Command and Control
What is Command and Control?
The infrastructure and communication channels used by attackers to maintain remote control over compromised systems within a target network.
Terms that appear alongside command and control
Each of these is named in at least one of the same controls as command and control. The number is how many controls name both.
- cybersecurity 3 shared controls
- threat hunting 2 shared controls
- mitre 2 shared controls
- cisa 2 shared controls
- incident response 2 shared controls
- governance 2 shared controls
Frameworks that govern command and control
What the standards actually require on command and control
Requirements naming command and control across 6 standards, quoted from the control text.
To support effective PAP management in line with its policy, objectives and programmes, the organization should define, document and communicate roles, accountabilities, responsibilities and authorities.
ansi-asis-pap-1-2012-physical-asset-protection::A.6.1 · A.6.1 Roles, authority, cross-functional teams and command and control →The civil space cybersecurity requirements that Interior, Commerce and NASA recommend for FAR contract language take a risk-based, tiered approach for all new civil space systems, apply at least to on-orbit and link segments, and for the highest-risk tier prot...
us-executive-order-14144-strengthening-and-promoting-innovation-in-the-nations-cybersecurity::3(e)(i)(A) · Sec. 3(e)(i)(A) (now 3(c)(i)(A)) Protect civil space command and control →Establish [Assignment: organization-defined alternate communications paths] for system operations organizational command and control.
NIST800-SC-47 · SC-47 Alternate Communications Paths →All ECO members, including deputies, must be trained for the duties in the procedures, with enough people trained in each position to cover absences, and training must include exercises and assessment.
as-3745-2010-planning-for-emergencies-in-facilities::6.3 · Train every ECO member, with extra training for senior roles, first-attack firefighters and response teams →The organization must keep procedures that identify the disruptive incidents that could affect it, its activities, functions and services, its stakeholders and the environment, recording how it will prevent them, get ready for them and respond to them;
asis-spc-1-2009-organizational-resilience-standard::4.4.7 · 4.4.7 Incident prevention, preparedness and response procedures covering the twenty needs, reviewed after incidents, with competent personnel →How controls operate, including monitoring and testing evidence, is reviewed to make sure the controls inside business processes work effectively, with activities that keep evidence of effectiveness through means such as periodic tests, ongoing monitoring, ind...
cobit-2019::MEA02.02 · MEA02.02 Review effectiveness of business process controls →Questions people ask about command and control
What is Command and Control?
Why is Command and Control important for compliance?
Which compliance frameworks address Command and Control?
Where can I learn more about Command and Control?
See how Command and Control applies across compliance frameworks
Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.