| PDF Pages<\/th>\n | PDF Title<\/th>\n<\/tr>\n | ||||||
|---|---|---|---|---|---|---|---|
| 7<\/td>\n | Introduction <\/td>\n<\/tr>\n | ||||||
| 9<\/td>\n | 1 Scope 2 Normative references 3 Terms and definitions 3.1 General terms <\/td>\n<\/tr>\n | ||||||
| 10<\/td>\n | 3.2 Terms related to organization <\/td>\n<\/tr>\n | ||||||
| 11<\/td>\n | 3.3 Terms related to sectoral approach to cybersecurity <\/td>\n<\/tr>\n | ||||||
| 12<\/td>\n | 3.4 Terms related to risk <\/td>\n<\/tr>\n | ||||||
| 14<\/td>\n | 4 Abbreviations 5 Sectoral Cybersecurity Assessment 5.1 Application of the sectoral cybersecurity assessment methodology <\/td>\n<\/tr>\n | ||||||
| 16<\/td>\n | 5.2 Principles and new capacities <\/td>\n<\/tr>\n | ||||||
| 19<\/td>\n | 6 Sectoral representation of risk 6.1 Sectoral ICT systems 6.1.1 Sectoral ICT system components and their relationships 6.1.2 Multi-layered architecture of sectoral ICT system <\/td>\n<\/tr>\n | ||||||
| 21<\/td>\n | 6.1.3 Risk \u2013based definitions of cybersecurity and assurance requirements in sectoral systems <\/td>\n<\/tr>\n | ||||||
| 22<\/td>\n | 6.1.4 Sectoral ICT system architecture relevance for risk assessment <\/td>\n<\/tr>\n | ||||||
| 23<\/td>\n | 6.1.5 Cybersecurity certification of sectoral ICT systems <\/td>\n<\/tr>\n | ||||||
| 24<\/td>\n | 6.2 Consistent sectoral risk assessment <\/td>\n<\/tr>\n | ||||||
| 25<\/td>\n | 6.3 Performing sectoral risk assessment 6.3.1 General <\/td>\n<\/tr>\n | ||||||
| 26<\/td>\n | 6.3.2 Choosing an approach 6.3.3 Identifying business processes, objectives and requirements 6.3.4 Identifying primary and supporting assets <\/td>\n<\/tr>\n | ||||||
| 27<\/td>\n | 6.3.5 Defining risk scenarios 6.3.6 Assessment of consequences in risk scenarios <\/td>\n<\/tr>\n | ||||||
| 28<\/td>\n | 6.3.7 Assessment of likelihood in risk scenarios <\/td>\n<\/tr>\n | ||||||
| 29<\/td>\n | 6.3.8 Adding the attacker perspective: assessment of attack potential <\/td>\n<\/tr>\n | ||||||
| 30<\/td>\n | 6.3.9 Risk re-assessment for supporting assets 7 Normalized representation of risk, cybersecurity and assurance 7.1 Risk assessment results: meta-risk classes <\/td>\n<\/tr>\n | ||||||
| 31<\/td>\n | 7.2 Risk-based definition of common security levels and selection of controls 7.2.1 General 7.2.2 Introducing Common Security Levels\u00a0(CSL) <\/td>\n<\/tr>\n | ||||||
| 32<\/td>\n | 7.2.3 Applying Meta-risk Classes and Common Security Levels\u00a0for sectoral risk treatment 7.2.4 Attack Potential as criterion for selecting the CSL of controls 7.3 Consistent implementation of assurance 7.3.1 Introduction <\/td>\n<\/tr>\n | ||||||
| 33<\/td>\n | 7.3.2 Definition of a common assurance reference concept based on ISO\/IEC\u00a015408 <\/td>\n<\/tr>\n | ||||||
| 34<\/td>\n | 7.3.3 Applying CTI concept of attack potential to CAR 8 Mapping cybersecurity and assurance requirements to scheme\u2019s representation <\/td>\n<\/tr>\n | ||||||
| 35<\/td>\n | Annex\u00a0A (informative)Examples of normalized scales in sectoral risk assessment A.1 Qualitative approach for assessment of consequences <\/td>\n<\/tr>\n | ||||||
| 36<\/td>\n | A.2 Qualitative approach to likelihood assessment A.3 Qualitative approach to risk estimation <\/td>\n<\/tr>\n | ||||||
| 37<\/td>\n | A.4 Qualitative approach to risk mitigation <\/td>\n<\/tr>\n | ||||||
| 38<\/td>\n | A.5 Addressing meta-risk classes by Common Assurance Reference classification <\/td>\n<\/tr>\n | ||||||
| 39<\/td>\n | Annex\u00a0B (informative)CTI fundamentals B.1 General <\/td>\n<\/tr>\n | ||||||
| 40<\/td>\n | B.2 Attacker types <\/td>\n<\/tr>\n | ||||||
| 41<\/td>\n | B.3 Characteristics of attackers <\/td>\n<\/tr>\n | ||||||
| 45<\/td>\n | B.4 Criteria for attack potential qualitative estimation B.4.1 Characteristics: Opportunity B.4.1.1 Area: System Access\/Knowledge <\/td>\n<\/tr>\n | ||||||
| 47<\/td>\n | B.4.1.2 Area: Vulnerabilities <\/td>\n<\/tr>\n | ||||||
| 49<\/td>\n | B.4.2 Characteristics: Means B.4.2.1 Area: Capabilities and Resources <\/td>\n<\/tr>\n | ||||||
| 51<\/td>\n | B.4.2.2 Area: Skills <\/td>\n<\/tr>\n | ||||||
| 53<\/td>\n | B.4.3 Characteristic: Motives B.4.3.1 Area: Valuation <\/td>\n<\/tr>\n | ||||||
| 54<\/td>\n | B.4.3.2 Area: Goals <\/td>\n<\/tr>\n | ||||||
| 56<\/td>\n | B.5 Estimating Attack potential using CTI approach B.5.1 General B.5.2 Characteristics: Opportunity <\/td>\n<\/tr>\n | ||||||
| 57<\/td>\n | B.5.3 Characteristics: Means B.5.4 Characteristics: Motives <\/td>\n<\/tr>\n | ||||||
| 58<\/td>\n | B.5.5 Calculation of attack potential level (APL) B.5.6 Finding equivalence between CTI and ISO\/IEC\u00a018045 for the attack potential estimation <\/td>\n<\/tr>\n | ||||||
| 61<\/td>\n | Annex\u00a0C (informative)Application of Common Security Level approach – examples C.1 General C.2 Example use case: Mobile device-based authentication system <\/td>\n<\/tr>\n | ||||||
| 63<\/td>\n | C.3 Example use case: Protection against cloned devices and cheating vendors <\/td>\n<\/tr>\n | ||||||
| 65<\/td>\n | Annex\u00a0D (informative)Example of assurance level mapping <\/td>\n<\/tr>\n<\/table>\n","protected":false},"excerpt":{"rendered":" BS EN 18037 Guidelines on a sectoral cybersecurity assessment<\/b><\/p>\n |