CAO-400 Cybersecurity — Domain ECF

CAO-400 Cybersecurity › CAO-410 Access Control Policy › CAO-411 Access Control Governance › CAO-4111 Establish and maintain an access control policy aligned to business and security requirements › CAO-41111 Signed, reviewed, stored, communicated and acknowledged access control policy, with technical proof held in the document management system.

CAO-411111 · Examine the access-control policy and confirm it is documented, management-approved, current, and defines purpose, scope and responsibilities.

Method: Examine · Expected evidence: Approved access-control policy document with version and approval record

Operational controls: CAO-4111112 Policy Approval & Version Register · CAO-4111111 Access Control Policy — controlled template

CAO-400 Cybersecurity › CAO-410 Access Control Policy › CAO-411 Access Control Governance › CAO-4111 Establish and maintain an access control policy aligned to business and security requirements › CAO-41111 Signed, reviewed, stored, communicated and acknowledged access control policy, with technical proof held in the document management system.

CAO-411112 · Confirm the access-control policy is communicated to, and acknowledged by, all affected parties.

Method: Examine, interview · Expected evidence: Distribution and acknowledgement records

Operational controls: CAO-4111122 Policy Acknowledgement Register · CAO-4111121 Policy Communication Work Instruction

CAO-400 Cybersecurity › CAO-410 Access Control Policy › CAO-411 Access Control Governance › CAO-4111 Establish and maintain an access control policy aligned to business and security requirements › CAO-41112 Document management system workflow configured for scheduled review and approval, with automated email notifications to owners and approvers.

CAO-411121 · Verify a scheduled review-and-approval workflow exists in the document management system, with review dates and owner/approver notifications.

Method: Examine, observe · Expected evidence: DMS workflow configuration, review schedule and notification logs

Operational controls: CAO-4111212 Policy Review Schedule Register · CAO-4111211 Document Review & Approval Workflow — work instruction

CAO-400 Cybersecurity › CAO-410 Access Control Policy › CAO-411 Access Control Governance › CAO-4111 Establish and maintain an access control policy aligned to business and security requirements › CAO-41113 Access-control model enforcing need-to-know and least-privilege, with access assigned by role and job function.

CAO-411131 · Examine the defined access-control model and confirm access is assigned by role and job function on a least-privilege, need-to-know basis.

Method: Examine · Expected evidence: Documented access-control / role-based access model and role definitions

Operational controls: CAO-4111312 Role Definition Register · CAO-4111311 Role-Based Access Model — template

CAO-400 Cybersecurity › CAO-410 Access Control Policy › CAO-411 Access Control Governance › CAO-4111 Establish and maintain an access control policy aligned to business and security requirements › CAO-41114 Access-control system configured to enforce assigned permissions and to deny access by default.

CAO-411141 · Inspect the access-control system configuration to confirm assigned permissions are enforced and the default setting is deny-all.

Method: Examine, test · Expected evidence: Access-control system configuration showing default-deny and permission enforcement

Operational controls: CAO-4111412 Configuration Baseline Register · CAO-4111411 Access Control Configuration Standard — template

CAO-400 Cybersecurity › CAO-410 Access Control Policy › CAO-411 Access Control Governance › CAO-4111 Establish and maintain an access control policy aligned to business and security requirements › CAO-41115 Periodic review and recertification of user, privileged and system-account access rights, approved by authorised personnel.

CAO-411151 · Examine access-review records to confirm user, privileged and system-account access is reviewed at defined intervals and approved by authorised personnel.

Method: Examine · Expected evidence: Completed access-review / recertification records with approver sign-off

Operational controls: CAO-4111512 Access Recertification Work Instruction · CAO-4111511 User Access Review Form

CAO-400 Cybersecurity › CAO-410 Access Control Policy › CAO-411 Access Control Governance › CAO-4112 Enforce segregation of duties to prevent conflicting access › CAO-41121 Conflicting duties and areas of responsibility identified and segregated within the access model to prevent unauthorised or unintentional modification or misuse.

CAO-411211 · Examine the access model and role assignments to confirm conflicting duties are identified and segregated.

Method: Examine · Expected evidence: Segregation-of-duties matrix and conflict-analysis records

Operational controls: CAO-4112112 SoD Conflict Register · CAO-4112111 Segregation-of-Duties Matrix — template

CAO-400 Cybersecurity › CAO-410 Access Control Policy › CAO-411 Access Control Governance › CAO-4112 Enforce segregation of duties to prevent conflicting access › CAO-41122 Compensating controls applied where segregation of duties is impractical — activity logging, monitoring and independent supervisory review.

CAO-411221 · Where segregation of duties is not feasible, confirm compensating controls — logging, monitoring and supervisory review — are documented and operating.

Method: Examine, observe · Expected evidence: Documented compensating controls and monitoring / review logs

Operational controls: CAO-4112212 Supervisory Review Work Instruction · CAO-4112211 Compensating Controls Register

CAO-400 Cybersecurity › CAO-410 Access Control Policy › CAO-412 Identity Management › CAO-4121 Assign and manage unique identities for users, services and devices across the lifecycle › CAO-41211 Unique identifier assigned to every user, service and device before access is granted; shared or generic accounts permitted only by exception and held individually accountable.

CAO-412111 · Examine identity records and system settings to confirm every user, service and device has a unique ID, and that any shared or generic accounts are authorised exceptions held individually accountable.

Method: Examine, test · Expected evidence: Identity register and shared-account exception approvals

Operational controls: CAO-4121112 Shared / Generic Account Exception Form · CAO-4121111 Identity Register

CAO-400 Cybersecurity › CAO-410 Access Control Policy › CAO-412 Identity Management › CAO-4121 Assign and manage unique identities for users, services and devices across the lifecycle › CAO-41212 Identity lifecycle managed end to end — provisioning, modification and de-provisioning authorised; access for terminated users revoked immediately and inactive accounts disabled within a defined period.

CAO-412121 · Examine joiner-mover-leaver records to confirm provisioning, modification and de-provisioning are authorised, leaver access is revoked immediately, and inactive accounts are disabled within the defined period.

Method: Examine · Expected evidence: Joiner-mover-leaver records and account-disablement log

Operational controls: CAO-4121212 Account Disablement Register · CAO-4121211 Joiner-Mover-Leaver Work Instruction

CAO-400 Cybersecurity › CAO-410 Access Control Policy › CAO-412 Identity Management › CAO-4121 Assign and manage unique identities for users, services and devices across the lifecycle › CAO-41213 Third-party and remote-support accounts enabled only when required, monitored while in use, and disabled when not in use.

CAO-412131 · Examine third-party and remote-support account controls to confirm accounts are enabled only when required, monitored while in use, and disabled when idle.

Method: Examine, observe · Expected evidence: Third-party account activity logs

Operational controls: CAO-4121311 Third-Party Access Register

CAO-400 Cybersecurity › CAO-410 Access Control Policy › CAO-412 Identity Management › CAO-4122 Proof and bind identities to the correct entity before issuing credentials › CAO-41221 Identity proofing performed to verify an entity before credentials are issued, with the verified identity bound to the issued credential.

CAO-412211 · Examine the identity-proofing process to confirm entities are verified and the verified identity is bound to the issued credential before issuance.

Method: Examine · Expected evidence: Identity-proofing records

Operational controls: CAO-4122111 Identity Proofing Work Instruction

CAO-400 Cybersecurity › CAO-410 Access Control Policy › CAO-412 Identity Management › CAO-4122 Proof and bind identities to the correct entity before issuing credentials › CAO-41222 User identity verified before any creation or modification of authentication factors.

CAO-412221 · Confirm user identity is verified before any creation or modification of authentication factors.

Method: Examine, observe · Expected evidence: Credential-change verification logs

Operational controls: CAO-4122211 Credential Change Request Form

CAO-400 Cybersecurity › CAO-410 Access Control Policy › CAO-413 Authentication › CAO-4131 Manage authentication information securely throughout its lifecycle › CAO-41311 Authentication factors generated, distributed, stored and reset under controlled processes, with first-use and reset values unique and changed on first use.

CAO-413111 · Examine the processes for generating, distributing, storing and resetting authentication factors, confirming first-use and reset values are unique and changed on first use.

Method: Examine · Expected evidence: Credential-management procedure and reset logs

Operational controls: CAO-4131112 Credential Reset Register · CAO-4131111 Credential Management Work Instruction

CAO-400 Cybersecurity › CAO-410 Access Control Policy › CAO-413 Authentication › CAO-4131 Manage authentication information securely throughout its lifecycle › CAO-41312 Authentication factors rendered unreadable using strong cryptography in transmission and storage.

CAO-413121 · Inspect configuration to confirm authentication factors are rendered unreadable with strong cryptography in transmission and storage.

Method: Examine, test · Expected evidence: Cryptographic configuration evidence

Operational controls: CAO-4131211 Cryptographic Configuration Standard

CAO-400 Cybersecurity › CAO-410 Access Control Policy › CAO-413 Authentication › CAO-4131 Manage authentication information securely throughout its lifecycle › CAO-41313 Password and passphrase strength enforced — minimum length, complexity and history — with periodic change or dynamic analysis where single-factor authentication is used.

CAO-413131 · Examine authentication settings to confirm password and passphrase length, complexity and history meet defined minimums, with periodic change or dynamic analysis where single-factor.

Method: Examine, test · Expected evidence: Password policy configuration

Operational controls: CAO-4131311 Password Policy Configuration Standard

CAO-400 Cybersecurity › CAO-410 Access Control Policy › CAO-413 Authentication › CAO-4131 Manage authentication information securely throughout its lifecycle › CAO-41314 Authentication policy and user guidance documented and communicated to all users.

CAO-413141 · Examine the authentication policy and confirm it is documented and communicated to all users with guidance on selecting strong authentication factors.

Method: Examine · Expected evidence: Authentication policy and communication records

Operational controls: CAO-4131412 User Authentication Guidance · CAO-4131411 Authentication Policy — template

CAO-400 Cybersecurity › CAO-410 Access Control Policy › CAO-413 Authentication › CAO-4132 Enforce strong, multi-factor authentication proportionate to risk › CAO-41321 Multi-factor authentication enforced for all administrative access, all remote access from outside the network, and all access to sensitive environments.

CAO-413211 · Test that multi-factor authentication is enforced for all administrative access, all remote access from outside the network, and all access to sensitive environments.

Method: Examine, test · Expected evidence: MFA configuration and enforcement evidence

Operational controls: CAO-4132111 MFA Configuration Standard

CAO-400 Cybersecurity › CAO-410 Access Control Policy › CAO-413 Authentication › CAO-4132 Enforce strong, multi-factor authentication proportionate to risk › CAO-41322 Multi-factor authentication systems resistant to replay and bypass, requiring at least two independent factor types.

CAO-413221 · Examine the multi-factor authentication system to confirm resistance to replay and bypass and the use of at least two independent factor types.

Method: Examine, test · Expected evidence: MFA system design and configuration

Operational controls: CAO-4132211 MFA System Design Record

CAO-400 Cybersecurity › CAO-410 Access Control Policy › CAO-413 Authentication › CAO-4132 Enforce strong, multi-factor authentication proportionate to risk › CAO-41323 Invalid authentication attempts limited through account lockout thresholds and lockout durations.

CAO-413231 · Test that invalid authentication attempts trigger account lockout in line with defined thresholds and durations.

Method: Test · Expected evidence: Lockout configuration evidence

Operational controls: CAO-4132311 Account Lockout Configuration Standard

CAO-400 Cybersecurity › CAO-410 Access Control Policy › CAO-413 Authentication › CAO-4133 Protect identity assertions and authentication transactions against compromise › CAO-41331 Idle sessions required to re-authenticate after a defined period of inactivity.

CAO-413311 · Test that idle sessions require re-authentication after the defined period of inactivity.

Method: Test · Expected evidence: Session-timeout configuration

Operational controls: CAO-4133111 Session Timeout Configuration Standard

CAO-400 Cybersecurity › CAO-410 Access Control Policy › CAO-413 Authentication › CAO-4133 Protect identity assertions and authentication transactions against compromise › CAO-41332 Application and system account credentials protected — not hard-coded, rotated regularly, and interactive use prevented or tightly controlled.

CAO-413321 · Examine application and system account credential handling to confirm credentials are not hard-coded, are rotated, and interactive use is prevented or controlled.

Method: Examine · Expected evidence: Secrets-management evidence and service-account inventory

Operational controls: CAO-4133212 Service Account Register · CAO-4133211 Secrets Management Work Instruction

CAO-400 Cybersecurity › CAO-410 Access Control Policy › CAO-413 Authentication › CAO-4133 Protect identity assertions and authentication transactions against compromise › CAO-41333 Hardware tokens, smart cards and certificates individually assigned and protected against unauthorised use.

CAO-413331 · Examine assignment records to confirm hardware tokens, smart cards and certificates are individually assigned and protected against misuse.

Method: Examine · Expected evidence: Authenticator assignment register

Operational controls: CAO-4133311 Authenticator Assignment Register

CAO-400 Cybersecurity › CAO-410 Access Control Policy › CAO-414 Authorization and Access Rights › CAO-4141 Provision, modify and revoke access rights through a formal joiner-mover-leaver process › CAO-41411 Formal joiner-mover-leaver workflow authorising the provisioning, modification and revocation of access rights, with records retained.

CAO-414111 · Examine joiner-mover-leaver workflow records to confirm provisioning, modification and revocation of access are authorised and recorded.

Method: Examine · Expected evidence: Access request and approval records

Operational controls: CAO-4141111 Access Request & Approval Form

CAO-400 Cybersecurity › CAO-410 Access Control Policy › CAO-414 Authorization and Access Rights › CAO-4141 Provision, modify and revoke access rights through a formal joiner-mover-leaver process › CAO-41412 Access for leavers and role-changers removed or adjusted promptly on notification from human resources or management.

CAO-414121 · Examine termination notifications and access-removal logs to confirm leaver and role-change access is adjusted promptly.

Method: Examine · Expected evidence: Termination-to-revocation logs

Operational controls: CAO-4141211 Leaver Access Removal Register

CAO-400 Cybersecurity › CAO-410 Access Control Policy › CAO-414 Authorization and Access Rights › CAO-4142 Grant access on a least-privilege, need-to-know basis › CAO-41421 Access granted strictly on a least-privilege, need-to-know basis, scoped to job classification and function.

CAO-414211 · Examine access grants against role definitions to confirm least-privilege and need-to-know are applied by job function.

Method: Examine · Expected evidence: Access-grant records against the role matrix

Operational controls: CAO-4142111 Least-Privilege Access Standard

CAO-400 Cybersecurity › CAO-410 Access Control Policy › CAO-414 Authorization and Access Rights › CAO-4142 Grant access on a least-privilege, need-to-know basis › CAO-41422 Application and system accounts assigned only the least privilege necessary and restricted to their required functions.

CAO-414221 · Examine application and system account privileges to confirm they are limited to required functions.

Method: Examine · Expected evidence: Application and system account privilege records

Operational controls: CAO-4142211 Application & System Account Register

CAO-400 Cybersecurity › CAO-410 Access Control Policy › CAO-414 Authorization and Access Rights › CAO-4143 Review access rights at planned intervals and on role change › CAO-41431 User and privileged access rights reviewed at planned intervals and on role change, with recertification by the responsible owners.

CAO-414311 · Examine access-review records to confirm user and privileged access is reviewed at planned intervals and on role change, with owner recertification.

Method: Examine · Expected evidence: Periodic access-review records

Operational controls: CAO-4143111 Periodic Access Review Form

CAO-400 Cybersecurity › CAO-410 Access Control Policy › CAO-414 Authorization and Access Rights › CAO-4143 Review access rights at planned intervals and on role change › CAO-41432 Application and system account access reviewed periodically for continued appropriateness.

CAO-414321 · Examine periodic reviews of application and system account access for continued appropriateness.

Method: Examine · Expected evidence: Application and system account review records

Operational controls: CAO-4143211 System Account Review Register

CAO-400 Cybersecurity › CAO-410 Access Control Policy › CAO-415 Privileged Access › CAO-4151 Restrict, log and review privileged access rights › CAO-41511 Privileged access restricted to named individuals, approved, time-bound where feasible, and segregated from day-to-day user accounts.

CAO-415111 · Examine privileged access assignments to confirm they are restricted to named individuals, approved, time-bound where feasible, and segregated from day-to-day accounts.

Method: Examine · Expected evidence: Privileged access register and approvals

Operational controls: CAO-4151112 Privileged Access Approval Form · CAO-4151111 Privileged Access Register

CAO-400 Cybersecurity › CAO-410 Access Control Policy › CAO-415 Privileged Access › CAO-4151 Restrict, log and review privileged access rights › CAO-41512 Privileged activity logged and the logs reviewed for inappropriate or anomalous use.

CAO-415121 · Examine privileged-activity logs and review records to confirm privileged actions are logged and reviewed for inappropriate use.

Method: Examine · Expected evidence: Privileged-activity logs and review records

Operational controls: CAO-4151211 Privileged Activity Log-Review Work Instruction

CAO-400 Cybersecurity › CAO-410 Access Control Policy › CAO-415 Privileged Access › CAO-4151 Restrict, log and review privileged access rights › CAO-41513 Privileged access rights reviewed more frequently than standard access rights.

CAO-415131 · Examine the review schedule to confirm privileged access rights are reviewed more frequently than standard access.

Method: Examine · Expected evidence: Privileged-access review schedule and records

Operational controls: CAO-4151311 Privileged Access Review Schedule

CAO-400 Cybersecurity › CAO-410 Access Control Policy › CAO-415 Privileged Access › CAO-4152 Control the use of privileged utility programs › CAO-41521 Use of privileged utility programs capable of overriding system or application controls restricted, authorised and logged.

CAO-415211 · Examine controls over privileged utility programs to confirm their use is restricted, authorised and logged.

Method: Examine · Expected evidence: Privileged-utility authorisation records and logs

Operational controls: CAO-4152111 Privileged Utility Authorisation Register

CAO-400 Cybersecurity › CAO-410 Access Control Policy › CAO-415 Privileged Access › CAO-4152 Control the use of privileged utility programs › CAO-41522 Unnecessary privileged utility programs removed or disabled.

CAO-415221 · Examine systems to confirm unnecessary privileged utility programs are removed or disabled.

Method: Examine, test · Expected evidence: System hardening evidence and utility inventory

Operational controls: CAO-4152211 System Hardening Standard

CAO-400 Cybersecurity › CAO-410 Access Control Policy › CAO-416 Remote and Mobile Access › CAO-4161 Secure remote and mobile working through controlled connectivity and device requirements › CAO-41611 Remote access provided only over secured, encrypted channels (such as VPN or TLS) with multi-factor authentication enforced.

CAO-416111 · Examine remote-access configuration to confirm connections use secured, encrypted channels with multi-factor authentication.

Method: Examine, test · Expected evidence: Remote-access (VPN/TLS) configuration

Operational controls: CAO-4161111 Remote Access Configuration Standard

CAO-400 Cybersecurity › CAO-410 Access Control Policy › CAO-416 Remote and Mobile Access › CAO-4161 Secure remote and mobile working through controlled connectivity and device requirements › CAO-41612 Mobile and endpoint devices required to meet defined security baselines — encryption, patching, anti-malware and remote wipe — before connecting.

CAO-416121 · Examine endpoint and mobile device controls to confirm devices meet defined security baselines before connecting.

Method: Examine · Expected evidence: Device-compliance and MDM records

Operational controls: CAO-4161212 Mobile Device Register · CAO-4161211 Device Security Baseline Standard

CAO-400 Cybersecurity › CAO-410 Access Control Policy › CAO-416 Remote and Mobile Access › CAO-4161 Secure remote and mobile working through controlled connectivity and device requirements › CAO-41613 Remote and mobile working policy defining acceptable use, approved connectivity methods and device standards.

CAO-416131 · Examine the remote and mobile working policy to confirm it defines acceptable use, approved connectivity and device standards.

Method: Examine · Expected evidence: Remote and mobile working policy

Operational controls: CAO-4161311 Remote & Mobile Working Policy — template

CAO-400 Cybersecurity › CAO-410 Access Control Policy › CAO-416 Remote and Mobile Access › CAO-4162 Enforce access segregation in shared and virtual environments › CAO-41621 Logical segregation enforced between tenants, environments and workloads in shared and virtualised infrastructure.

CAO-416211 · Examine shared and virtualised infrastructure to confirm logical segregation between tenants, environments and workloads.

Method: Examine, test · Expected evidence: Segregation configuration evidence

Operational controls: CAO-4162111 Environment Segregation Standard

CAO-400 Cybersecurity › CAO-410 Access Control Policy › CAO-416 Remote and Mobile Access › CAO-4162 Enforce access segregation in shared and virtual environments › CAO-41622 Administrative and management interfaces of shared and virtual environments access-controlled and isolated from general access.

CAO-416221 · Examine administrative and management interfaces of shared and virtual environments to confirm they are access-controlled and isolated.

Method: Examine · Expected evidence: Management-interface access configuration

Operational controls: CAO-4162211 Management Interface Access Standard

CAO-400 Cybersecurity › CAO-420 Network Security Policy › CAO-421 Network Security Management › CAO-4211 Establish and operate network security controls › CAO-42111 Network security controls (such as firewalls) installed at the network boundary and between network segments.

CAO-421111 · Examine network diagrams and device configurations to confirm network security controls are installed at the boundary and between segments.

Method: Examine, observe · Expected evidence: Network diagram and NSC configurations

Operational controls: CAO-4211112 Firewall / NSC Configuration Register · CAO-4211111 Network Architecture Diagram

CAO-400 Cybersecurity › CAO-420 Network Security Policy › CAO-421 Network Security Management › CAO-4211 Establish and operate network security controls › CAO-42112 Configuration standards for network security controls defined, applied and reviewed at a defined frequency.

CAO-421121 · Examine NSC configuration standards and change records to confirm they are defined, applied and reviewed.

Method: Examine · Expected evidence: NSC configuration standard and review records

Operational controls: CAO-4211212 NSC Ruleset Review Register · CAO-4211211 NSC Configuration Standard

CAO-400 Cybersecurity › CAO-420 Network Security Policy › CAO-421 Network Security Management › CAO-4211 Establish and operate network security controls › CAO-42113 Rulesets restrict inbound and outbound traffic to that which is necessary and deny all other traffic.

CAO-421131 · Examine NSC rulesets to confirm traffic is restricted to that which is necessary and all other traffic is denied.

Method: Examine, test · Expected evidence: NSC ruleset evidence

Operational controls: CAO-4211311 Network Traffic Ruleset Register

CAO-400 Cybersecurity › CAO-420 Network Security Policy › CAO-421 Network Security Management › CAO-4212 Secure network services and their security mechanisms › CAO-42121 Security mechanisms, service levels and management requirements of all network services identified and applied, whether provided in-house or outsourced.

CAO-421211 · Examine the network-services inventory and agreements to confirm security mechanisms and service levels are identified and applied.

Method: Examine · Expected evidence: Network-services inventory and service-level agreements

Operational controls: CAO-4212111 Network Services Register

CAO-400 Cybersecurity › CAO-420 Network Security Policy › CAO-421 Network Security Management › CAO-4212 Secure network services and their security mechanisms › CAO-42122 Insecure services, protocols and ports restricted, with business justification and additional security features documented where they are used.

CAO-421221 · Examine configurations to confirm insecure services, protocols and ports are restricted, with documented justification and safeguards where used.

Method: Examine · Expected evidence: Services, protocols and ports register with justifications

Operational controls: CAO-4212211 Allowed Services, Protocols and Ports Register

CAO-400 Cybersecurity › CAO-420 Network Security Policy › CAO-421 Network Security Management › CAO-4212 Secure network services and their security mechanisms › CAO-42123 Transmission of sensitive information over open or public networks protected using strong cryptography and secure protocols.

CAO-421231 · Examine configurations to confirm sensitive data in transit over open or public networks is protected with strong cryptography and trusted certificates.

Method: Examine, test · Expected evidence: TLS / encryption configuration evidence

Operational controls: CAO-4212312 Certificate Inventory Register · CAO-4212311 Transmission Encryption Standard

CAO-400 Cybersecurity › CAO-420 Network Security Policy › CAO-422 Network Segmentation › CAO-4221 Segregate networks into security zones › CAO-42211 Networks segregated into security zones based on trust level, with controls enforced between zones.

CAO-422111 · Examine network architecture to confirm segregation into security zones with controls enforced between them.

Method: Examine, observe · Expected evidence: Network segmentation diagram and zone controls

Operational controls: CAO-4221112 Security Zone Register · CAO-4221111 Network Segmentation Diagram

CAO-400 Cybersecurity › CAO-420 Network Security Policy › CAO-422 Network Segmentation › CAO-4221 Segregate networks into security zones › CAO-42212 Systems storing or processing sensitive data placed in a separate, controlled zone isolated from untrusted networks.

CAO-422121 · Examine the placement of sensitive systems to confirm isolation in a controlled zone.

Method: Examine · Expected evidence: Data-flow and zone-placement evidence

Operational controls: CAO-4221211 Data Flow and Zoning Register

CAO-400 Cybersecurity › CAO-420 Network Security Policy › CAO-422 Network Segmentation › CAO-4222 Control connectivity between trusted and untrusted networks › CAO-42221 Connections between trusted and untrusted networks controlled by network security controls that permit only authorised traffic.

CAO-422211 · Examine boundary controls to confirm only authorised traffic passes between trusted and untrusted networks.

Method: Examine, test · Expected evidence: Boundary NSC ruleset

Operational controls: CAO-4222111 Trust Boundary Ruleset Register

CAO-400 Cybersecurity › CAO-420 Network Security Policy › CAO-422 Network Segmentation › CAO-4222 Control connectivity between trusted and untrusted networks › CAO-42222 Inbound traffic from untrusted networks restricted to system components providing authorised, publicly accessible services.

CAO-422221 · Examine configurations to confirm inbound traffic from untrusted networks is restricted to authorised public-facing components.

Method: Examine · Expected evidence: DMZ configuration evidence

Operational controls: CAO-4222211 DMZ Configuration Standard

CAO-400 Cybersecurity › CAO-420 Network Security Policy › CAO-422 Network Segmentation › CAO-4222 Control connectivity between trusted and untrusted networks › CAO-42223 Anti-spoofing measures implemented to detect and block forged source IP addresses.

CAO-422231 · Test that anti-spoofing measures detect and block forged source addresses.

Method: Test · Expected evidence: Anti-spoofing configuration

Operational controls: CAO-4222311 Anti-Spoofing Configuration Standard

CAO-400 Cybersecurity › CAO-420 Network Security Policy › CAO-423 Web and Content Filtering › CAO-4231 Filter and control access to external web content › CAO-42311 Outbound web access filtered and controlled to block access to malicious or unauthorised content.

CAO-423111 · Examine web-filtering configuration to confirm malicious and unauthorised categories are blocked.

Method: Examine, test · Expected evidence: Web-filtering policy and configuration

Operational controls: CAO-4231112 Blocked Categories Register · CAO-4231111 Web Filtering Standard

CAO-400 Cybersecurity › CAO-420 Network Security Policy › CAO-423 Web and Content Filtering › CAO-4231 Filter and control access to external web content › CAO-42312 Web-filtering activity logged and exceptions managed through an approval process.

CAO-423121 · Examine web-filter logs and exception approvals to confirm logging and controlled exceptions.

Method: Examine · Expected evidence: Web-filter logs and exception approvals

Operational controls: CAO-4231211 Web Filter Exception Form

CAO-400 Cybersecurity › CAO-420 Network Security Policy › CAO-424 Cloud Network Security › CAO-4241 Secure the use of cloud services › CAO-42411 Cloud services acquired, used and managed in line with security requirements, with shared-responsibility boundaries defined.

CAO-424111 · Examine cloud-service agreements and configurations to confirm security requirements and shared-responsibility boundaries are defined and met.

Method: Examine · Expected evidence: Cloud security requirements and responsibility matrix

Operational controls: CAO-4241112 Shared Responsibility Matrix · CAO-4241111 Cloud Security Requirements Standard

CAO-400 Cybersecurity › CAO-420 Network Security Policy › CAO-424 Cloud Network Security › CAO-4242 Secure cloud administration and virtual network configuration › CAO-42421 Cloud administrative access secured with strong authentication and least privilege, with virtual network controls restricting traffic.

CAO-424211 · Examine cloud administrative access and virtual network configuration to confirm strong authentication, least privilege and traffic restriction.

Method: Examine, test · Expected evidence: Cloud admin and virtual network configuration

Operational controls: CAO-4242111 Cloud Configuration Baseline Standard

CAO-400 Cybersecurity › CAO-420 Network Security Policy › CAO-424 Cloud Network Security › CAO-4242 Secure cloud administration and virtual network configuration › CAO-42422 Cloud security posture monitored, with misconfigurations detected and remediated.

CAO-424221 · Examine cloud security-posture monitoring to confirm misconfigurations are detected and remediated.

Method: Examine · Expected evidence: CSPM findings and remediation records

Operational controls: CAO-4242211 Cloud Posture Monitoring Register

CAO-400 Cybersecurity › CAO-420 Network Security Policy › CAO-425 Infrastructure Resilience and Availability › CAO-4251 Protect infrastructure from environmental threats › CAO-42511 Physical and environmental protections implemented for infrastructure against fire, flood, power and climate threats.

CAO-425111 · Examine environmental controls at facilities to confirm protection against environmental threats.

Method: Examine, observe · Expected evidence: Environmental control and inspection records

Operational controls: CAO-4251111 Environmental Controls Register

CAO-400 Cybersecurity › CAO-420 Network Security Policy › CAO-425 Infrastructure Resilience and Availability › CAO-4251 Protect infrastructure from environmental threats › CAO-42512 Supporting utilities such as power and cooling protected and provided with redundancy.

CAO-425121 · Examine supporting utilities to confirm protection and redundancy such as UPS and generators.

Method: Examine, observe · Expected evidence: Utility redundancy evidence

Operational controls: CAO-4251211 Utility and Redundancy Register

CAO-400 Cybersecurity › CAO-420 Network Security Policy › CAO-425 Infrastructure Resilience and Availability › CAO-4252 Implement resilience mechanisms and capacity to maintain availability › CAO-42521 Redundancy and resilience mechanisms implemented for critical infrastructure to meet availability requirements.

CAO-425211 · Examine redundancy and failover mechanisms and test results to confirm availability requirements are met.

Method: Examine, test · Expected evidence: Redundancy design and failover test records

Operational controls: CAO-4252111 Redundancy and Failover Test Register

CAO-400 Cybersecurity › CAO-420 Network Security Policy › CAO-425 Infrastructure Resilience and Availability › CAO-4252 Implement resilience mechanisms and capacity to maintain availability › CAO-42522 Capacity monitored, forecast and managed to maintain required performance and availability.

CAO-425221 · Examine capacity monitoring and forecasts to confirm capacity is managed to meet demand.

Method: Examine · Expected evidence: Capacity monitoring and forecast records

Operational controls: CAO-4252211 Capacity Management Register

CAO-400 Cybersecurity › CAO-430 Cryptography and Data Encryption Policy › CAO-431 Cryptographic Controls › CAO-4311 Establish and apply cryptographic controls appropriate to risk › CAO-43111 Policy on the use of cryptographic controls established, defining approved algorithms, key strengths and use cases based on risk.

CAO-431111 · Examine the cryptographic policy to confirm approved algorithms and key strengths are defined according to risk.

Method: Examine · Expected evidence: Cryptographic controls policy

Operational controls: CAO-4311111 Cryptographic Controls Policy — template

CAO-400 Cybersecurity › CAO-430 Cryptography and Data Encryption Policy › CAO-432 Cryptographic Key Management › CAO-4321 Protect cryptographic keys › CAO-43211 Cryptographic keys protected against unauthorised access, modification, loss and disclosure throughout storage and use.

CAO-432111 · Examine key-protection controls to confirm keys are secured against unauthorised access and disclosure.

Method: Examine · Expected evidence: Key-protection configuration and access records

Operational controls: CAO-4321111 Key Protection Standard

CAO-400 Cybersecurity › CAO-430 Cryptography and Data Encryption Policy › CAO-432 Cryptographic Key Management › CAO-4322 Operate the cryptographic key management lifecycle › CAO-43221 Cryptographic keys managed across the full lifecycle: generation, distribution, storage, rotation, retirement and destruction.

CAO-432211 · Examine key-management procedures and records to confirm lifecycle activities are performed and authorised.

Method: Examine · Expected evidence: Key lifecycle records

Operational controls: CAO-4322112 Cryptographic Key Inventory Register · CAO-4322111 Key Management Lifecycle Work Instruction

CAO-400 Cybersecurity › CAO-430 Cryptography and Data Encryption Policy › CAO-433 Data Encryption at Rest › CAO-4331 Render stored data unreadable through encryption or equivalent measures › CAO-43311 Stored sensitive data rendered unreadable using strong cryptography or equivalent measures such as tokenisation or truncation.

CAO-433111 · Examine storage configuration to confirm sensitive data at rest is rendered unreadable.

Method: Examine, test · Expected evidence: Encryption-at-rest configuration

Operational controls: CAO-4331111 Data-at-Rest Encryption Standard

CAO-400 Cybersecurity › CAO-430 Cryptography and Data Encryption Policy › CAO-434 Data Protection in Transit › CAO-4341 Protect data in transit against interception and alteration › CAO-43411 Data in transit protected against interception and alteration using strong cryptography and integrity controls.

CAO-434111 · Examine transmission configuration to confirm data in transit is encrypted and integrity-protected.

Method: Examine, test · Expected evidence: Transit encryption and integrity configuration

Operational controls: CAO-4341111 Data-in-Transit Protection Standard

CAO-400 Cybersecurity › CAO-430 Cryptography and Data Encryption Policy › CAO-435 Data Masking and Minimisation › CAO-4351 Mask sensitive data on display › CAO-43511 Sensitive data masked on display so that only the minimum necessary is shown, based on need-to-know.

CAO-435111 · Examine display configurations to confirm sensitive data is masked except where a documented need exists.

Method: Examine, test · Expected evidence: Data-masking configuration

Operational controls: CAO-4351111 Data Masking Standard

CAO-400 Cybersecurity › CAO-430 Cryptography and Data Encryption Policy › CAO-435 Data Masking and Minimisation › CAO-4352 Minimise the storage of sensitive data › CAO-43521 Storage of sensitive data minimised to that required for business, legal or regulatory purposes.

CAO-435211 · Examine data inventory and storage practices to confirm sensitive-data storage is minimised to defined needs.

Method: Examine · Expected evidence: Data inventory and minimisation records

Operational controls: CAO-4352111 Data Minimisation Standard

CAO-400 Cybersecurity › CAO-430 Cryptography and Data Encryption Policy › CAO-436 Data Leakage Prevention › CAO-4361 Prevent unauthorised leakage of data › CAO-43611 Data leakage prevention measures applied to systems, networks and devices that store, process or transmit sensitive data.

CAO-436111 · Examine DLP configuration to confirm monitoring and blocking of unauthorised data egress.

Method: Examine, test · Expected evidence: DLP policy and alerts

Operational controls: CAO-4361112 DLP Alert Register · CAO-4361111 Data Leakage Prevention Standard

CAO-400 Cybersecurity › CAO-430 Cryptography and Data Encryption Policy › CAO-437 Data Retention and Secure Deletion › CAO-4371 Retain data only as required and securely delete it when no longer needed › CAO-43711 Data retained only for defined retention periods and securely deleted or destroyed when no longer required.

CAO-437111 · Examine retention schedules and deletion records to confirm data is retained per policy and securely deleted.

Method: Examine · Expected evidence: Retention schedule and deletion records

Operational controls: CAO-4371112 Secure Deletion Work Instruction · CAO-4371111 Data Retention Schedule

CAO-400 Cybersecurity › CAO-430 Cryptography and Data Encryption Policy › CAO-438 Data Security Management › CAO-4381 Govern the security of data processing and lawful safeguards › CAO-43811 Security and lawful-processing safeguards applied to personal and sensitive data, including documented records of processing.

CAO-438111 · Examine records of processing and safeguards to confirm lawful and secure data processing.

Method: Examine · Expected evidence: Records of processing and applied safeguards

Operational controls: CAO-4381111 Records of Processing Register

CAO-400 Cybersecurity › CAO-430 Cryptography and Data Encryption Policy › CAO-438 Data Security Management › CAO-4382 Maintain the integrity of data › CAO-43821 Integrity controls applied to detect and prevent unauthorised or accidental alteration of data.

CAO-438211 · Examine integrity controls such as change-detection to confirm unauthorised alterations are detected.

Method: Examine, test · Expected evidence: Integrity-monitoring configuration and alerts

Operational controls: CAO-4382111 Integrity Monitoring Register

CAO-400 Cybersecurity › CAO-430 Cryptography and Data Encryption Policy › CAO-438 Data Security Management › CAO-4383 Protect data in use › CAO-43831 Data in use protected through access controls, memory protection and, where applicable, confidential-computing measures.

CAO-438311 · Examine controls over data in use to confirm access restriction and protection during processing.

Method: Examine · Expected evidence: Data-in-use protection configuration

Operational controls: CAO-4383111 Data-in-Use Protection Standard

CAO-400 Cybersecurity › CAO-430 Cryptography and Data Encryption Policy › CAO-438 Data Security Management › CAO-4384 Back up and protect the resilience of data › CAO-43841 Data backed up, protected and tested for restoration in line with defined recovery requirements.

CAO-438411 · Examine backup configuration and restoration tests to confirm data is backed up and recoverable.

Method: Examine, test · Expected evidence: Backup configuration and restore-test records

Operational controls: CAO-4384112 Restoration Test Register · CAO-4384111 Backup and Restore Standard

CAO-400 Cybersecurity › CAO-450 Operations Security Policy › CAO-451 Operating Procedures › CAO-4511 Establish and maintain documented operating procedures › CAO-45111 Documented operating procedures for IT and security operations maintained and available to those who need them.

CAO-451111 · Examine operating procedures to confirm they are documented, current and available to relevant personnel.

Method: Examine · Expected evidence: Documented operating procedures

Operational controls: CAO-4511111 Operating Procedures Library

CAO-400 Cybersecurity › CAO-450 Operations Security Policy › CAO-452 Threat Intelligence › CAO-4521 Acquire and act on threat intelligence › CAO-45211 Threat intelligence collected, analysed and used to inform protective measures.

CAO-452111 · Examine threat-intelligence sources and outputs to confirm intelligence is gathered and acted upon.

Method: Examine · Expected evidence: Threat-intelligence reports and actions

Operational controls: CAO-4521111 Threat Intelligence Register

CAO-400 Cybersecurity › CAO-450 Operations Security Policy › CAO-453 Endpoint Protection › CAO-4531 Protect endpoints and operational systems › CAO-45311 Endpoints and operational systems protected through hardening, configuration management and endpoint security tooling.

CAO-453111 · Examine endpoint configurations and security tooling to confirm hardening and protection are applied.

Method: Examine, test · Expected evidence: Endpoint hardening and protection configuration

Operational controls: CAO-4531111 Endpoint Hardening Standard

CAO-400 Cybersecurity › CAO-450 Operations Security Policy › CAO-454 Logging › CAO-4541 Generate logs of security-relevant events › CAO-45411 Logs generated for security-relevant events across systems, applications and network devices.

CAO-454111 · Examine logging configuration to confirm security-relevant events are captured.

Method: Examine, test · Expected evidence: Logging configuration and sample logs

Operational controls: CAO-4541111 Audit Logging Standard

CAO-400 Cybersecurity › CAO-450 Operations Security Policy › CAO-454 Logging › CAO-4542 Protect and retain log information › CAO-45421 Log information protected against tampering and unauthorised access, and retained for a defined period.

CAO-454211 · Examine log-protection and retention controls to confirm logs are secured and retained per policy.

Method: Examine · Expected evidence: Log-protection configuration and retention records

Operational controls: CAO-4542111 Log Retention and Protection Standard

CAO-400 Cybersecurity › CAO-450 Operations Security Policy › CAO-455 Security Monitoring and Detection › CAO-4551 Monitor systems, networks and environments for anomalies › CAO-45511 Systems, networks and environments monitored to detect anomalous activity and potential incidents.

CAO-455111 · Examine monitoring and alerting to confirm anomalous activity is detected and reviewed.

Method: Examine · Expected evidence: Monitoring alerts and review records

Operational controls: CAO-4551111 Security Monitoring Register

CAO-400 Cybersecurity › CAO-450 Operations Security Policy › CAO-455 Security Monitoring and Detection › CAO-4552 Detect and respond to security control failures › CAO-45521 Failures of critical security controls detected, alerted and responded to promptly.

CAO-455211 · Examine control-failure detection to confirm failures are detected and addressed promptly.

Method: Examine, test · Expected evidence: Control-failure alerts and response records

Operational controls: CAO-4552111 Control Failure Response Register

CAO-400 Cybersecurity › CAO-450 Operations Security Policy › CAO-456 Clock Synchronisation › CAO-4561 Synchronise clocks across systems › CAO-45611 Clocks across systems synchronised to an accurate, agreed time source.

CAO-456111 · Examine time-synchronisation configuration to confirm clocks are synchronised to an authorised source.

Method: Examine, test · Expected evidence: Time-synchronisation configuration

Operational controls: CAO-4561111 Time Synchronisation Standard

CAO-400 Cybersecurity › CAO-460 Threat and Vulnerability Management Policy › CAO-461 Malware Protection › CAO-4611 Protect against malware › CAO-46111 Anti-malware solutions deployed and kept current on all applicable systems.

CAO-461111 · Examine anti-malware deployment and update status to confirm coverage and currency.

Method: Examine, test · Expected evidence: Anti-malware configuration and update logs

Operational controls: CAO-4611111 Anti-Malware Standard

CAO-400 Cybersecurity › CAO-460 Threat and Vulnerability Management Policy › CAO-462 Technical Vulnerability Management › CAO-4621 Identify and remediate technical vulnerabilities › CAO-46211 Technical vulnerabilities identified, assessed, prioritised and remediated within defined timeframes.

CAO-462111 · Examine vulnerability scans and remediation records to confirm vulnerabilities are identified and remediated within timeframes.

Method: Examine · Expected evidence: Vulnerability scan reports and remediation records

Operational controls: CAO-4621111 Vulnerability Management Register

CAO-400 Cybersecurity › CAO-460 Threat and Vulnerability Management Policy › CAO-463 Security and Penetration Testing › CAO-4631 Test for unauthorised wireless and conduct security testing › CAO-46311 Unauthorised wireless access points detected and security testing performed at a defined frequency.

CAO-463111 · Examine wireless-detection and security-testing records to confirm unauthorised wireless is detected and testing performed.

Method: Examine · Expected evidence: Wireless scan and security-test records

Operational controls: CAO-4631111 Wireless and Security Testing Register

CAO-400 Cybersecurity › CAO-460 Threat and Vulnerability Management Policy › CAO-463 Security and Penetration Testing › CAO-4632 Conduct penetration testing › CAO-46321 Penetration testing performed at a defined frequency and after significant change, with findings remediated.

CAO-463211 · Examine penetration-test reports and remediation to confirm testing is performed and findings addressed.

Method: Examine · Expected evidence: Penetration-test reports and remediation

Operational controls: CAO-4632111 Penetration Test Register

CAO-400 Cybersecurity › CAO-460 Threat and Vulnerability Management Policy › CAO-464 Intrusion Detection › CAO-4641 Detect and respond to intrusions › CAO-46411 Intrusion-detection and prevention mechanisms deployed to detect and respond to network intrusions.

CAO-464111 · Examine intrusion-detection configuration and alerts to confirm intrusions are detected and responded to.

Method: Examine, test · Expected evidence: IDS and IPS configuration and alerts

Operational controls: CAO-4641111 Intrusion Detection Register

CAO-400 Cybersecurity › CAO-460 Threat and Vulnerability Management Policy › CAO-465 Integrity and Change Detection › CAO-4651 Detect unauthorised changes and tampering › CAO-46511 Change-detection and anti-tampering mechanisms deployed to detect unauthorised modification of critical files and devices.

CAO-465111 · Examine change-detection and tamper controls to confirm unauthorised modifications are detected.

Method: Examine, test · Expected evidence: Change and tamper detection alerts

Operational controls: CAO-4651111 Change and Tamper Detection Register

CAO-400 Cybersecurity › CAO-470 Incident Response Policy › CAO-471 Incident Management Planning › CAO-4711 Establish and maintain incident management arrangements › CAO-47111 Incident management policy, plan, roles and responsibilities established and maintained.

CAO-471111 · Examine the incident response plan and roles to confirm arrangements are documented and maintained.

Method: Examine · Expected evidence: Incident response plan and roles

Operational controls: CAO-4711111 Incident Response Plan — template

CAO-400 Cybersecurity › CAO-470 Incident Response Policy › CAO-472 Incident Detection and Assessment › CAO-4721 Detect, assess and classify security events › CAO-47211 Security events detected, assessed and classified by severity to identify incidents.

CAO-472111 · Examine event-triage records to confirm events are assessed and classified consistently.

Method: Examine · Expected evidence: Event assessment and classification records

Operational controls: CAO-4721111 Incident Classification Matrix

CAO-400 Cybersecurity › CAO-470 Incident Response Policy › CAO-473 Incident Response › CAO-4731 Respond to and contain security incidents › CAO-47311 Security incidents responded to and contained according to documented procedures.

CAO-473111 · Examine incident records to confirm incidents are responded to and contained per procedure.

Method: Examine · Expected evidence: Incident response records

Operational controls: CAO-4731111 Incident Response Work Instruction

CAO-400 Cybersecurity › CAO-470 Incident Response Policy › CAO-473 Incident Response › CAO-4732 Mitigate and recover from incident impact › CAO-47321 Incident impact mitigated and affected services restored in line with recovery priorities.

CAO-473211 · Examine recovery records to confirm impact is mitigated and services restored.

Method: Examine · Expected evidence: Incident recovery records

Operational controls: CAO-4732111 Incident Recovery Register

CAO-400 Cybersecurity › CAO-470 Incident Response Policy › CAO-474 Incident Reporting and Communication › CAO-4741 Report incidents to required parties within mandated timeframes › CAO-47411 Incidents reported to required internal and external parties within mandated timeframes.

CAO-474111 · Examine incident-reporting records to confirm reporting to required parties within timeframes.

Method: Examine · Expected evidence: Incident-reporting records and notifications

Operational controls: CAO-4741111 Incident Notification Register

CAO-400 Cybersecurity › CAO-470 Incident Response Policy › CAO-475 Incident Recovery › CAO-4751 Recover normal operations after an incident › CAO-47511 Normal operations recovered and verified after an incident.

CAO-475111 · Examine post-incident restoration records to confirm normal operations are recovered and verified.

Method: Examine · Expected evidence: Operations restoration verification

Operational controls: CAO-4751111 Service Restoration Register

CAO-400 Cybersecurity › CAO-470 Incident Response Policy › CAO-476 Forensics and Learning › CAO-4761 Collect evidence and learn from incidents › CAO-47611 Evidence collected and lessons learned captured and used to improve controls.

CAO-476111 · Examine post-incident reviews and evidence handling to confirm lessons learned are captured and applied.

Method: Examine · Expected evidence: Post-incident review records and evidence log

Operational controls: CAO-4761112 Evidence Collection Work Instruction · CAO-4761111 Lessons Learned Register

CAO-400 Cybersecurity › CAO-480 Secure Software Development Policy › CAO-481 Secure Development Lifecycle › CAO-4811 Apply a secure development lifecycle › CAO-48111 Secure development lifecycle defined and applied across all software development.

CAO-481111 · Examine the secure development lifecycle to confirm security is integrated across development phases.

Method: Examine · Expected evidence: Secure development lifecycle documentation

Operational controls: CAO-4811111 Secure Development Lifecycle Standard

CAO-400 Cybersecurity › CAO-480 Secure Software Development Policy › CAO-481 Secure Development Lifecycle › CAO-4812 Manage secure changes and releases › CAO-48121 Changes and releases managed through authorised, tested and documented change control.

CAO-481211 · Examine change records to confirm changes are authorised, tested and documented before release.

Method: Examine · Expected evidence: Change control records

Operational controls: CAO-4812111 Change Management Work Instruction

CAO-400 Cybersecurity › CAO-480 Secure Software Development Policy › CAO-481 Secure Development Lifecycle › CAO-4813 Protect public-facing applications › CAO-48131 Public-facing applications protected against attacks through secure controls such as web application firewalls or automated vulnerability detection.

CAO-481311 · Examine protections for public-facing applications to confirm attacks are detected and prevented.

Method: Examine, test · Expected evidence: Web application protection configuration

Operational controls: CAO-4813111 Web Application Protection Standard

CAO-400 Cybersecurity › CAO-480 Secure Software Development Policy › CAO-482 Secure Coding › CAO-4821 Develop software using secure coding practices › CAO-48211 Software developed using secure coding practices that prevent common vulnerabilities.

CAO-482111 · Examine coding standards and reviews to confirm secure coding practices are applied.

Method: Examine · Expected evidence: Secure coding standard and review records

Operational controls: CAO-4821111 Secure Coding Standard

CAO-400 Cybersecurity › CAO-480 Secure Software Development Policy › CAO-483 Security Requirements and Architecture › CAO-4831 Define security requirements and secure architecture › CAO-48311 Security requirements and secure architecture defined for new and changed systems.

CAO-483111 · Examine requirements and architecture artifacts to confirm security is specified by design.

Method: Examine · Expected evidence: Security requirements and architecture documents

Operational controls: CAO-4831111 Security Requirements Template

CAO-400 Cybersecurity › CAO-480 Secure Software Development Policy › CAO-484 Security Testing in Development › CAO-4841 Test software security throughout development › CAO-48411 Software security tested throughout development, including code review and vulnerability testing.

CAO-484111 · Examine security-testing records to confirm testing is performed across development.

Method: Examine · Expected evidence: Application security test results

Operational controls: CAO-4841111 Application Security Testing Register

CAO-400 Cybersecurity › CAO-480 Secure Software Development Policy › CAO-485 Development Environment Security › CAO-4851 Secure development environments and source code › CAO-48511 Development environments and source code secured and access-controlled, with separation of development, test and production environments.

CAO-485111 · Examine development environments and source-code controls to confirm separation and access control.

Method: Examine · Expected evidence: Environment separation and source-access configuration

Operational controls: CAO-4851111 Development Environment Security Standard

CAO-400 Cybersecurity › CAO-490 People and Physical Security Policy › CAO-491 Human Resources Security › CAO-4911 Secure human resources across the employment lifecycle › CAO-49111 Human-resource security applied across the employment lifecycle, including screening, terms of employment and exit.

CAO-491111 · Examine HR security controls to confirm screening, terms and exit procedures are applied.

Method: Examine · Expected evidence: HR screening and exit records

Operational controls: CAO-4911111 Personnel Security Work Instruction

CAO-400 Cybersecurity › CAO-490 People and Physical Security Policy › CAO-492 Security Awareness and Training › CAO-4921 Build security awareness and competence › CAO-49211 Security awareness, education and training delivered and competence maintained.

CAO-492111 · Examine awareness and training records to confirm delivery and competence.

Method: Examine · Expected evidence: Training completion records

Operational controls: CAO-4921111 Security Awareness Training Register

CAO-400 Cybersecurity › CAO-490 People and Physical Security Policy › CAO-493 Physical Security Perimeter and Entry › CAO-4931 Establish physical security perimeters › CAO-49311 Physical security perimeters defined and protected for areas containing sensitive information and systems.

CAO-493111 · Examine physical perimeters to confirm protected areas are defined and secured.

Method: Examine, observe · Expected evidence: Physical perimeter and zoning records

Operational controls: CAO-4931111 Physical Security Zones Register

CAO-400 Cybersecurity › CAO-490 People and Physical Security Policy › CAO-493 Physical Security Perimeter and Entry › CAO-4932 Control physical entry and visitor access › CAO-49321 Physical entry controlled and visitor access authorised, logged and escorted as required.

CAO-493211 · Examine entry and visitor controls to confirm access is authorised, logged and escorted.

Method: Examine, observe · Expected evidence: Access logs and visitor register

Operational controls: CAO-4932111 Visitor Access Register

CAO-400 Cybersecurity › CAO-490 People and Physical Security Policy › CAO-494 Physical Monitoring and Protection › CAO-4941 Monitor and protect physical environments › CAO-49411 Physical environments monitored and protected against unauthorised access and environmental threats.

CAO-494111 · Examine physical monitoring such as CCTV and intrusion detection to confirm environments are monitored.

Method: Examine, observe · Expected evidence: Physical monitoring records

Operational controls: CAO-4941111 Physical Monitoring Register

CAO-400 Cybersecurity › CAO-490 People and Physical Security Policy › CAO-495 Equipment and Media Security › CAO-4951 Secure equipment and supporting utilities › CAO-49511 Equipment sited, protected and maintained, and supporting utilities secured.

CAO-495111 · Examine equipment security and maintenance to confirm equipment is protected and maintained.

Method: Examine, observe · Expected evidence: Equipment maintenance and protection records

Operational controls: CAO-4951111 Equipment Security Register

CAO-400 Cybersecurity › CAO-490 People and Physical Security Policy › CAO-495 Equipment and Media Security › CAO-4952 Securely manage storage media and its disposal › CAO-49521 Storage media managed, protected and securely disposed of across its lifecycle.

CAO-495211 · Examine media handling and disposal records to confirm media is protected and securely disposed.

Method: Examine · Expected evidence: Media inventory and disposal records

Operational controls: CAO-4952112 Secure Media Disposal Work Instruction · CAO-4952111 Media Handling Register