Operations Security
What is Operations Security?
The process of protecting unclassified information that could be used by adversaries to piece together sensitive operational activities.
Terms that appear alongside operations security
Each of these is named in at least one of the same controls as operations security. The number is how many controls name both.
- vulnerability 9 shared controls
- malware 8 shared controls
- audit 8 shared controls
- nist 7 shared controls
- backup and recovery 6 shared controls
- encryption 2 shared controls
- secure configuration 2 shared controls
- network segmentation 2 shared controls
Frameworks that govern operations security
What the standards actually require on operations security
Requirements naming operations security across 6 standards, quoted from the control text.
The organisation uses defined operations security controls to protect supply chain-related information for the system, component or service. No enhancements.
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::SR-07 · SR-07 Supply chain operations security →For all ICT assets, entities under Article 16(1) must manage the asset lifecycle; check whether assets are supported by their ICT third-party providers; identify capacity needs and prevent shortages;
dora-rts-on-ict-risk-management-framework-commission-delegated-regulation-eu-2024-1774::34 · Article 34: ICT operations security (simplified framework) →Applies operations security to acquisition so that adversaries cannot learn what is being bought, from whom and when.
161R1-SR-7 · Supply Chain Operations Security →Employ the following operations security controls to protect key organizational information throughout the system development life cycle: [Assignment: organization-defined operations security controls].
NIST800-SC-38 · SC-38 Operations Security →Undertakings implement procedures ensuring CIA of ICT systems and services: vulnerability identification and remediation (patching, antivirus, compensating controls); secure configuration baselines;
EIOPA-ICTSG-GL.10 · ICT operations security →ISMAP Cloud Operations covers the day-to-day security operations of cloud services. (1) Cloud Security Monitoring and Logging: 24x7 Security Operations Center (SOC) + SIEM Security Information and Event Management + UEBA User and Entity Behaviour Analytics + S...
ISMAP-CloudOperations-Monitoring-Logging-IncidentResponse-NISC-Reporting-Vulnerability-Change-SLA · ISMAP Cloud Operations - Security Monitoring + SIEM + Logging + Incident Response + NISC Reporting + Vulnerability Management + Penetration Testing + Change Management + SLA Management →Questions people ask about operations security
What is Operations Security?
Why is Operations Security important for compliance?
Which compliance frameworks address Operations Security?
Where can I learn more about Operations Security?
See how Operations Security applies across compliance frameworks
Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.