What Changed In This Release
- Added 7 controls: GOV-02.1 Exception Management, RSK-01.5 Risk Appetite, RSK-03.1 Risk Catalog, SEA-01.2 Achieving Resilience Requirements, THR-09 Threat Catalog, THR-10 Threat Analysis and VPM-03.1 Vulnerability Exploitation Analysis.
- Updated the risk and threat models to help with risk and threat assessments and with materiality decisions for incidents, threats and risks. Updated the Data Privacy Management Principles (DPMP).
- Added mapping for 20 laws, regulations and frameworks, including the Australia Essential Eight, Canada OSFI B-13, CMMC 2.1 (draft), FedRAMP R5, NIS2, NIST CSF 2.0 (initial public draft), PCI DSS Self-Assessment Questionnaires and the SEC Cybersecurity Rule. Removed Shared Assessments SIG 2022 and SWIFT CSF 2021.
- Standardized terminology, for example Third-Party Service Provider (TSP) became External Service Provider (ESP) and Minimum Compliance Criteria (MCC) became Minimum Compliance Requirements (MCR).
- Wordsmithed the GOV, CFG, MNT and PRI policies and 11 controls, and renamed 30 controls.
- Updated 136 standards and the guidance for 121 controls.
- Updated mappings for NIST SP 800-53 R5, NIST SP 800-172, FAR 52.204-21 and PCI DSS 4.0.
Did You Purchase An Older Version Of This Product?
Releases from before 2024 are significantly out of date. Existing customers are encouraged to repurchase the current version at 50% of the original product price.