received proper authorization? ","Not Performed",{"$f":"VLOOKUP(D108,Lookups!$A$2:$B$8,2,FALSE)","v":0}]
["Technical review of applications after Operating system changes",81,"Are reviews and tests performed to ensure that changes made to production systems do not have an adverse impact on security or operations?","Not Performed",{"$f":"VLOOKUP(D109,Lookups!$A$2:$B$8,2,FALSE)","v":0}]
["Information Leakage",82,"Have you implemented tools and procedures to monitor for and prevent loss of sensitive data?","Not Performed",{"$f":"VLOOKUP(D110,Lookups!$A$2:$B$8,2,FALSE)","v":0}]
["Outsourced Software Development",83,"Do your contract agreements include security requirements for outsourced software development?","Not Performed",{"$f":"VLOOKUP(D111,Lookups!$A$2:$B$8,2,FALSE)","v":0}]
["Control of technical vulnerabilities",84,"Does your institution have a patch management strategy in place and responsibilities assigned for monitoring and promptly responding to patch releases, security bulletins, and vulnerability reports? ","Not Performed",{"$f":"VLOOKUP(D112,Lookups!$A$2:$B$8,2,FALSE)","v":0}]
[null,null,"Supplier Relationships (ISO 15)","Total Score for ISO 15->",{"$f":"IFERROR(AVERAGE(E114:E119),\"\")","v":0}]
["Identification of risk related to external parties",85,"Does your institution specify security requirements in contracts with external entities (third party) before granting access to sensitive institutional information assets?","Not Performed",{"$f":"VLOOKUP(D114,Lookups!$A$2:$B$8,2,FALSE)","v":0}]
["Addressing security when dealing with customers",86,"Are requirements addressed and remediated prior to granting access to data, assets, and information systems?","Not Performed",{"$f":"VLOOKUP(D115,Lookups!$A$2:$B$8,2,FALSE)","v":0}]
["Service Delivery",87,"Do agreements for external information system services specify appropriate security requirements? ","Not Performed",{"$f":"VLOOKUP(D116,Lookups!$A$2:$B$8,2,FALSE)","v":0}]
["Monitoring and review of third-party services",88,"Does your institution have a process in place for assessing that external information system providers comply with appropriate security requirements?","Not Performed",{"$f":"VLOOKUP(D117,Lookups!$A$2:$B$8,2,FALSE)","v":0}]
[null,89,"Is external information system services provider compliance with security controls monitored? ","Not Performed",{"$f":"VLOOKUP(D118,Lookups!$A$2:$B$8,2,FALSE)","v":0}]
[null,90,"Are external information system service agreements executed and routinely reviewed to ensure security requirements are current? ","Not Performed",{"$f":"VLOOKUP(D119,Lookups!$A$2:$B$8,2,FALSE)","v":0}]
[null,null,"Information Security Incident Management (ISO 16)","Total Score for ISO 16->",{"$f":"IFERROR(AVERAGE(E121:E122),\"\")","v":0}]
["Reporting Information security events",91,"Are incident-handling procedures in place to report and respond to security events throughout the incident life cycle, including the definition of roles and responsibilities?","Not Performed",{"$f":"VLOOKUP(D121,Lookups!$A$2:$B$8,2,FALSE)","v":0}]
["Collection of evidence",92,"Are your incident response staff aware of legal or compliance requirements surrounding evidence collection?","Not Performed",{"$f":"VLOOKUP(D122,Lookups!$A$2:$B$8,2,FALSE)","v":0}]
[null,null,"Information Security Aspects of Business Continuity Management (ISO 17)","Total Score for ISO 17->",{"$f":"IFERROR(AVERAGE(E124),\"\")","v":0}]
["Including information security in Business continuity management process",93,"Does your institution have a documented business continuity plan for information technology that is based on a business impact analysis, is periodically tested, and has been reviewed and approved by senior staff or the board of trustees?\n","Not Performed",{"$f":"VLOOKUP(D124,Lookups!$A$2:$B$8,2,FALSE)","v":0}]
[null,null,"Compliance (ISO 18)","Total Score for ISO 18->",{"$f":"IFERROR(AVERAGE(E126:E133),\"\")","v":0}]
["Protection of organizational records",94,"Does your institution have a records management or data governance policy that addresses the life cycle of both paper and electronic records at your institution?","Not Performed",{"$f":"VLOOKUP(D126,Lookups!$A$2:$B$8,2,FALSE)","v":0}]
["Data Protection and privacy of personal information",95,"Does your institution have an enforceable data protection policy that covers personally identifiable information (PII)?","Not Performed",{"$f":"VLOOKUP(D127,Lookups!$A$2:$B$8,2,FALSE)","v":0}]
["Prevention of misuse of information processing facilities",96,"Does your institution have an Acceptable Use Policy that defines misuse?","Not Performed",{"$f":"VLOOKUP(D128,Lookups!$A$2:$B$8,2,FALSE)","v":0}]
["Regulation of cryptographic controls",97,"Does your institution provide guidance for the community on export control laws?","Not Performed",{"$f":"VLOOKUP(D129,Lookups!$A$2:$B$8,2,FALSE)","v":0}]
["Compliance with security policy",98,"Are standard operating procedures periodically evaluated for compliance with your organization's security policies, standards, and procedures?","Not Performed",{"$f":"VLOOKUP(D130,Lookups!$A$2:$B$8,2,FALSE)","v":0}]
["Technical compliance checking",99,"Does your institution perform periodic application and network layer vulnerability testing or penetration testing against critical information systems?","Not Performed",{"$f":"VLOOKUP(D131,Lookups!$A$2:$B$8,2,FALSE)","v":0}]
["Information System Audit controls",100,"Are you performing independent audits on information systems to identify strengths and weaknesses?","Not Performed",{"$f":"VLOOKUP(D132,Lookups!$A$2:$B$8,2,FALSE)","v":0}]
["Protection of information system audit tools",101,"Are audit tools properly separated from development and operational system environments to prevent any misuse or compromise?","Not Performed",{"$f":"VLOOKUP(D133,Lookups!$A$2:$B$8,2,FALSE)","v":0}]
[null,null,"THE END -- overall average ------>",null,null,{"$f":"AVERAGE(E16:E133)","v":0}]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[" "]
[" "]
[" "]
[" "]
[" "]
[" "]
[" "]
[" "]
[" "]
[" "]
[" "]
[" "]
[" "]
[" "]
[" "]
[" "]
[" "]
[" "]
[" "]
[" "]

{"sheet":"Tool Mapped to Standards","index":3,"n_rows":117,"n_cols":6,"rows_kept":117,"cut":false,"hidden":false,"merged":[]}
["Assessment Tool Question #","ISO 27002:2013","NIST SP 800-53 r4 Controls","NIST 800-171 r1 Controls","NIST Cybersecurity Framework","CIS 20 Critical Security Controls (ver 6.1)"]
["Risk Management (ISO 27005:2011)"]
[1,"No direct mapping, see ISO 27005 (risk management)","RA-1","3.11.1","ID.RM-1"]
[2,"No direct mapping, see ISO 27005 (risk management)","RA-2","3.11.1","ID.RM-1"]
[3,"No direct mapping, see ISO 27005 (risk management)","RA-3","3.11.1","ID.RM-1, ID.GV-4"]
["Information Security Policies (ISO 5)"]
[4,"5. Information Security Policies","PL Family",null,"ID.GV-1"]
[5,"5.1 Management direction for information security","PL Family",null,"ID.GV-1"]
[6,"5.1.1 Policies for information security","PL Family","3.12.4","ID.GV-1"]
["Organization of Information Security (ISO 6)"]
[7,"7.2.1 Management responsibilities","PM-2, PM-3, PM-9; SP 800-39,SP 800-37"]
[8,"Deleted from ISO 27002:2013","CP-2, CP-4, IR-4, PL-1, PL-2, PM-2, SA-2;SP 800-39, SP 800-37"]
[9,"6.1.1 Information security roles and responsibilities","AC-5, AC-6, CM-9, PM-2; SP 800-39, SP 800-37",null,"ID.AM-6; ID.GV-2"]
[10,"Deleted from ISO 27002:2013","CA-1, CA-6, PM-10; SP 800-37",null,"ID.AM-6"]
[11,"6.1.3 Contact with authorities","Multiple controls with contact reference (e.g.,IR-6, SI-5), SP 800-39; SP 800-37",null,"DE.DP-4, RS.CO-3, RS.CO-5"]
[12,"6.1.4 Contact with special interest groups","AT-5, SI-5",null,"RS.CO-5"]
[13,"18.2.1 Independent review of information security","CA-2, CA-7; SP 800-39, SP 800-37"]
["Human Resource Security (ISO 7)"]
[14,"7.2.2 Information security awareness, education and training","AT-2, AT-3, IR-2","3.2.1; 3.2.2","PR.AT-1","CSC 17"]
[15,"7.2.3 Disciplinary process","AT-3, PS-8",null,"PR.AT-2, PR.AT-3, PR.AT-4, PR.AT-5","CSC 17"]
[16,"7.3 Termination and change of employment","PS-4",null,"PR.AT-2, PR.AT-3, PR.AT-4, PR.AT-6"]
[17,"7.3.1 Termination or change of employment responsibilities\n8.1.4 Return of assets\n9.2.6 Removal or adjustment of access rights\n11.1 Secure areas\n11.1.1 Physical security perimeter","AC-2, PS-4, PS-5, PE-3",null,"PR.AC-4, PR.DS-3","CSC 16"]
[18,"11.1.2 Physical entry controls\n11.1.3 Securing offices, room and facilities","PE-3, PE-4, PE-5, PE-6",null,"PR.AC-4, PR.DS-3","CSC 16"]
["Asset Management (ISO 8)"]
[19,"8.1.1 Inventory of assets","CM-8, CM-9, PM-5","3.4.1","ID.AM-1, ID.AM-2","CSC 1 (devices), CSC 2 (software), CSC13 (data)"]
[20,"8.1.2 Ownership of assets","CM-8, CM-9, PM-5, AC-16, AC-20, PL-4, RA-2, MP-2, MP-3, SC-16","3.4.1","ID.AM-5","CSC 13"]
["Access Control (ISO 9)"]
[21,"9.1 Business requirements of access control","AC-1",3.1,"PR.AC-1, PR.AC-4"]
[22,"9.1.1 Access control policy\n9.2 User access management","AC-1, AC-3, AC-5, AC-6, AC-7, AC-9, AC-17, AC-18, AC-19, CM-5, MP-1, SI-9","3.1.1; 3.1.2; 3.1.4; 3.1.5","PR.AC-1, PR.AC-4","CSC 5, CSC 16"]
[23,"9.2.1 User registration and deregistration \n9.2.2 User access provisioning\n9.2.3 Management of privileged access rights","AC-1, AC-2, AC-6, AC-21, IA-5, PE-1, PE-2, SI-9","3.1.1; 3.1.2; 3.1.4; 3.1.5","PR.AC-1, PR.AC-4","CSC 5"]
[24,"9.2.4 Management of secret authentication information of users","AC-6, IA-5",null,"PR.AC-4","CSC 5"]
[25,"9.2.5 Review of user access rights\n9.3 User responsibilities\n9.3.1 Use of secret authentication information\n11.2.8 Unattended user equipment\n11.2.9 Clear desk and clear screen policy\n13. Communications security\n9.1.2 Access to networks and network services","AC-1, AC-2, AC-5, AC-6, AC-11, AC-17, AC-18, AC-20, IA-2, IA-5m PE-2  PE-3, PE-5, PE-18, SC-10, MP-4","3.1.1; 3.1.2; 3.1.4; 3.1.5","PR.AC-3","CSC 3"]
[26,"Deleted from ISO 27002:2013","AC-3, AC-6, AC-17, AC-18, SC-7",null,"PR.DS-5"]
[27,"9.4 System and application access control","AC-4, AC-17, AC-18",null,"PR.DS-6","CSC 5, CSC 16"]
[28,"9.4.2 Secure log-on procedures","AC-7, AC-8, AC-9, AC-10, IA-2, IA-6, IA-8, SC-10","3.1.8",null,"CSC 16"]
[29,"9.2.1 User registration and deregistration\n9.2.2 User access provisioning","IA-2, IA-4, IA-5, IA-8",null,"PR.AC-1, PR.AC-4","CSC 5"]
[30,"9.1.1 Access control policy\n9.2 User access management\n9.2.3 Management of privileged access rights","AC-5, AC-24","3.1.4; 3.1.5; 3.1.6; 3.1.7; 3.5.3",null,"CSC 5"]
[31,"9.4.3 Password management system","IA-2, IA-5","3.5.5",null,"CSC 16"]
[32,"9.4.2 Secure log-on procedures \n9.4.4 Use of privileged utility programs","AC-2, AC-3, AC-6, AC-11, AC-14, CM-5, SC-10","3.1.6; 3.1.7; 3.1.8; 3.4.5",null,"CSC 13"]
[33,"9.4.1 Information access restriction \n6.2 Mobile devices and teleworking","AC-19, SC-7; SP 800-39"]
[34,"6.2.1 Mobile device policy","AC-1, AC-17, AC-18, AC-19, PL-4, PS-6","3.1.12; 3.1.16; 3.1.18",null,"CSC 14"]
[35,"6.2 Mobile devices and teleworking\n6.2.1 Mobile device policy\n6.2.2 Teleworking","AC-19, AC-24","3.1.18","PR.AC-3"]
["Cryptography (ISO 10)"]
[36,"10. Cryptography","SC-13","3.1.19","PR.DS-2","CSC 14"]
[37,"10. Cryptography","SC-13","3.1.19","PR.DS-1, PR.DS-2, ","CSC 14"]
[38,"10.1.1  Policy on the use of cryptographic controls","Multiple controls address cryptography (e.g., IA-7, SC-8, SC-9, SC-12, SC-13)","3.13.10","PR.DS-6"]
["Physical and Environmental Security (ISO 11)"]
[39,"11.1.4 Protecting against external and environmental threats","CP Family; PE-1, PE-2, PE-9, PE-10, PE-11, PE-13,PE-15","3.10.1","PR.PT-3, PR.AC-2"]
[40,"11.1.5 Working in secure areas \n11.1.6 Delivery and loading areas \n11.2 Equipment","AT-2, AT-3 , PL-4, PS-6, PE-1, PE-2, PE-3, PE-4, PE-6, PE-8, PE-9, PE-11, PE-12, PE-14, PE-16, PE-18","3.10.2","PR.IP-5, PR.DS-4"]
[41,"11.2.4 Equipment maintenance \n11.2.6 Security of equipment and assets off-premises","MA Family, MP-5, PE-1, PE-3, PE-6","3.10.5","PR.IP-5, PR.PT-3"]
[42,"11.2.7 Secure disposal or re-use of equipment","MP-6",null,"PR.MA-1"]
[43,"11.2.5 Removal of assets\n12. Operations security","MP-5 , MP-6, PE-16","3.8.3","PR.IP-6"]
[44,"12.1.1 Document operating procedures","CM-9, PE-19, PE-20","3.8.7","PR.DS-3, PR.DS-5"]
["Operations Security (ISO 12)"]
[45,"12.1.2 Change management","CM-1, CM-3, CM-4, CM-5, CM-9","3.4.1; 3.4.2","PR.IP-1","CSC 3"]
[46,"12.1.2 Change management","AC-5","3.4.4","PR.IP-2, PR.IP-3"]
[47,"6.1.2  Segregation of duties","CM-2",null,"PR.AC-4"]
[48,"15.2.1 Monitoring and review of supplier services","SA-9",null,"PR.DS-8"]
[49,"12.1.3 Capacity management","AU-4, AU-5, CP-2, SA-2, SC-5",null,"DE.AE-1, PR.DS-4"]
[50,"12.2.1 Controls against malware","AC-19, AT-2, PE-20, SA-8, SC-2, SC-3, SC-7,SC-14, SC-38, SI-3, SI-7","3.13.13; 3.14.2","DE.CM-4, RS.MI-1, RS.MI-2","CSC 4, CSC 8"]
[51,"12.2.1 Controls against malware","SI-8","3.14.2","DE.CM-4, RS.MI-1, RS.MI-2","CSC 7, CSC 8"]
[52,"12.3.1 Information backup","CP-9",null,"PR.IP-4","CSC 10"]
[53,"9.1.2  Access to networks and network services","PE-2, PE-3, PE-6, PE-7, PE-8, PE-18",null,null,"CSC 11"]
[54,"12.1.4 Separation of development, testing and operational environments\n13.1.3 Segregation in networks","SC-32",null,"PR.AC-5","CSC 9, CSC 12, CSC 14"]
[55,"13.1.1 Network controls","AU-1, AU-2, AU-3, AU-4, AU-5, AU-6, AU-7, AU-9, AU-11, AU-12, AU-14, SI-4",null,null,"CSC 11"]
[56,"8.3.1 Management of removable media \n8.3.2 Disposal of media \n8.2.3 Handling of assets \n13.2 Information transfer","PE-16, SI-12, MP Family",null,"PR.PT-2, PR.IP-6","CSC 13"]
[57,"14.1.2 Securing application services on public networks\n14.1.3 Protecting application services transactions","AU-10, IA-8, SC-3, SC-7, SC-8, SC-9, SC-3, SC-14"]
[58,"12.4.1 Event logging","AU-1, AU-2, AU-3, AU-4, AU-5, AU-8, AU-11, AU-12",3.3,"PR.PT-1","CSC 4, CSC 6"]
[59,"12.4.2 Protection of log information","AU-1, AU-6, AU-7, AU-9, PE-6, PE-8, SC-7, SI-4","3.3.3; 3.3.5","PR.PT-1","CSC 4, CSC 6"]
[60,"12.4.1 Event logging\n12.4.3 Administrator and operator logs","AU-12","3.3.1; 3.3.2","PR.PT-1","CSC 4, CSC 6"]
[61,"12.4.1 Event logging\n12.4.2  Protection of log information","AU-8, AU-9, AU-11","3.3.8","PR.PT-1","CSC 4, CSC 6"]
[62,"12.4.3 Administrator and operator logs","AU-2, AU-12","3.3.1; 3.3.2","PR.PT-1","CSC 4, CSC 6"]
[63,"14.2.2 System change control procedures\n12.4.1 Event logging","SA-13","3.14.3","PR.DS-7","CSC 3"]
[64,"12.4.1 Event logging\n12.4.4 Clock synchronization","AU-2, AU-12, SI-2","3.3.1; 3.3.7",null,"CSC 6"]
["Communications Security (ISO 13)"]
[65,"13.2.4 Confidentiality or nondisclosure agreements","PL-4, PS-6, SA-9",null,"PR.IP-11"]
[66,"13.1 Network security management","CP-9, CP-10",null,"PR.IP-4","CSC 10"]
[67,"13.1.1 Network controls\n13.1.2 Security of network services","AC-4, AC-17, AC-18, AC-20, CA-3, CP-8, PE-5,SC-7, SC-8, SC-9, SC-10, SC-19, SC-20, SC-21, SC-22, SC-23","3.13.1","DE.CM-1","CSC 15"]
[68,"13.2.1 Information transfer policies and procedures \n13.2.2 Agreements on information transfer \n13.2.3 Electronic messaging","Multiple controls; electronic messaging not addressed separately in SP 800-53. AC-1, AC-3, AC-4, AC-17, AC-18, AC-20, CA-3, PL-4, PS-6, SC-7, SC-16, SI-9, CA-3, SA-9, MP-5",null,"PR.DS-1, PR.DS-2, PR.DS-5, PR.IP-6","CSC 14"]
[69,"13.1.1 Network controls","AC-17, AC-18, AC-19, AC-20, CA-3, IA-2, IA-3, IA-8",null,null,"CSC 12"]
[70,"13.1.3 Segregation in networks","AC-3, AC-6, AC-17, AC-18, PE-3, MA-3, MA-4, SC-4",null,"DE.CM-7","CSC 15"]
["Systems Acquisition, Development, and Maintenance (ISO 14)"]
[71,"14. System acquisition, development and maintenance","AC-1, AC-4, AC-17, AC-18, PE-17, PL-4, PS-6",null,"ID.AM-4","CSC 3"]
[72,"14.1 Security requirements of information systems",null,null,null,"CSC 3"]
[73,"14.1.1 Information security requirements analysis and specification\n14.1.2 Securing application services on public networks","PL-7, PL-8, SA-1, SA-3, SA-4",null,"PR.IP-12","CSC 18"]
[74,"Deleted from ISO 27002:2013","SI-10"]
[75,"Deleted from ISO 27002:2013","SI-7, SI-9, SI-10",null,"PR.DS-7"]
[76,"Deleted from ISO 27002:2013","AU-10, SC-8, SC-23, SI-7"]
[77,"10.1.2 Key management\n12.5 Control of operational software","SC-12, SC-17",null,null,"CSC 18"]
[78,"12.5.1 Installation of software on operational systems\n12.6.2 Restrictions on software installation","CM-1, CM-2, CM-3, CM-4, CM-5, CM-9, CM-10, CM-11, PL-4","3.4.8; 3.4.9","PR.DS-8"]
[79,"14.3.1 Protection of test data",null,null,null,"CSC 18"]
[80,"9.4.5 Access control to program source code","AC-3, AC-6, CM-5, CM-9, MA-5, SA-10",null,"PR.IP-3"]
[81,"12.2.1 Secure development policy","SC-2, SC-3, SC-4, SC-5, SC-6, SC-7, SC-8, SC-9, SC-10, SC-11, SC-12, SC-13, SC-14, SC-17, SC-18, SC-20, SC-21, SC-22, SC-23",null,"PR.IP-3"]
[82,"14.2.2 System change control procedures \n14.2.3 Technical review of applications after operating platform changes \n14.2.4 Restrictions on changes to software packages","CM-1, CM-3, CM-4, CM-5, CM-9, SA-10, SI-2",null,"PR.DS-5"]
[83,"Deleted from ISO 27002:2013","AC-4, IR-9, PE-19",null,"ID.AM-6"]
[84,"14.2.7 Outsourced development","CM-10, CM-11, SA-1, SA-4, SA-8, SA-9, SA-11, SA-12, SA-15, SA-17",null,"PR.IP-12","CSC 4"]
["Supplier Relationships (ISO 15)"]
[85,"Deleted from ISO 27002:2013","CA-3, PM-9, RA-3, SA-1, SA-9, SC-7",null,"ID.AM-4"]
[86,"15.1.2 Addressing security within supplier agreements","AU-16, CA-2, CA-3, PS-7, SA-9"]
[87,"15.2.1 Monitoring and review of supplier services\n15.2.2 Managing changes to supplier services","RA-3, SA-9, SA-10",null,"ID.AM-4"]
[88,"15.1.1 Information security policy for supplier relationships\n15.1.2 Addressing security within supplier agreements","AC-1, AT-1, AU-1, CA-1, CM-1, CP-1, IA-1, IA-7, IR-1, MA-1, MP-1, PE-1, PL-1, PM-1, PS-1, RA-1, RA-2, SA-1, SA-6, SC-1, SC-13, SI-1",null,"ID.AM-4"]
[89,"15.1.1 Information security policy for supplier relationships\n15.1.2 Addressing security within supplier agreements","AC-1, AT-1, AU-1, CA-1, CM-1, CP-1, IA-1, IA-7, IR-1, MA-1, MP-1, PE-1, PL-1, PM-1, PS-1, RA-1, RA-2, SA-1, SA-6, SC-1, SC-13, SI-1",null,"ID.AM-4"]
[90,"15.1.1 Information security policy for supplier relationships\n15.1.2 Addressing security within supplier agreements","AC-1, AT-1, AU-1, CA-1, CM-1, CP-1, IA-1, IA-7, IR-1, MA-1, MP-1, PE-1, PL-1, PM-1, PS-1, RA-1, RA-2, SA-1, SA-6, SC-1, SC-13, SI-1",null,"ID.AM-4"]
["Information Security Incident Management (ISO 16)"]
[91,"16.1.4 Assessment of and decision on information security events","RA-3, RA-5, SI-2, SI-5","3.6.1; 3.14.3","RS.RP-1, RS.CO-1, RS.CO-2, RS.CO-3, RS.CO-4","CSC 19"]
[92,"16.1 Management of information security incidents and improvements \n16.1.1 Responsibilities and procedures \n16.1.2 Reporting information security events \n16.1.3 Reporting information security weaknesses \n16.1.6  Learning from information security incidents","AU-6, IR-1, IR-4, IR-6, SI-2, SI-4, SI-5 PL-4",null,"ID.GV-3, RS.AN-3","CSC 19"]
["Information Security Aspects of Business Continuity Management (ISO 17)"]
[93,"17. Information security aspects of business continuity management","AU-7, AU-9, IR-4",null,"PR.IP-9","CSC 10"]
["Compliance (ISO 18)"]
[94,"18.1 Compliance with legal and contractual requirements","CP-1, CP-2, CP-4, PM-9, RA Family"]
[95,"18.1.3 Protection of records","AU-9, AU-11, CP-9, MP-1, MP-4, SA-5, SI-12"]
[96,"18.1.4 Privacy and protection of personally identifiable information","Appendix J; SI-12",null,"ID.GV-2"]
[97,"Deleted from ISO 27002:2013","AC-8, AU-6, CM-11, PL-4, PS-6, PS-8",null,"ID.GV-3"]
[98,"18.1.5 Regulation of cryptographic controls","IA-7, SC-13"]
[99,"18.2.2 Compliance with security policies and standards","AC-2, CA-2, CA-7, IA-7, PE-8, SI-12",null,"PR.IP-12, DE.CM-8"]
[100,"18.2.3 Technical compliance review","CA-2, CA-7, RA-5",null,"PR.IP-7"]
[101,"12.7.1 Information systems audit controls","AU-1, AU-2, AU-9","3.3.1; 3.3.2"]

{"sheet":"Tool Mapped to Core Data Servic","index":4,"n_rows":117,"n_cols":5,"rows_kept":117,"cut":false,"hidden":false,"merged":[]}
["Assessment Tool Question #","EDUCAUSE Core Data Service Benchmark Data Cross Reference (2016 CDS)","Included in CDS Information Security Maturity Index Question (2016 Infosec Module, Q5)","EDUCAUSE Core Data Service Benchmark Data Cross Reference (2015 CDS)","Included in CDS Information Security Maturity Index Question (M7Q5) (2015 CDS)"]
["Risk Management (ISO 27005:2011)"]
[1,"Capability & Deployment Module Q4",null,"M1Q6.c; M1Q14"]
[2,"Capability & Deployment Module Q4",3.1,"M1Q14","Sec 3.1"]
[3,"Capability and Deployment Module Q4\nInfoSec Module Q8-9",null,"M1Q1.b; M7Q8-9"]
["Information Security Policies (ISO 5)"]
[4,"InfoSec Module Q1.f",1.8,"M1Q12; M7Q1.f; M7Q10","Sec 2.1"]
[5,"InfoSec Module Q1.f",null,"M1Q12; M7Q1.f; M7Q10"]
[6,"InfoSec Module Q1.f",null,"M1Q12; M7Q1.f; M7Q10"]
["Organization of Information Security (ISO 6)"]
[7]
[8,"InfoSec Module Q2-4",1.1000000000000001,"M7Q4","Sec 1.1"]
[9,"InfoSec Module Q1.a",null,"M7Q1.a; M7Q4"]
[10,"InfoSec Module Q1.k",null,"M7Q1.k"]
[11,null,1.7]
[12,"InfoSec Module Q10",1.4,null,"Sec 1.4"]
[13,"InfoSec Module Q8-9","3.7; 3.8",null,"Sec 5.7, sec 5.8"]
["Human Resource Security (ISO 7)"]
[14,"InfoSec Module Q1.e",1.3,"M7Q5 (sec 1.3); M7Q10","Sec 1.3"]
[15,null,null,"M7Q10"]
[16]
[17,null,"2.7; 2.8",null,"Sec 4.2"]
[18,null,"2.7; 2.9"]
["Asset Management (ISO 8)"]
[19,null,4.3,null,"Sec 3.2"]
[20,null,4.4000000000000004,null,"Sec 3.3"]
["Access Control (ISO 9)"]
[21,"InfoSec Module Q13-15","2.7; 2.9","M1Q12; M5Q12","Sec 4.1"]
[22,"InfoSec Module Q13-15","2.7; 2.9","M1Q12; M7Q6.h; M7Q6.n; M7Q6.o"]
[23,null,null,"See generally M2Q8.a"]
[24,null,2.9,null,"Sec 4.3"]
[25,"InfoSec Module Q13-14",null,"M7Q6.n"]
[26,"See generally InfoSec Module Q6 re security technology deployment",null,"See generally M7Q6 re security technology deployment"]
[27,"InfoSec Module Q15",6.1,"See generally M7Q14"]
[28]
[29]
[30,"InfoSec Module Q13-14"]
[31,null,"2.10; 2.11",null,"Sec 4.4"]
[32,null,2.4,null,"Sec 3.4, Sec 3.5"]
[33,null,4.0999999999999996,null,"Sec 2.4"]
[34,"InfoSec Module Q6.m",4.2,"M7Q6.n"]
[35]
["Cryptography (ISO 10)"]
[36,"See generally InfoSec Module Q6 re security technology deployment\nInfoSec Module Q6.m",null,"See generally M7Q6 re security technology deployment; M7Q6.m"]
[37,null,4.2,null,"Sec 2.5"]
[38,null,null,"See generally M7Q14"]
["Physical and Environmental Security (ISO 11)"]
[39,null,null,"M5Q12; see module 5 for data centers generally"]
[40,null,null,"M5Q14"]
[41,"InfoSec Module Q13-15",2.8]
[42]
[43,null,null,null,"Sec 3.7"]
[44]
["Operations Security (ISO 12)"]
[45,"InfoSec Module Q1.l",2.2999999999999998,"M7Q1,l; M7Q5 (sec 3.2)","Sec 2.3"]
[46,null,3.6,"See generally M1Q8 (ITIL)"]
[47,null,1.2,null,"Sec 1.2"]
[48]
[49,"See generally InfoSec Module Q6 re security technology deployment",null,"See generally M7Q6 re security technology deployment"]
[50,"See generally InfoSec Module Q6 re security technology deployment",null,"See generally M7Q6 re security technology deployment; M7Q5 (sec 5.2)","Sec 5.2"]
[51,"See generally InfoSec Module Q6 re security technology deployment",null,"See generally M7Q6 re security technology deployment"]
[52,null,2.5,null,"Sec 3.8"]
[53,"See generally InfoSec Module Q6 re security technology deployment",null,"See generally M7Q6 re security technology deployment"]
[54]
[55,"See generally InfoSec Module Q6 re security technology deployment",null,"See generally M7Q6 re security technology deployment"]
[56]
[57,"See generally InfoSec Module Q6 re security technology deployment",null,"See generally M7Q6 re security technology deployment; M1Q12"]
[58,"See generally InfoSec Module Q6 re security technology deployment",null,"See generally M7Q6 re security technology deployment"]
[59,null,null,null,"Sec 5.3"]
[60,"InfoSec Module Q6.p",null,"M7Q6.p"]
[61,null,3.4,"M7Q5 (sec 5.4)","Sec 5.4"]
[62,"InfoSec Module Q6.p",3.3,"M7Q6.p"]
[63,"See generally InfoSec Module Q6 re security technology deployment",null,"See generally M7Q6 re security technology deployment"]
[64]
["Communications Security (ISO 13)"]
[65]
[66,null,2.6,null,"Sec 3.9"]
[67,"See generally InfoSec Module Q6 re security technology deployment\nInfoSecModule Q13",null,"See generally M7Q6 re security technology deployment"]
[68,"See generally InfoSec Module Q6 re security technology deployment\nInfoSec Module Q6.q",null,"See generally M7Q6 re security technology deployment; M7Q6.q"]
[69,"See generally InfoSec Module Q6 re security technology deployment",null,"See generally M7Q6 re security technology deployment"]
[70,"See generally InfoSec Module Q6 re security technology deployment",null,"See generally M7Q6 re security technology deployment"]
["Systems Acquisition, Development, and Maintenance (ISO 14)"]
[71,"InfoSec Module Q8",null,"M7Q1.k"]
[72,"InfoSec Module Q1.a\nInfoSec Module Q1.b\nInfoSec Module Q1.l",null,"M7Q1.a; M7Q1.b; M7Q1.l"]
[73]
[74]
[75]
[76]
[77]
[78]
[79]
[80,null,3.5,null,"Sec 5.5, Sec 5.6"]
[81,"InfoSec Module Q1.l",null,"M7Q1.l"]
[82,"InfoSec Module Q6.b",null,"M7Q6.b"]
[83,null,null,"See generally M1Q9"]
[84,null,"2.1; 3.2",null,"Sec 1.5, Sec 5.1"]
["Supplier Relationships (ISO 15)"]
[85,null,1.1100000000000001,null,"Sec 5.11"]
[86]
[87,null,null,"See generally M1Q9 re outsourcing policy"]
[88,null,null,"See generally M1Q9 re outsourcing policy"]
[89,null,null,"See generally M1Q9 re outsourcing policy"]
[90,null,null,"See generally M1Q9 re outsourcing policy"]
["Information Security Incident Management (ISO 16)"]
[91,null,"1.5; 1.9",null,"Sec 1.6, Sec 5.9, Sec 5.10"]
[92,null,1.6,null,"Sec 1.7"]
["Information Security Aspects of Business Continuity Management (ISO 17)"]
[93,null,"5.1; 5.2"]
["Compliance (ISO 18)"]
[94,"InfoSec Module Q1.o","4.6; 4.7",null,"Sec 3.6, 3.7"]
[95,null,null,"M7Q1.i; M7Q1.j; M1Q12"]
[96,null,2.2000000000000002,null,"Sec 2.2"]
[97,null,null,"M1Q12 (see generally infosec policy for research)"]
[98,"InfoSec Module Q1.a",null,"M7Q1.a; M7Q10; M1Q6.d"]
[99,"InfoSec Module Q6.i",null,"M7Q6.i"]
[100,"See generally InfoSec Module Q8-9",null,"See generally M7Q8; M7Q9"]
[101]

{"sheet":"Lookups","index":5,"n_rows":8,"n_cols":2,"rows_kept":8,"cut":false,"hidden":false,"merged":[]}
["Description","Value"]
["Not Performed",0]
["Performed Informally",1]
["Planned",2]
["Well Defined",3]
["Quantitatively Controlled",4]
["Continuously Improving",5]
["Not Applicable","Blank"]