Operations Security
What is Operations Security?
The process of protecting unclassified information that could be used by adversaries to piece together sensitive operational activities.
Terms that appear alongside operations security
Each of these is named in at least one of the same controls as operations security. The number is how many controls name both.
- vulnerability 9 shared controls
- malware 8 shared controls
- audit 8 shared controls
- nist 7 shared controls
- backup and recovery 6 shared controls
- encryption 2 shared controls
- secure configuration 2 shared controls
- network segmentation 2 shared controls
Frameworks that govern operations security
What the standards actually require on operations security
Requirements naming operations security across 6 standards, quoted from the control text.
Applies operations security to acquisition so that adversaries cannot learn what is being bought, from whom and when.
161R1-SR-7 · Supply Chain Operations Security →Operations Security. Employ the following operations security controls to protect key organizational information throughout the system development life cycle: [organization-defined]
NIST800-SC-38 · Operations Security. Employ the following operations security controls to protect key organizational information throughout the system development life cycle: [organization-defined] →Institutions shall implement security measures in ICT operations, including configuration and hardening, protection against malware, vulnerability and patch management, and encryption of data in transit and at rest as appropriate.
EBA-GL-3.4.4 · ICT operations security →Undertakings implement procedures ensuring CIA of ICT systems and services: vulnerability identification and remediation (patching, antivirus, compensating controls); secure configuration baselines;
EIOPA-ICTSG-GL.10 · ICT operations security →ISMAP Cloud Operations covers the day-to-day security operations of cloud services. (1) Cloud Security Monitoring and Logging: 24x7 Security Operations Center (SOC) + SIEM Security Information and Event Management (Splunk + Microsoft Sentinel + IBM QRadar + Su...
ISMAP-CloudOperations-Monitoring-Logging-IncidentResponse-NISC-Reporting-Vulnerability-Change-SLA · ISMAP Cloud Operations - Security Monitoring + SIEM + Logging + Incident Response + NISC Reporting + Vulnerability Management + Penetration Testing + Change Management + SLA Management →Audit considerations. Control from ISO 27043 framework, domain: ISO 27043: Operations Security.
ISO27043-26 · Audit considerations →Questions people ask about operations security
What is Operations Security?
Why is Operations Security important for compliance?
Which compliance frameworks address Operations Security?
Where can I learn more about Operations Security?
See how Operations Security applies across compliance frameworks
Our platform maps 686 frameworks with 311K cross-framework control mappings. Explore how this concept is addressed across standards.